painthy.com Open in urlscan Pro
45.130.41.84 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://painthy.com/travel-insurance-online-in-2023/
Submission: On December 22 via manual (December 22nd 2023, 9:38:24 am UTC) from IE — Scanned from DE

Summary HTTP 289 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 28 IPs in 6 countries across 20 domains to perform 289 HTTP transactions. The main IP is 45.130.41.84, located in St Petersburg, Russian Federation and belongs to BEGET-AS, RU. The main domain is painthy.com.
TLS certificate: Issued by R3 on December 2nd 2023. Valid for: 3 months.

This is the only time painthy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	45.130.41.84 45.130.41.84	198610 (BEGET-AS) (BEGET-AS)
6	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
57	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
7	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
4 26	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
47	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
34	2a00:1450:400... 2a00:1450:4001:82a::2006	15169 (GOOGLE) (GOOGLE)
8	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
4 8	34.251.137.37 34.251.137.37	16509 (AMAZON-02) (AMAZON-02)
6 7	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
3 5	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
2	2.16.97.41 2.16.97.41	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
2	91.134.110.137 91.134.110.137	16276 (OVH) (OVH)
6	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
7	2600:9000:211... 2600:9000:211e:da00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	2600:1f18:1ac... 2600:1f18:1aca:4282:f6ab:e265:5899:7930	14618 (AMAZON-AES) (AMAZON-AES)
1	64.233.184.156 64.233.184.156	15169 (GOOGLE) (GOOGLE)
2	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
289	28

24 45.130.41.84 (St Petersburg, Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: ssl.codia2.beget.com

painthy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

47 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:82a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.251.137.37 (Dublin, Ireland) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-137-37.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.184.194 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.36.155 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.123 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.16.97.41 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-16-97-41.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.75.62.37 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.134.110.137 (France)

ASN16276 (OVH, FR)
PTR: ip137.ip-91-134-110.eu

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:211e:da00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2600:1f18:1aca:4282:f6ab:e265:5899:7930 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.184.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wa-in-f156.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
104	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	980 KB
42	doubleclick.net 10 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 515 bid.g.doubleclick.net — Cisco Umbrella Rank: 840 ad.doubleclick.net — Cisco Umbrella Rank: 139	422 KB
40	adsafeprotected.com 4 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 900 static.adsafeprotected.com — Cisco Umbrella Rank: 602 dt.adsafeprotected.com — Cisco Umbrella Rank: 567	415 KB
34	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	2 MB
24	painthy.com painthy.com	407 KB
15	gstatic.com fonts.gstatic.com www.gstatic.com	177 KB
9	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	579 KB
8	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	5 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578	3 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	57 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	2 KB
2	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 622	326 B
2	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	1 KB
2	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1299	326 B
2	openx.net us-u.openx.net — Cisco Umbrella Rank: 491	400 B
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2814 pixel.wp.com — Cisco Umbrella Rank: 2796	3 KB
1	yahoo.com ups.analytics.yahoo.com — Cisco Umbrella Rank: 307	125 B
1	w.org s.w.org — Cisco Umbrella Rank: 3043	661 B
0	spotxchange.com Failed sync.search.spotxchange.com Failed
289	20

	Domain	Requested by
57	pagead2.googlesyndication.com	painthy.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com fw.adsafeprotected.com www.googletagservices.com
47	tpc.googlesyndication.com	googleads.g.doubleclick.net painthy.com tpc.googlesyndication.com pagead2.googlesyndication.com
34	s0.2mdn.net	googleads.g.doubleclick.net painthy.com s0.2mdn.net
26	googleads.g.doubleclick.net	4 redirects pagead2.googlesyndication.com painthy.com googleads.g.doubleclick.net
25	dt.adsafeprotected.com	googleads.g.doubleclick.net
24	painthy.com	painthy.com
9	www.googletagservices.com	googleads.g.doubleclick.net painthy.com
8	fw.adsafeprotected.com	4 redirects googleads.g.doubleclick.net painthy.com
8	www.googleadservices.com	googleads.g.doubleclick.net painthy.com
8	www.gstatic.com	googleads.g.doubleclick.net
7	static.adsafeprotected.com	googleads.g.doubleclick.net
7	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
7	fonts.gstatic.com	fonts.googleapis.com
6	googleads4.g.doubleclick.net	painthy.com googleads.g.doubleclick.net
6	fonts.googleapis.com	painthy.com googleads.g.doubleclick.net
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
4	cdnjs.cloudflare.com	s0.2mdn.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
2	ad.doubleclick.net	painthy.com
2	rtb-csync.smartadserver.com	googleads.g.doubleclick.net
2	www.google.com	1 redirects tpc.googlesyndication.com
2	sync.teads.tv	googleads.g.doubleclick.net
2	us-u.openx.net	googleads.g.doubleclick.net
1	bid.g.doubleclick.net	googleads.g.doubleclick.net
1	ups.analytics.yahoo.com	googleads.g.doubleclick.net
1	s.w.org	painthy.com
1	pixel.wp.com	painthy.com
1	stats.wp.com	painthy.com
0	sync.search.spotxchange.com Failed	googleads.g.doubleclick.net
289	29

This site contains links to these domains. Also see Links.

Domain
gulfjab.com
yesijob.com
itjobzy.com
gointer.ru
feedbegin.com
www.facebook.com
twitter.com
plus.google.com
pinterest.com
www.linkedin.com
www.tumblr.com

Subject Issuer	Validity	Valid
painthy.com R3	`2023-12-02` - `2024-03-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.w.org Sectigo ECC Domain Validation Secure Server CA	`2023-12-18` - `2025-01-17`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
teads.tv R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-03` - `2024-01-24`	6 months	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-07`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 38 frames:

Primary Page: https://painthy.com/travel-insurance-online-in-2023/
Frame ID: 132A3A92E816879809A190B3E4DC6880
Requests: 39 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup_fy2021.html
Frame ID: 846A029283FBFD025BAAEE00A66E17FE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&adk=1812271804&adf=3025194257&lmt=1703237899&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x675_r&format=0x0&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899365&bpp=3&bdt=765&idt=225&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5850829227916&frm=20&pv=2&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=237
Frame ID: 3AC26878B9AB450DB84378FFBB529655
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=280&slotname=6557565023&adk=2167923837&adf=2546238867&pi=t.ma~as.6557565023&w=760&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=760x280&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899368&bpp=1&bdt=767&idt=236&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=239
Frame ID: 239C48149D678AF1654FFE0317167AAA
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=8984148311&adk=3498851007&adf=1704752105&pi=t.ma~as.8984148311&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899369&bpp=1&bdt=769&idt=243&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=1341&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=245
Frame ID: C56B8963F39D045E5BEC0B733A4EA098
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=3047912464&adk=2012044130&adf=2599789896&pi=t.ma~as.3047912464&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899370&bpp=1&bdt=770&idt=246&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2842&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=247
Frame ID: 3AC463C6AAF31BB1E86F6B59F2ED1602
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Frame ID: AE22C82CDEC5D99C0040330A0CF54AD3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=1118&slotname=9671647671&adk=1459535944&adf=2219702706&pi=t.ma~as.9671647671&w=325&cr_col=1&cr_row=13&fwrn=2&lmt=1703237899&rafmt=9&format=325x1118&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&crui=image_sidebyside&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=272&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190%2C325x250&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=410&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&fsb=1&dtd=273
Frame ID: D60189CA3D123C39BEE37F6EC9657630
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 6179B50FA04BDC56A55C5F59D58CDE17
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 6FD871D09D70327A51B3012CEF62D339
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: D2B279DA93CD96C1203F92DAB38F819A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 3482381331FC45F22AFDE5E6DB23753A
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXrxKpWxUvN0r52rMsCZj-Z2YbP5ID-SutXZuKLnTFBhAYDxR4vtmPOAuVZpJ5wsIKaH2GznQznmCfTzBH8sM5oEgg_OxQlSNdD6I9CH4H2EZsC0APdzBqzkX4IQVDmTf-Bea4T_JMZc8tIzMNN6FToXuotcjIGmNW9_Qmou_wFPcQjewM
Frame ID: 93DFCAAA40406D3CE5EB42436C055C66
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: DE38A9AA212B6F23D3E6E82E9E7C7174
Requests: 26 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs
Frame ID: 0D4CEE08279B7378680AA260B5246174
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: F2562A44F1D67C9A51CA6B5304EAF659
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjMrI38ATAB&v=APEucNU-cUaO_ENpj-N2gFCvkBypcYpdS1GM32h2CXla8E_eFwJ5eSo4Xkg1A5s4F8qX6HfqQ3-J8h66aJqOdv9NA-hcFO6leqZ-CqKTh6CSAg06NtkMzcC2eH_2ZVQvnKd188rghw7820x6BLFhMxaFzUhoDbdcBa8_p9pN9rTBLIh1mjHmWMM
Frame ID: A16A18D2C4B40213128DD2B451DD6B08
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNWNiYACMAE&v=APEucNWL5IOJtvzW3I44LNOGTtbcSG3UQazT1bOr1y4CoNJS7XcFp1Hh-ZZrrP4HbhheDbWGbJ2w67PFTnhbYHIe81K1hWHV7dvJxb7DyPrkDzL8cIw4U7nTgUfQVy6rx-YtRU9aFbJFBj5aOLiB0DZXP1sXQh0NE9dwpeE4ThM06Vw_wlWTtYs
Frame ID: FEC5E29E0A47E791DDE2C710248336BD
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 4C701B198D1E40DDA86171FEE3EA28FB
Requests: 26 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 5BA951784548BBC605F59D5B75B030A5
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 765EBAF84018098A678B6174A0F5A9D4
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: BD0FFCE9BFF31E8F486C1AEC0A97F192
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: DA2EE95ECAD1D6D0D22F56C2126C1C26
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 4C480C4DBE86CAE52E998C3A936C3602
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 0A4CD91CF406F77E8211FE7FA071E630
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 8DC19195C1B811AA125CD5095460AE78
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
Frame ID: 3B4EC8069F53B941021D22754664D56A
Requests: 14 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 55D7FB18231B90DEDE7E47C70FF6AD06
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 66F12E2FFD2805242300D779D641817F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 2D36A5AFA8B2FAAD0142ED0042D1AFD1
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: A69B6F2C6B9ACAA80B9D2139353ACBDF
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
Frame ID: FFDCA19111C8BDF4C112D86B0E03E6D6
Requests: 14 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 81084348BEBA08685D74D0FACC0C8385
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: E48FB4CEDA8F051E4CAFEBE2807BAF2B
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 46E14127911E34C4BA9B122F495C918F
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250
Frame ID: 489A534864F0EA426592588BDD5A4E43
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: BEF35ACF2229C5CF30F994A1DA5A2DCB
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2A4F8C0B08476B78308B071ACE3D7E02
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

10 Essential Tips for Buying Travel Insurance Online in 2023

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

289
Requests

94 %
HTTPS

44 %
IPv6

20
Domains

29
Subdomains

28
IPs

6
Countries

4792 kB
Transfer

11328 kB
Size

13
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://gulfjab.com/visa-sponsorship-jobs-in-qatar/
Title: Visa Sponsorship Jobs In Qatar 2023-2024

Search URL Search Domain Scan URL

URL: https://yesijob.com/luxembourg-visa-sponsorship-jobs/
Title: Luxembourg Visa Sponsorship Jobs In 2023-2024

Search URL Search Domain Scan URL

URL: https://yesijob.com/stork-jobs-usa-uk-netherlands-canada/
Title: Vice President, Corporate Finance- Industrials, Investment Banking

Search URL Search Domain Scan URL

URL: https://yesijob.com/kpmg-jobs-openings-in-uae-oman-2023/
Title: Director, Digital Management and Transformation Execution

Search URL Search Domain Scan URL

URL: https://yesijob.com/exxonmobil-oil-energy-jobs-usa-uk-singapore/
Title: Manager, Collaboration – Meetings, Video & Voice

Search URL Search Domain Scan URL

URL: https://yesijob.com/atlas-professionals-job-singapore-norway/
Title: Manager, Finance & Accounting

Search URL Search Domain Scan URL

URL: https://yesijob.com/saipem-worldwide-jobs-saudi-arabia-italy/
Title: Audit CIPS Arabic Manager

Search URL Search Domain Scan URL

URL: https://yesijob.com/qatar-energy-jobs-qatarenergy-careers/
Title: Alliance Lead – Microsoft

Search URL Search Domain Scan URL

URL: https://yesijob.com/maersk-careers-uae-qatar-ksa-usa-uk-canada/
Title: Senior Consultant

Search URL Search Domain Scan URL

URL: https://yesijob.com/qatar-fuel-jobs-2023-woqod-qatar-job-vacancies/
Title: Associate Manager 3 – External Audit (Banking)

Search URL Search Domain Scan URL

URL: https://gulfjab.com/abb-jobs-uae-ksa-usa-uk-india-singapore/
Title: ABB Jobs UAE, KSA, USA, UK, India, Singapore, Malaysia, Canada

Search URL Search Domain Scan URL

URL: https://itjobzy.com/stantec-careers-uae-qatar-ksa-usa-uk/
Title: Stantec Careers: UAE, Qatar, KSA, USA, UK, India, Bahrain, Canada

Search URL Search Domain Scan URL

URL: https://gointer.ru/maersk-careers-uae-qatar-ksa-usa-uk-india/
Title: Maersk Careers UAE, Qatar, KSA, USA, UK, Singapore, Canada, India

Search URL Search Domain Scan URL

URL: https://yesijob.com/al-naboodah-careers-in-dubai-jobs-in-uae/
Title: Field Sales Executive

Search URL Search Domain Scan URL

URL: https://yesijob.com/drydocks-world-jobs-in-dubai-uae-jobs/
Title: Assistant Distributor Manager General Trade – Abu Dhabi

Search URL Search Domain Scan URL

URL: https://yesijob.com/highest-paying-jobs-in-dubai-in-2023/
Title: Assistant Distributor Manager General Trade – Dubai

Search URL Search Domain Scan URL

URL: https://yesijob.com/loan-jobs-in-dubai/
Title: Customer Service Executive

Search URL Search Domain Scan URL

URL: https://yesijob.com/google-apprenticeship/
Title: Google Apprenticeship Recruitment For Freshers In 2023

Search URL Search Domain Scan URL

URL: https://feedbegin.com/hiring-insurance-agents-in-austria/
Title: Hiring Insurance Agents in Austria: 65000 EUR + Benefits

Search URL Search Domain Scan URL

URL: https://yesijob.com/best-mortgage-refinance-companies/
Title: Associate Brand Manager, Degree Innovation

Search URL Search Domain Scan URL

URL: https://yesijob.com/mortgage-broker-for-refinancing/
Title: Machine Operator/C-shift (Independence, MO)

Search URL Search Domain Scan URL

URL: https://yesijob.com/kpmg-jobs-uae-qatar-saudi-arabia-usa/
Title: Global Procurement Logistics & Indirects Assistant Manager – Elida Beauty at Unilever

Search URL Search Domain Scan URL

URL: https://yesijob.com/hilti-jobs-uk-usa-singapore-malaysia/
Title: Maintenance Technician/Team Line Lead – Hellmann’s

Search URL Search Domain Scan URL

URL: https://yesijob.com/velesto-energy-drilling-jobs-in-malaysia/
Title: Digital Commerce Category Strategy Lead, Home Care MYSG

Search URL Search Domain Scan URL

URL: https://yesijob.com/accenture-jobs-dubai-qatar-usa-uk-india/
Title: IT Analyst – Directly Consumed Services

Search URL Search Domain Scan URL

URL: https://yesijob.com/jpmorgan-careers-uae-ksa-canada/
Title: Brand Manager, Premium Ice Cream Innovation SEA

Search URL Search Domain Scan URL

URL: https://yesijob.com/johnson-controls-careers-uae-usa-uk-canada/
Title: Supply Planning Assistant Manager

Search URL Search Domain Scan URL

URL: https://yesijob.com/keppel-corporation-singapore-jobs/
Title: Global Brand Manager Sunlight Lead

Search URL Search Domain Scan URL

URL: https://yesijob.com/jobs-in-singapore/
Title: Finance Business Partner – Indonesia (1 year contract)

Search URL Search Domain Scan URL

URL: https://yesijob.com/capgemini-job-vacancies-exciting-engineering/
Title: UI Assistant Business Development Manager – French Islands

Search URL Search Domain Scan URL

URL: https://yesijob.com/aibel-offshore-wind-jobs-singapore-norway/
Title: E-Commerce Executive

Search URL Search Domain Scan URL

URL: https://yesijob.com/switzerland-jobs-free-swiss-work-visa/
Title: Switzerland Jobs 2023 With Free Swiss Work VISA

Search URL Search Domain Scan URL

URL: https://gulfjab.com/high-paying-hsbc-careers-in/
Title: 10 High-Paying HSBC Careers in 2023: A Comprehensive Guide

Search URL Search Domain Scan URL

URL: https://gulfjab.com/visa-sponsorship-jobs-in-dubai-foreigners/
Title: Visa Sponsorship Jobs in Dubai for Foreigners 2023/2024

Search URL Search Domain Scan URL

URL: https://itjobzy.com/visa-sponsorship-jobs-in-turkey-foreigners/
Title: Visa Sponsorship Jobs in Turkey for foreigners 2023/2024

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://painthy.com/travel-insurance-online-in-2023/

Search URL Search Domain Scan URL

URL: http://twitter.com/home?status=https://painthy.com/travel-insurance-online-in-2023/%20-%2010%20Essential%20Tips%20for%20Buying%20Travel%20Insurance%20Online%20in%202023

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://painthy.com/travel-insurance-online-in-2023/

Search URL Search Domain Scan URL

URL: http://pinterest.com/pin/create/button/?url=https://painthy.com/travel-insurance-online-in-2023/&media=https://painthy.com/wp-content/uploads/2023/06/Travel-Insurance-Online-painthy.com_.jpg

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://painthy.com/travel-insurance-online-in-2023/&title=https://painthy.com/travel-insurance-online-in-2023/

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share/link?url=https://painthy.com/travel-insurance-online-in-2023/&name=https://painthy.com/travel-insurance-online-in-2023/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://googleads.g.doubleclick.net/pagead/adview?ai=C-gP8C1mFZdjhKsjarr4Pz4aboAGEs6b0dICliZyrEbTrkoaCPxABILausZABYJWCgICYB6ABmdqBwgPIAQmpAtYcMLJqdLI-qAMByAPLBKoE9AFP0F9LvMMHZu4NUH3-0xmXl2yrF32FKYmY063UisvvoDuA8nBaYlBkLVyH6M4oA9IrMCElMfTlKugAF1GfShWrErBcHnWWP_0ge-wxQZcWidYWI9G8UL0rsaDhY3P7uXn4oC_RakesaBSscqFUkvY1ErT1ahB05HAo3jfNNHd9mBaYLP6Z-7kWf_zEB9d-HjYOzN_natKeXFJuHgR-rRUEvF9MTEToWivlZgS25nzfdAvHWd9jURpDOWWx_IvCIN6OuObJLA8N9z0r2ZyTzsQhr5Th0ndRPjysJ2C8jbJfZ4wiJN5EpAK8GvsDymvOOJdZytIwwATr3K-yyQSIBd-j7PZLkgUECAQYAZIFBAgFGASgBi6AB8-l_j2oB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBD1yCjSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIXY58_fooMDmgnBAWh0dHBzOi8vd3d3LnNhcnRvcml1cy5jb20vZW4vcHIvbWVkaWNhbC1kZXZpY2VzL2ltcGFjdC1vZi1pdmQtcmVndWxhdGlvbnMtb24tbWFudWZhY3R1cmluZz91dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZ1dG1fY2FtcGFpZ249bWVkaWNhbC1kZXZpY2VzJnV0bV90ZXJtPWRpc3BsYXktYWRzJnV0bV9jb250ZW50PWRpc3BsYXmACgHICwGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQK4E-QD2BMNiBQC0BUBgBcBshccChoIABIUcHViLTk3NzkxMzQ4MzU0ODk3ODEYAA&sigh=8O5AkiHBA3M&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwAvHhf_e16YqZAdX6-dW_TEkCJG8c8bimn1Cwyuz9yboJ8Qg7-qITFk0hncgF8nkt55_kMkcQlpMFZF4SXCJZj9UnNep9pcOdoTfiA1BicYAQ&template_id=484&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213284667959753477026%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22943746329%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227281429165560439281%22}&andc=true

Request Chain 101

https://googleads.g.doubleclick.net/pagead/adview?ai=CfFmDC1mFZfreLKinhQaqzq-oBfzy3Op0v-Lw2LES19aivcABEAEgtq6xkAFglYKAgJgHoAGgk6qHA8gBBqkC1hwwsmp0sj6oAwGqBPwBT9DneZ8L7ouZ8dxnJO6etGuSaWpU2wB8cMEI-JqJ0foi-3owFCaAPQxyVC6r-1J9xRwqL1F8BevWGr4S-1QuMdDuMeFyjCKFys5nPHcI8IKoF6jVnF1VnJQxrG6YMfnaBJ_cGpxC3szX8dLqro8tltDsBk-iUat2cK-bNsqUnm5c-f7irufeldmizf8RidPFg_49AxyqSZQc9PfQ5qIftwjbWY3cVdzk3ukDZ9YIM_Tr2K5h8yIf5VF5ODMgTlzEfB3kGMae-cTcdfLwujRHr0r0IZW-zgT7YXduZJ9LEm_K9NvKEo4gzKBXFxs-TL-D5gvrffEsgDqoKh6wwASemr_XvATgBAOIBY7do51NkgUGCAMQBRgFkgUGCBsQARgBkgULCCIQAhgBSMaSkQKSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBjeAB8js1XioB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHCxCHr5sBGK26iYIC0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOlj0o-nP36KDA5oJ8AFodHRwczovL3d3dy5vMm9ubGluZS5kZS9lLXNob3AvYXBwbGUvYXBwbGUtaXBob25lLTE1LXByby1tYXgtMjU2Z2ItdGl0YW4tbmF0dXItZGV0YWlscy8_emllbGdydXBwZT1wcml2YXRrdW5kZW4mdGFyaWY9bzItbW9iaWxlLW0mcGFydG5lcklkPSVlZXhjaWQhJm1lZGl1bT1kaXNwbGF5Jm1lZGlhY29kZT0wXzBfMF8wXy0wJnV0bV90ZXJtPTBfMF8wXzBfLTAmcmVmPTBfMF8wXzBfLTAmdXRtX2NvbnRlbnQ9JWVleGNpZCGACgHICwGiDBAqDgoM5LSxAu61sQK1uLECsBPniOsVyBOryOfjA9gTDYgUAdgUAdAVAYAXAbIXHAoaCAASFHB1Yi05Nzc5MTM0ODM1NDg5NzgxGAA&sigh=dwn-_8KDb0A&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_FOfV_tQmAp5jJelgnMIx6YBCw8TkIiiLBbGWE7MisKWWMcoXafC3fGNtxEH0DSJhgFgoNzVlJAsMv_R0fIkmihs_vogic5OMbxgB&template_id=509&vt=10&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225117499128113796754%22,%22debug_reporting%22:true,%22destination%22:%22https://o2online.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22820677024%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229890198698843148129%22}&andc=true

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1&C=1

Request Chain 134

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZYVZDZmaR6fgqmQgRY9Q8QAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEOlHcJczz3eUHySXE9b5tss&google_cver=1

Request Chain 136

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTI2MjUwOTA4NjAzNzAwNA%3D%3D

Request Chain 138

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHIMUZnAzGs_f0OM71gSVww&google_cver=1

Request Chain 140

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEEXYDr95UkYJ4X_RuDOxotA&google_cver=1

Request Chain 142

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEA8yDaIwAz6cDrPFVk-rlwc&google_cver=1

Request Chain 145

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 146

https://googleads.g.doubleclick.net/pagead/adview?ai=Cx5OgC1mFZcTxKumjrr4P7aCS0AGEs6b0dIqKosurEte1usTMQRABILausZABYJWCgICYB6ABmdqBwgPIAQmpAtYcMLJqdLI-qAMByAPLBKoE9AFP0Dm-aQHk-qjoB5HFFjo13-bglDEHAZAxN8-BJPtvwuf87uUOj9CmaHc8OXtqzS8LRz6YL2XDB7eBL5Qzl0rqbXsyftwpv9lEWngEVRRlnMBXSUJDXdEcafkkNVRc7YNAYCwIRMmnsCrhivloj0o6E2rkZZik8IGS7_5ash5dLKDbFRQUge3Yoahp019--Ek17SLVwiWhEnHDTiVl5P-2qpSVWGY4ceZZVtb7CBlm8RjLjL6fmZKNeLA7lMIHvSYnpFf3HEvTsv62v3q6pCccFM5lqQ3VxhRtG6PoFwM2ZW7wn0gzmfNt3kf225O3K-ZD4kQCwASFhJ7-twSIBd-j7PZLkgUECAQYAZIFBAgFGASgBi6AB8-l_j2oB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDp1RzSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WPbj58_fooMDmgnXAWh0dHBzOi8vd3d3LnNhcnRvcml1cy5jb20vZW4vcHIvbWVkaWNhbC1kZXZpY2VzL2NvbnNpc3RlbmN5LWluLXBoeXNpY2FsLWRhdGEtb2YtdW5pc2FydC1jbi1tZW1icmFuZXMtd2hpdGUtcGFwZXI_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPW1lZGljYWwtZGV2aWNlcyZ1dG1fdGVybT1kaXNwbGF5LWFkcyZ1dG1fY29udGVudD1kaXNwbGF5gAoByAsBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxArgT5APYEw3QFQGAFwGyFxwKGggAEhRwdWItOTc3OTEzNDgzNTQ4OTc4MRgA&sigh=gtMpxO2Thvk&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf__0oyCyFd_LpWAkUqH5SjmTY2fnnKdan6A8F77MX60889nlojrMvVMn3FLF_2aKWG-HUDRvQL9rl2wtMjHqtQnVZxom-h8jXHvCIYAQ&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228675181594955593168%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22943746329%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226532415816374557105%22}&andc=true

Request Chain 147

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEA7epZ2a-DKmc8h_LnTneSQ&google_cver=1

Request Chain 150

https://googleads.g.doubleclick.net/pagead/adview?ai=C3HOuC1mFZaTgKtvHrr4PwPKW6AvfhsDPdMb03bGwEY7Pv9LFMRABILausZABYJWCgICYB6AB77CF3CjIAQmpAtYcMLJqdLI-qAMByAPLBKoE-AFP0HhLy9WXg45yvVCcixvEIrwCK_2zI7ZG_-Zb3gmVxrOqub2H08t_DdcCTVY9aFuV8ScTZ8tarkY5QjqgkFzF4Ipp4wmsbvcFJLtlLYRnIpK0HfAkS7eKT-ioaqaot1cULon0C_Sqcsl5sK5dsxrSiG5nWBSHwLgsdXB68igYMqpI83sQwNUgirMpm4OcJcQ9e1UXAJx9u-wvEVJcqGOMraESP_tD_wPYTZ2oq_QWsN0bs9EPX1C9Om4hX-MwJTXtXoQP8yUrIvEEeN7SX3I-usO4eAvhQif0BKcVm8m_qHYceBYAbQSZH58CWVO_FzvvMGvm4hrYvcAEl82RjJIEiAXdorfEQpIFBAgEGAGSBQQIBRgEoAYugAfv6NW7A6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEPnfMNIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY9N3nz9-igwOaCSJodHRwczovL21ldml5Lm1pc3VtaS1lYy5jb20vZGUtZGUvgAoByAsBogwUKhIKEOS0sQLutbECtbixAru7sQK4E-QD2BMNiBQB0BUBmBYBgBcBshccChoIABIUcHViLTk3NzkxMzQ4MzU0ODk3ODEYAA&sigh=SS5FPqy0t9w&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwAvHhf_66AOzxdWdI8_viWB7S5j2j6-rkhavFG942dPjGAzFMnCqxn-p5XgnZBT14APD7bRN1aRsKyFAztQk9pLRUvFRZfSoYzXLnAytHUYAQ&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218093280926742710065%22,%22debug_reporting%22:true,%22destination%22:%22https://misumi-ec.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210930444399%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214379317452156963505%22}&andc=true

Request Chain 176

https://fw.adsafeprotected.com/rfw/st/1627455/73523888/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0jUOjcb7QpH6-_mKM7EWtiB&adContainerId=brand_safety_DVmFZbIB_KmO7A-L7ZnQCw&cbFunctionName=goog_wrapCb_DVmFZbIB_KmO7A-L7ZnQCw&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fpainthy.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fpainthy.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271804%26client%3Dca-pub-9779134835489781%26fa%3D4%26ifi%3D14%26uci%3Da!e%26btvi%3D4&adsafe_type=be&adsafe_jsinfo=,id:88457057-e4d8-9ffd-1318-194a20c3b365,c:xwligc,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-765c58974b-5lxw5,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a1*.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1b1,idMap:1a1*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:26,oid:d82eb50b-a0ad-11ee-85ff-9a0ebc1d7ea0,v:19.8.466,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js?xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adContainerId=brand_safety_DVmFZbIB_KmO7A-L7ZnQCw&cbFunctionName=goog_wrapCb_DVmFZbIB_KmO7A-L7ZnQCw&true_pb=

Request Chain 208

https://fw.adsafeprotected.com/rfw/bgd/1474271/76103299/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20123268692&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0igZCT3G_1pkHCoixOFfrYV&adsafe_url=https%3A%2F%2Fpainthy.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fpainthy.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1%23RS-3-%26adk%3D1812271801%26client%3Dca-pub-9779134835489781%26fa%3D1%26ifi%3D15%26uci%3Da!f%26btvi%3D5&adsafe_type=d&adsafe_jsinfo=,id:7534f3dc-bcfe-b38e-7138-8aefa1c80512,c:xwlii5,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-765c58974b-qk9mp,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tZ9WEKM+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:14,oid:d80d232b-a0ad-11ee-aa5b-6a5dfe2041ef,v:19.8.466,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_xappb=

Request Chain 217

https://fw.adsafeprotected.com/rfw/st/1835641/76875435/4.js?ias_dspID=3&ias_campId=1015029463&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20785736086&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gqGEW7Eahv3dmNqcfuOYuU&adContainerId=gcc_DVmFZci0DduzjuwPs6KlwAo&cbFunctionName=goog_wrapCb_DVmFZci0DduzjuwPs6KlwAo&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fpainthy.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fpainthy.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9779134835489781%26output%3Dhtml%26h%3D250%26slotname%3D6557565023%26adk%3D3612231468%26adf%3D3057537806%26pi%3Dt.ma~as.6557565023%26w%3D325%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1703237899%26rafmt%3D1%26format%3D325x250%26url%3Dhttps%253A%252F%252Fpainthy.com%252Ftravel-insurance-online-in-2023%252F%26ea%3D0%26fwr%3D0%26fwrattr%3Dtrue%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703237899372%26bpp%3D1%26bdt%3D771%26idt%3D268%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C760x280%252C760x190%252C760x190%26nras%3D1%26correlator%3D5850829227916%26frm%3D20%26pv%3D1%26ga_vid%3D1657473427.1703237900%26ga_sid%3D1703237900%26ga_hid%3D551342891%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1045%26ady%3D110%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31079980%252C95320885%26oid%3D2%26pvsid%3D4329896297552133%26tmod%3D215552153%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257ClEe%257C%26abl%3DCS%26pfx%3D0%26fu%3D128%26bc%3D31%26bz%3D1%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D10%26uci%3Da!a%26fsb%3D1%26dtd%3D269&adsafe_type=bed&adsafe_jsinfo=,id:338b214c-9f2d-52fc-50ff-4fb44c85dc9f,c:xwliiT,sl:na,em:true,fr:false,thd:1,mn:jsserver-primary-765c58974b-xjqlb,rg:ie,pt:1-5-15,mu:10000,br:c,bru:c,an:n,oam:0,mtim:2,mot:0,app:0,maw:0,fm:tZ9WELv+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1%7C1b2,idMap:161*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:IMG.qs,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:18,oid:d848f37d-a0ad-11ee-9495-6a7221985382,v:19.8.466,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=gcc_DVmFZci0DduzjuwPs6KlwAo&cbFunctionName=goog_wrapCb_DVmFZci0DduzjuwPs6KlwAo&true_pb=

Request Chain 235

https://fw.adsafeprotected.com/rfw/st/1627455/73523888/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0g5PUQQnxzHeKemaCGTwI0_&adContainerId=brand_safety_DVmFZdyoDc3UjuwP3JWJCA&cbFunctionName=goog_wrapCb_DVmFZdyoDc3UjuwP3JWJCA&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fpainthy.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fpainthy.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271803%26client%3Dca-pub-9779134835489781%26fa%3D3%26ifi%3D13%26uci%3Da!d%26btvi%3D3&adsafe_type=be&adsafe_jsinfo=,id:39e86ddc-4c62-47ba-3160-b597aedaae7b,c:xwlik2,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-765c58974b-qk9mp,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tZ9WEMF+11%7C12%7C131%7C141%7C151%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a11%7C1a121%7C1a13%7C1a14%7C1b1%7C1b2%7C1b3,idMap:191*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:18,oid:d84c4f76-a0ad-11ee-aa5b-6a5dfe2041ef,v:19.8.466,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js?xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adContainerId=brand_safety_DVmFZdyoDc3UjuwP3JWJCA&cbFunctionName=goog_wrapCb_DVmFZdyoDc3UjuwP3JWJCA&true_pb=

289 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
painthy.com/travel-insurance-online-in-2023/ 114 KB
25 KB 1306ms
894ms Document
text/html 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 / PHP/7.4.33
Resource Hash: 8f94cdf171f0d2852724afdf3e881daa15ea06c5b5de964d8e1096c5d8e8761a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 09:38:18 GMT
link: <https://painthy.com/wp-json/>; rel="https://api.w.org/" <https://painthy.com/wp-json/wp/v2/posts/4255>; rel="alternate"; type="application/json" <https://painthy.com/?p=4255>; rel=shortlink
server: nginx-reuseport/1.21.1
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

GET
H2 200 style.min.css
painthy.com/wp-includes/css/dist/block-library/ 107 KB
14 KB 326ms
324ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 18:31:51 GMT
server: nginx-reuseport/1.21.1
etag: W/"654bd417-1add3"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
painthy.com/wp-includes/js/mediaelement/ 11 KB
3 KB 326ms
325ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Tue, 30 Nov 2021 11:58:07 GMT
server: nginx-reuseport/1.21.1
etag: W/"61a611cf-2bf8"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 wp-mediaelement.min.css
painthy.com/wp-includes/js/mediaelement/ 4 KB
1 KB 326ms
325ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.2
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Tue, 30 Nov 2021 11:58:07 GMT
server: nginx-reuseport/1.21.1
etag: W/"61a611cf-105a"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
838 B 339ms
34ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A%2C400%7CPoppins%3A%2C400%7CPoppins%3A%2C400%2C%2C400&subset=latin%2Clatin-ext%2Ccyrillic%2Ccyrillic-ext%2Cgreek%2Cgreek-ext%2Cvietnamese&ver=1.6

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e120707b7a0de913a32da3e779b975bd342672ca68c9aa373029f38c90cfb56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 09:38:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:18 GMT

GET
H2 200 bootstrap.css
painthy.com/wp-content/themes/disto/css/ 221 KB
34 KB 326ms
325ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/css/bootstrap.css?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 6c38dc17dbebb7e00014f3ea1025d5bb245baff733b50069eff5403b5dfaeeb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-373fb"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 style.css
painthy.com/wp-content/themes/disto/ 733 KB
89 KB 327ms
325ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/style.css?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: ceee574841dd9f8ff1f1d23a93e3115a2c6b0392f804f3c6b35fd6c53d754073

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-b7494"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 responsive.css
painthy.com/wp-content/themes/disto/css/ 93 KB
13 KB 327ms
326ms Stylesheet
text/css 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/css/responsive.css?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: dc94b334bdbade3c6e278dcb6568556f0ce413d97a49d046e94a67f56472f0ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-17598"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 jquery.min.js Show response
painthy.com/wp-includes/js/jquery/ 86 KB
30 KB 327ms
326ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 18:31:50 GMT
server: nginx-reuseport/1.21.1
etag: W/"654bd416-15601"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 jquery-migrate.min.js Show response
painthy.com/wp-includes/js/jquery/ 13 KB
5 KB 327ms
326ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 09 Aug 2023 07:30:14 GMT
server: nginx-reuseport/1.21.1
etag: W/"64d34086-3509"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 script.min.js Show response
painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/js/ 18 KB
6 KB 327ms
327ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/js/script.min.js?ver=3.1.7
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 21887c5b83211b384496919a3ede8fc99cd6d6bab068bd714b00eb05cec0c056

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Thu, 14 Dec 2023 17:42:34 GMT
server: nginx-reuseport/1.21.1
etag: W/"657b3e8a-497b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 123ms
72ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9779134835489781

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

714283149e025e488aa69bf74f407a2a348d71cc720f6856b3c1f9c7386fac01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Origin: https://painthy.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51595
x-xss-protection: 0
server: cafe
etag: 15230512319522852581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:19 GMT

GET
H2 200 logo-painthy.png
painthy.com/wp-content/uploads/2022/07/ 3 KB
4 KB 328ms
327ms Image
image/png 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://painthy.com/wp-content/uploads/2022/07/logo-painthy.png
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 566165820cb347905665472e5e57227f1a034c64299787686311ffa124d9082b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
last-modified: Wed, 06 Jul 2022 23:14:45 GMT
server: nginx-reuseport/1.21.1
etag: "62c61765-d7f"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3455
expires: Sun, 21 Jan 2024 09:38:18 GMT

GET
H2 200 Travel-Insurance-Online-painthy.com_-1000x583.jpg
painthy.com/wp-content/uploads/2023/06/ 74 KB
74 KB 327ms
327ms Image
image/jpeg 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://painthy.com/wp-content/uploads/2023/06/Travel-Insurance-Online-painthy.com_-1000x583.jpg
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: c88b45fbea9fffd91d7dc5d44d9973a00b1d5b326eab6a8092b796e2bfad22bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
last-modified: Thu, 08 Jun 2023 09:49:27 GMT
server: nginx-reuseport/1.21.1
etag: "6481a427-12657"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 75351
expires: Sun, 21 Jan 2024 09:38:18 GMT

GET
H2 200 post-like.js Show response
painthy.com/wp-content/plugins/disto-function/ 918 B
629 B 328ms
327ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/plugins/disto-function/post-like.js?ver=1.0
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: f278bf82a64ac1a5ae8f69e06890047a914b3d0100bf856aabd758d2e15edf36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:18 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:56:33 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c61321-396"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:18 GMT

GET
H2 200 fluidvids.js Show response
painthy.com/wp-content/themes/disto/js/ 1 KB
863 B 75ms
74ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/fluidvids.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: d9ce958515e4c42199afa5f6f985d7038047c2ca5821147d68fe3604b138e5aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-484"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 infinitescroll.js Show response
painthy.com/wp-content/themes/disto/js/ 10 KB
4 KB 76ms
74ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/infinitescroll.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: aaadde89b0db2f97f270379b4762e025c85a1a4d8a4c9ae2421ab48198cc3ae6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-2971"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 justified.js Show response
painthy.com/wp-content/themes/disto/js/ 37 KB
12 KB 76ms
75ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/justified.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 25fdc7a17a7b3884e86c6f6b72b60288025980e5bcfff6b736f077902c1697ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-94e2"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 slick.js Show response
painthy.com/wp-content/themes/disto/js/ 42 KB
10 KB 76ms
75ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/slick.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 2c55dea800c7c131d9f3e3ac8a411abf3ca2b4fa836a7376aba3e99c43a621ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-a77b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 theia-sticky-sidebar.js Show response
painthy.com/wp-content/themes/disto/js/ 5 KB
2 KB 149ms
148ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/theia-sticky-sidebar.js?ver=1.5
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: ad386e83074906780dfa1feec2070ff6e11f15c07953ac3d8431300ae0ba175b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-1509"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 aos.js Show response
painthy.com/wp-content/themes/disto/js/ 14 KB
5 KB 149ms
148ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/aos.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-37a3"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 custom.js Show response
painthy.com/wp-content/themes/disto/js/ 18 KB
3 KB 149ms
149ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/js/custom.js?ver=1.6
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: c0a71ca2c2b80121a9db00dd745294b6a10f3904add5781197d3f6db69e4a574

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: W/"62c612f1-48ce"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 e-202351.js Show response
stats.wp.com/ 7 KB
3 KB 77ms
24ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202351.js
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684464982353.1523
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Tue, 10 Dec 2024 14:24:55 GMT

GET
BLOB 200
OK 7183e419-fcac-44dc-9fdc-379d62e49010
https://painthy.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://painthy.com/7183e419-fcac-44dc-9fdc-379d62e49010
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
50 KB 175ms
124ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9779134835489781

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6bd9bec24e304c7e1da425e52179d00e0b3da704014724d0bfb49a76be30cfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Origin: https://painthy.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51595
x-xss-protection: 0
server: cafe
etag: 16448708422810902774
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:19 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 117ms
64ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A%2C400%7CPoppins%3A%2C400%7CPoppins%3A%2C400%2C%2C400&subset=latin%2Clatin-ext%2Ccyrillic%2Ccyrillic-ext%2Cgreek%2Cgreek-ext%2Cvietnamese&ver=1.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://painthy.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 19:20:06 GMT
x-content-type-options: nosniff
age: 569893
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 19:20:06 GMT

GET
H2 200 fontawesome-webfont.woff2
painthy.com/wp-content/themes/disto/css/fonts/ 65 KB
65 KB 140ms
140ms Font
application/font-woff2 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-content/themes/disto/css/fonts/fontawesome-webfont.woff2?v=4.5.0
Requested by: Host: painthy.com
URL: https://painthy.com/wp-content/themes/disto/css/bootstrap.css?ver=1.6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Request headers

Referer: https://painthy.com/wp-content/themes/disto/css/bootstrap.css?ver=1.6
Origin: https://painthy.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
last-modified: Wed, 06 Jul 2022 22:55:45 GMT
server: nginx-reuseport/1.21.1
etag: "62c612f1-10440"
content-type: application/font-woff2
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 66624
expires: Sun, 21 Jan 2024 09:38:19 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 501ms
495ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=205086879&post=4255&tz=3&srv=painthy.com&j=1%3A12.9.1&host=painthy.com&ref=&fcp=1916&rand=0.46777756314298236
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 22 Dec 2023 09:38:19 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 wp-emoji-release.min.js Show response
painthy.com/wp-includes/js/ 18 KB
5 KB 75ms
75ms Script
application/x-javascript 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://painthy.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.2
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Wed, 29 Mar 2023 19:30:09 GMT
server: nginx-reuseport/1.21.1
etag: W/"642491c1-4904"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 revisit.svg
painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/images/ 2 KB
1 KB 75ms
74ms Image
image/svg+xml 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/images/revisit.svg
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Thu, 14 Dec 2023 17:42:34 GMT
server: nginx-reuseport/1.21.1
etag: W/"657b3e8a-923"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H2 200 close.svg
painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/images/ 1 KB
862 B 75ms
75ms Image
image/svg+xml 45.130.41.84
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://painthy.com/wp-content/plugins/cookie-law-info/lite/frontend/images/close.svg
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.130.41.84 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.codia2.beget.com
Software: nginx-reuseport/1.21.1 /
Resource Hash: a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/travel-insurance-online-in-2023/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: gzip
last-modified: Thu, 14 Dec 2023 17:42:34 GMT
server: nginx-reuseport/1.21.1
etag: W/"657b3e8a-541"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=604800
expires: Fri, 29 Dec 2023 09:38:19 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ 399 KB
135 KB 128ms
84ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9779134835489781&plah=painthy.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9779134835489781

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df5c5714b3dfce783a2610ce20c6c76937dbaac7fa9e8d8255e96ff6d1e52020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137961
x-xss-protection: 0
server: cafe
etag: 16619151281427244237
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:19 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/ Frame 846A 9 KB
4 KB 71ms
21ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9779134835489781

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37166
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 21 Dec 2023 23:18:53 GMT
etag: 5585625838579639069
expires: Thu, 04 Jan 2024 23:18:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 1f449.svg
s.w.org/images/core/emoji/14.0.0/svg/ 563 B
661 B 73ms
22ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f449.svg

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Fri, 22 Dec 2023 09:38:19 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:53:43 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3AC2 332 KB
75 KB 828ms
828ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&adk=1812271804&adf=3025194257&lmt=1703237899&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x675_r&format=0x0&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899365&bpp=3&bdt=765&idt=225&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5850829227916&frm=20&pv=2&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=237

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9779134835489781&plah=painthy.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d32bca53e7da6924a748ddf98feb0964c0b2b2c84b53da67840c82bf27c9ae2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 76322
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 56ms
56ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=HEADER&cls=header-wraper%20header_magazine_full_screen%20header_magazine_full_screen%20jl_topa_menu_sticky%20options_dark_header%20jl_cus_sihead&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 239C 119 KB
40 KB 984ms
984ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=280&slotname=6557565023&adk=2167923837&adf=2546238867&pi=t.ma~as.6557565023&w=760&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=760x280&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899368&bpp=1&bdt=767&idt=236&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=239

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23a4c8aea33bd9eea731a9d0e87b50d55fe312110213eea872ba5840d7588675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40810
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C56B 117 KB
39 KB 981ms
981ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=8984148311&adk=3498851007&adf=1704752105&pi=t.ma~as.8984148311&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899369&bpp=1&bdt=769&idt=243&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=1341&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=245

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7787cbd48bce95bc4f53463c52f861ed80a912c3045b168c5aac679570321137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 39854
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3AC4 120 KB
40 KB 774ms
774ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=3047912464&adk=2012044130&adf=2599789896&pi=t.ma~as.3047912464&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899370&bpp=1&bdt=770&idt=246&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2842&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=247

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

69886f9d2ea8e9e70cc316ba6c0cc4c65e86ef277a2fc3822897dfacccbc4026

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40944
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AE22 26 KB
11 KB 1182ms
1181ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c42289cfcff6130c6ba4ced9d20fd8a7934b83c319a9f7f328d257957f6e0c25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10625
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D601 96 KB
33 KB 771ms
771ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=1118&slotname=9671647671&adk=1459535944&adf=2219702706&pi=t.ma~as.9671647671&w=325&cr_col=1&cr_row=13&fwrn=2&lmt=1703237899&rafmt=9&format=325x1118&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&crui=image_sidebyside&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=272&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190%2C325x250&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=410&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&fsb=1&dtd=273

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

540aca79a214cb7275bb0745228ceb99da4b23c6059c954122e77c5ee2d5b26d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 33786
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 3AC4 4 KB
751 B 32ms
32ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=3047912464&adk=2012044130&adf=2599789896&pi=t.ma~as.3047912464&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899370&bpp=1&bdt=770&idt=246&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=2842&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=247

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 07:58:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/12103691940707531682/ Frame 3AC4 46 KB
46 KB 115ms
64ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12103691940707531682/14763004658117789537

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc54199f625840bd1cb1b08713311057fbd0efb76c61889bd5b6ed1c9693df16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 21 Dec 2024 09:26:35 GMT
date: Fri, 22 Dec 2023 09:26:35 GMT
x-content-type-options: nosniff
age: 705
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46630
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 21:25:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3AC4 2 KB
875 B 95ms
51ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 3AC4 23 KB
9 KB 88ms
46ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:00:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38283
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 23:00:17 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3AC4 3 KB
1 KB 92ms
50ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3AC4 20 KB
9 KB 85ms
43ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3AC4 203 KB
65 KB 111ms
58ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H2 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 3AC4 37 KB
16 KB 72ms
21ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 19 Mar 2024 09:13:33 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/3945842057824754938/ Frame 3AC4 1 KB
1 KB 114ms
83ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3945842057824754938/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f1e32ac04df840c57d868c90453cf2e0cf6bdb178fc3832ee894713f932151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 17:36:27 GMT
date: Wed, 20 Dec 2023 17:36:27 GMT
x-content-type-options: nosniff
age: 144113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1398
x-xss-protection: 0
last-modified: Sun, 26 Jun 2022 20:03:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 e21910fd923a6283b5d44b2382eabc86.js Show response
www.gstatic.com/mysidia/ Frame D601 9 KB
4 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=1118&slotname=9671647671&adk=1459535944&adf=2219702706&pi=t.ma~as.9671647671&w=325&cr_col=1&cr_row=13&fwrn=2&lmt=1703237899&rafmt=9&format=325x1118&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&crui=image_sidebyside&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=272&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190%2C325x250&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=410&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&fsb=1&dtd=273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 02:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285954
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4064
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 18 Mar 2024 02:12:26 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D601 2 KB
856 B 31ms
30ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 50459845d1cbd526a76ea757de42d266.js Show response
www.gstatic.com/mysidia/ Frame D601 23 KB
10 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/50459845d1cbd526a76ea757de42d266.js?tag=exit_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 01:51:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287182
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9842
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 18 Mar 2024 01:51:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame D601 23 KB
9 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:00:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38283
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 23:00:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D601 3 KB
2 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D601 20 KB
8 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D601 203 KB
64 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ 160 KB
55 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a02263cf75c29f80fdb1b381769cd5ba8d13287b4c370eacb3bbd6df56a92912

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56007
x-xss-protection: 0
server: cafe
etag: 5399100907576838485
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 134ms
134ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=0&wpc=ca-pub-9779134835489781&warn=13&w=1600&h=1200&pp=0&ppp=0&eatf=false&eatfAbg=true&reatf=true&a=6%2C1%2C5%2C7&apv=20231212_093518&sat=1702993647105&afm=0&as_count=10&d_count=0&ng_count=0&am_count=0&atf_count=3&mdns=0.211&alldns=0.211&allp=18&pgh=14093&abl=false&rr=n&su=painthy.com&pvc=4329896297552133&r=0.1&eid=44759875%2C44759926%2C31079980%2C95320885

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4338038513380208953
s0.2mdn.net/simgad/ Frame D601 1022 KB
1024 KB 76ms
26ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4338038513380208953

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bbbd3ceb6cbf0495b4d9fe60b57a782a5fbe36ce7afa4b392932bf376895c81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 17:42:43 GMT
date: Wed, 20 Dec 2023 17:42:43 GMT
x-content-type-options: nosniff
age: 143737
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1046975
x-xss-protection: 0
last-modified: Wed, 20 Dec 2023 14:09:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 css
fonts.googleapis.com/ Frame 239C 4 KB
655 B 33ms
32ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=280&slotname=6557565023&adk=2167923837&adf=2546238867&pi=t.ma~as.6557565023&w=760&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=760x280&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899368&bpp=1&bdt=767&idt=236&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&cms=2&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=239

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 07:58:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 239C 2 KB
822 B 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 239C 23 KB
9 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:00:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38283
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 23:00:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 239C 3 KB
1 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 239C 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 239C 203 KB
64 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 239C 37 KB
15 KB 119ms
119ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 19 Mar 2024 09:13:33 GMT

GET
DATA 200
OK truncated
/ Frame D601 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 16bd4f8cc85c694b70ca290fd071101d246279844894c414e95d2227dad653a2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame C56B 4 KB
655 B 33ms
32ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=190&slotname=8984148311&adk=3498851007&adf=1704752105&pi=t.ma~as.8984148311&w=760&fwrn=4&lmt=1703237899&rafmt=11&format=760x190&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899369&bpp=1&bdt=769&idt=243&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&rplot=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=1341&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=245

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 09:05:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C56B 2 KB
822 B 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame C56B 23 KB
9 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:00:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38283
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 23:00:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C56B 3 KB
1 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C56B 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame C56B 203 KB
64 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame C56B 37 KB
15 KB 109ms
108ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 19 Mar 2024 09:13:33 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/6530076113981016145/ Frame 239C 12 KB
12 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6530076113981016145/14763004658117789537?w=400&h=209&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f51adeaf2fb7ad0273ed1d9d4a0cd2472e9618db8929451c18327c6593d2b9b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 07:00:12 GMT
date: Mon, 18 Dec 2023 07:00:12 GMT
x-content-type-options: nosniff
age: 355088
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12591
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 02:33:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/18436248163444061706/ Frame 239C 2 KB
2 KB 23ms
22ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18436248163444061706/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7b61a975a191484f4e516677b6af322da437bbb71a15d7e46a4c650429af983

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 07:00:01 GMT
date: Mon, 18 Dec 2023 07:00:01 GMT
x-content-type-options: nosniff
age: 355099
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2423
x-xss-protection: 0
last-modified: Tue, 26 Jul 2022 11:30:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame C56B
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C-gP8C1mFZdjhKsjarr4Pz4aboAGEs6b0dICliZyrEbTrkoaCPxABILausZABYJWCgICYB6ABmdqBwgPIAQmpAtYcMLJqdLI-qAMByAPLBKoE9AFP0F9LvMMHZu4NUH3-0xmXl2yrF32FKYm...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213284667959753477026%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22...

0
0

173ms
123ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213284667959753477026%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22943746329%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227281429165560439281%22}&andc=true

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"13284667959753477026","debug_reporting":true,"destination":"https://sartorius.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["943746329"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"7281429165560439281"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 22 Dec 2023 09:38:21 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"13284667959753477026","debug_reporting":true,"destination":"https://sartorius.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["943746329"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"7281429165560439281"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3AC4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14a88cd6c4eb65f2c578d0837dfb685f9e13ed0922ea6e330a6ca9b049c7135e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/758428636817297358/ Frame C56B 6 KB
6 KB 23ms
23ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/758428636817297358/14763004658117789537?w=400&h=209&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b94fc1694c78a4372c6e2aa67654f88852dab05934ffbd06b07074b2d095161d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 21 Dec 2024 09:09:12 GMT
date: Fri, 22 Dec 2023 09:09:12 GMT
x-content-type-options: nosniff
age: 1748
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6277
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 17:36:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/3945842057824754938/ Frame C56B 1 KB
1 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3945842057824754938/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f1e32ac04df840c57d868c90453cf2e0cf6bdb178fc3832ee894713f932151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 17:36:27 GMT
date: Wed, 20 Dec 2023 17:36:27 GMT
x-content-type-options: nosniff
age: 144113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1398
x-xss-protection: 0
last-modified: Sun, 26 Jun 2022 20:03:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3AC4 16 KB
16 KB 228ms
227ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:38:05 GMT
x-content-type-options: nosniff
age: 316815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Dec 2024 17:38:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3AC4 15 KB
15 KB 212ms
212ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:54:09 GMT
x-content-type-options: nosniff
age: 261851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Dec 2024 08:54:09 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 6179 9 KB
4 KB 23ms
23ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 08:54:58 GMT
etag: 5585625838579639069
expires: Fri, 05 Jan 2024 08:54:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 6FD8 9 KB
4 KB 24ms
22ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 08:54:58 GMT
etag: 5585625838579639069
expires: Fri, 05 Jan 2024 08:54:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame D2B2 9 KB
4 KB 25ms
24ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 08:54:58 GMT
etag: 5585625838579639069
expires: Fri, 05 Jan 2024 08:54:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 3482 9 KB
4 KB 25ms
25ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 08:54:58 GMT
etag: 5585625838579639069
expires: Fri, 05 Jan 2024 08:54:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 239C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c883ef096af0d17835d6efe8698339884088b137e82c62febe290bbcafc2382a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css2
fonts.googleapis.com/ Frame 6179 4 KB
671 B 34ms
34ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 08:15:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6179 205 B
229 B 66ms
66ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 14:24:49 GMT
x-content-type-options: nosniff
age: 242011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 18 Dec 2024 14:24:49 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6179 604 B
628 B 72ms
71ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 16:42:53 GMT
x-content-type-options: nosniff
age: 233727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 18 Dec 2024 16:42:53 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 6179 16 KB
7 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6766
x-xss-protection: 0
server: cafe
etag: 14924840246271906451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:43 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 6179 22 KB
9 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 02:16:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26485
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9210
x-xss-protection: 0
server: cafe
etag: 13914886398874665762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 02:16:55 GMT

GET
DATA 200
OK truncated
/ Frame C56B 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e40b26a16f681d7081d0560b5cdef298914d55e8a4eaaab30020cb41c8a41c6e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 93DF 624 B
242 B 65ms
64ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXrxKpWxUvN0r52rMsCZj-Z2YbP5ID-SutXZuKLnTFBhAYDxR4vtmPOAuVZpJ5wsIKaH2GznQznmCfTzBH8sM5oEgg_OxQlSNdD6I9CH4H2EZsC0APdzBqzkX4IQVDmTf-Bea4T_JMZc8tIzMNN6FToXuotcjIGmNW9_Qmou_wFPcQjewM

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DE38 89 KB
31 KB 268ms
267ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:21 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DE38 3 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DE38 20 KB
8 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DE38 203 KB
64 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE38 42 B
63 B 96ms
95ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AF0Rp_Y-IEBZkeUC2959MnlUeey-_QEuSmwMqqu6Af7NhDXZqtUleu3AfwBbwAGMT5CfSw3K42APTY3lg0g1o-Z6wsLS9ICnpdbykk3h9Vj6M_qDg

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C56B 16 KB
16 KB 120ms
119ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:38:05 GMT
x-content-type-options: nosniff
age: 316815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Dec 2024 17:38:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame C56B 15 KB
15 KB 99ms
99ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:54:09 GMT
x-content-type-options: nosniff
age: 261851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Dec 2024 08:54:09 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame D601
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CfFmDC1mFZfreLKinhQaqzq-oBfzy3Op0v-Lw2LES19aivcABEAEgtq6xkAFglYKAgJgHoAGgk6qHA8gBBqkC1hwwsmp0sj6oAwGqBPwBT9DneZ8L7ouZ8dxnJO6etGuSaWpU2wB8cMEI-Jq...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225117499128113796754%22,%22debug_reporting%22:true,%22destination%22:%22https://o2online.de%22,%22event_report_window%22:%2...

0
0

141ms
124ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225117499128113796754%22,%22debug_reporting%22:true,%22destination%22:%22https://o2online.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22820677024%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229890198698843148129%22}&andc=true

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"5117499128113796754","debug_reporting":true,"destination":"https://o2online.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["820677024"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"9890198698843148129"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 22 Dec 2023 09:38:21 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"5117499128113796754","debug_reporting":true,"destination":"https://o2online.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["820677024"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"9890198698843148129"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 ad
googleads.g.doubleclick.net/dbm/ Frame D601 42 B
64 B 51ms
51ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B2UlYZzxU1LAiTwOyx1Mm6c9LsyJilICGyGeXJMaXrOMjt1ZJRdROkyfLp9trsuF-vK-6pvw_IzJGilWXq0Up4bJODaOeHl988sI41cK6KbLQGpbcnDm3fR_2msh1Uv-bsnDPeuM7lZgrzzZ2jbTanwNrKmQ&dbm_d=AKAmf-Ckyfkeq7yL8_rOp8m_clNHR5Tpt0wg0V2Bj3g2SauUTOE-1UyQEhNxSlrPHB05oZ_BJavrzTfgD7XGCiTCIM7v5mA4H3hhoHJc2bAj-H1HiO2orSbmNLiueDlI9lzz_-Y-kcOhgwrxTzNy5Wsl9fyPYB1JqeBd_vD_Lldbm77Mr_yrlaiNwWHqSEkgWKsxEtYNOhpTR5Irhj3oGhqPkwVAQo7oU64usBve9A_yTqF83jzz21vZbChorS3W1NcWl24rxD18LZ5QyBmzA6cBIEbZ46J1mTKW4tlpgT2VqP1k5sw0XoMqWicE9G27z-qgP2MnyTWr6noPwP3mpFNbvkEc1pD8Wb2T-HW5sX1lHtYj0n1dLAT_i6hM2urpO-ecuTPqApjbwnAgh3vk1TQJeF3j0C_LmRj1TqWBUSeaFZ7R_Wb1eJmxacJ8xmxC9SvxM0hjEphRn0W5rUZdy-Hp_pS7Nrk4KXVC3h99aqz0Tx4cGOKbq_6uspXu37QAGcXn5qSAgGdJNQ_0ffDvGBZ_Lxz9_MBg7dBawqv7jRHN9dq4SdJ_t3Tah5ljVBADRh--HWYbPWMpSnR_njPiSTnpC7IK7WLAFRKBYwYAB1J4m_EFfvq5GMukM0KX04sVqVpefYgZ4QaopiF4_rZFGIuQORnlkk5XfHA13x2usqWmGYnmuGZlZI_Se-ShipWG3kZrzD7ODMK1CKZrPogCDPStZnyJahTMQzFD8wa_L-_pMmBRh7OE8k4PxzZzSHMSnNFKppDZu0VDJipjJ5sHCCZN-Uy4_hGiLCPQQ23ARxzcVmfNXxXr8Z2MLSqvZNQbZx0cvPHYOvRrcsKxHV7NqLQCSgsLxzILhQ6LQ6HTMSQvJiEMU9cHzihDwB4AaamzqufWWxrwE3m7JMzs3NDFdd1aB4epxJmFRpW-9AZwJuXw06sK1yd8leed3MwRTeqJCtBqHw5FY9p25IuvDN4QJjPX-MZyRhE9jj32O5PJzD0N82Eh4Im9hXgDlOduypAnIcfY7qGC47FS5w4XhZJovC5eTwz_Hn-SonBbWak3KZ6k9uZ5n9w0p9dNs87Gg_MkIp4dGmtzdywbRRLmj99E0h-UBdikfpmSZL7YhIh20IYH1h910-XY8EXEFE2kU9c8mAaThQ4LeWlzJ_4DodGnojkUSNCzRDhp2XhlH5d5S-wVoY-LogEH2aUvI5kvTM8fU_e5PHxfezEg-lOgLTFuNvz9mlIGLQnw9in3S0oyO_qvghEaSU-BuzmzXHf2g41gHlE850sLfGhFCBbeBrf7KoFQv_ckFNRY0SYlNKJTatMIAd1P-RCsieFZqcto8ZDyQmPXQvwAY-eHmECI7S-n4Ozu3aLCKwH6m3UgpsL8FeqXEJmSocA4Vf5RCQb6LwEm66WSgaOs5j5L3esRcoHcXh9Vp1hvrLsI_sUG4RiWuOGvdUS5Vu3mXdA--Xkk-z24dfWBn1jvznm4LSYOAyydt9AVzCsFBOIKTzCQ-l5AopkcwOsiyD_tIqPcEYXDw4SVU0jDy5B8S9BgpD7EJz7grD92v32IJdTrvTYbI-fAvxBbjB28OEap7SIe6sAEVKl2F0iJgpxufLmA6LHMkj057YcjO4DYnqxGJZKLCH8ohhLs-I4gweaSNpefqimnTf_oregzMQG2otZaNOt2LF4dN3kr1PDEahYHO3TLEkBMpp8gD7e72poZinmVqV3Z4gtERcYQkVtehbcUPtiA8AxGUmYDj5HUgkRY9sJxYTcpqfEO7Q4qJ9TJYdn7vpJZ1TwzSop5F3hF3qRdwUZbF3Tlx-0idlU2CYiIoF8-6g1D0Gz4PqTew-QvuWsuBsceUYuGV1x_nbH-9Yuk7TaDowXngwuqcozH2N3nUry29E0OvkOok-uR-rIf3EQKt8RfXmTGIlHP7ooZPAZa2YHLKsRxJLviRP-DggLokmXdRDabqU8eYFaW8h124sFAb_fDwmjqNsISdN_t3Ew4wMIbx3sZmgQsBRbBAJxJzRg_lsONfiRvUryjcxKTwYFQl-eanv2aEeHfgExWJZU4cOlUgl8eeuzVInzy0ArZkA4o0Vw_74GEd0674pUa7V88fa2pVrlON41j_FEntncsCApT7hnkHeHfeU8hF5khBkMojp9iWe8RXE4Uvj9rY8Ry9slheHjPpV7p6yGiYW4Tm86A26M7xxpmbgRL-rp5eWqUkXnfE3aegstHYbai4CPmbeRU7iqlXvqJG7qYbIs9FV0xisfO_WR4MQwLKk7BJFF78kCEIMLcPyMflirjTkqXK21D6Zm2mtKklMDCs3P6P9cQbE9xIyUdHeaz8yyLWaGbD21nJyLq9HPlMZVsrzGjnEBIp5qn8ShiIQy3F3u5RcU-clX8MDHw6yyedvAq9_JHArvUo-gKjErKQmeaTpM_RxElcBwVF_pbnxdnWV-U2Gc1xqUJoI8b-Jdl0_HAeUbZ6GHGm-utLFu9R3WlzcqocZAwnIpSEZDOuv4u_vW5rf8CRIC17KpSfqp3Xj7gdEvuqVyqc_Mi60chjoSw6DcrlIMmvVsPQvACw5MZfnEJ1fgulQI1eLFiiQRThevQMG30e7aSy8s3UFdQEk2VCKctyuNqGSKsxbPQCAEVCzOYVtN5f8QhqPu4-FreF5uwonAiHueBUgcyzeeuh9tVb_1eUKgQcNBh5nh4uea70eaRtUiVpVN1y3dTsxOXr4GCVAZz_sThsT_G3Y-ycHAxJFm2zm_6H_PhLJTFDuRloA5ejbNx3ThC0Eo5pHsePRtBgukjDM-q27op7dg0vOB92e_4NMuzkhe8YNbsVT9M5nmOt__x7GmV9ZubsDEUi_6a2VO8tq_G1rTWZb7wdNDIpi5C7sCsg3Xtqn2Kdpo_-mxrS3Yygfh5mMJUgME1CgcjgCb8FbPX9AKnklmr-ndE-cgAm0CFJlo9OxydXZelTa7XWwU444OMorX5e6NPyfhh4aAPI9-DLpo9wxw8py-lWG5JqZZ93oW3q59JbV5i-8RfmKtJnJNinAngMoRGSYUw_u1DzPfsS39yCMlGEsDThe2MRWRzUBh-eNfsgxcMGecoiVuaJT-hOK-FpxWGd7WGIf9Q3Hdymqgy_PzPYa3IlxT6a1NEOMPTmvzAlycJPHh52J0OyKFXuoFRVtpfBQq_Bu0FrTrC0eCWE3M_gFAAlAGEHH1bjkS1LXbz23dWpi4OBF0x_BpE6c9-dauaSD2OjDzNSkG8oreg0VYywW0wvfJWDGYd8-FHAdN806ECy5SM5ILLKtYW_IswsbF1Rpf4523We-9PHPaNv2O40kOPIv3Fk-mmgxolwwjBZrGfjKW16eeA4dzCI4f55vthJwW6CGuZkgNYcDLYdCXags4babHG3JILB7elWthIxOs-Cv5H_YvIVywq9vsU7X44athlfY-BpXmhsS1rhCxsb-GT23ee-9Vvi_N3xQFu51sXdG0VgAJg_y7sJPZNjI8K2FbALjzjA8xFBSkiUrYt8IoPFJLL8VoqjMKzBJ9yZaItjAutVMehpmmTKb4hm7pL_-vezxDXbc-K5jB7Z4BNAEJzsKXFtSQF08FvYNDeY-b5RnUqfu0QIkicyAo8_NVfy_W6mnhngiJlns5cE8G-VA9hP3YULJAgujvexctEQ_atCMaVT7g3MVFLn7WC4sMd2E52wwLPkvtvMyVSals0h10HAofqKx9qTuKgkzaeuRwPqIc_t_WJKZBo6F8U8Cbm2HnlIlU8meQxC5NdQXnVN8nwBoltzEFSbF2TZz7aGvAa28ToQwFt2jPLbZn9X5BxqlkEr-XoN9hVI661-9frwurGQsk2n00NAi_1QtS9pUKoI1MzQLN7vdFBnv1txtnJ5oCaHkOM1koQn0e_NG8MubomTdpMGJD4jqmJiiZC1bkNWyrw_-o_se8zrOCmTmDstHquhmpzBceSjExKvY9efW3k7qvkLqoZkvRb3noBYUvD_hYOMEFMM5erp3JJEMxtUTqp7LkuG9qbWfMb3iwfNrZOPRAK4WuVfs0zJCskgHb7EH5VbsBSkHEtl3e67WtFrkB_-5GaOTQhEUniCW4RN5VMRiRzgs4GXB5hcNeBspR35yhjpTSiBynyYg_XOxVspDvshmBnvbRdF15egfnLs-NtH5j8IjeKg6Mv5-cmJsJn5UwsEd7GnUKJq_uhON_KvJf2sQMc-7PTIfuybP8HYGmDtrURM_1tcomwH6RIeWUFp58ZZ48Bs_eBHVBVwIetx_4AQfdq01IU69DcjU-1Js16BVUPP79y7Eo6v3zXJv2e1mvymZitA5w4LzCs7gSGJdlyQf-2tbXMDqHLM86vw6ARmR4&cid=CAQSTgAvHhf_FOfV_tQmAp5jJelgnMIx6YBCw8TkIiiLBbGWE7MisKWWMcoXafC3fGNtxEH0DSJhgFgoNzVlJAsMv_R0fIkmihs_vogic5OMbxgB&dc_exteid=31419193644867022848430946449639594&dc_pubid=4&cbvp=2

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=1118&slotname=9671647671&adk=1459535944&adf=2219702706&pi=t.ma~as.9671647671&w=325&cr_col=1&cr_row=13&fwrn=2&lmt=1703237899&rafmt=9&format=325x1118&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&crui=image_sidebyside&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=272&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190%2C325x250&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=410&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&fsb=1&dtd=273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 111ms
58ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0D4C 640 B
262 B 63ms
62ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F256 89 KB
31 KB 140ms
140ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame F256 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame F256 20 KB
8 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F256 203 KB
64 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F256 42 B
63 B 80ms
80ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bf4YWHxc44mCKJH_doXpXvfA9qKOMsGQUnlnv-sbo5naMT91M-bDYd89G3WZCK8WKKdMbygY3Xla7-bPO5Ov7bEVTW2nH9Fy-Xc2fqxTVfQ1glAu0

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A16A 466 B
235 B 71ms
70ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjMrI38ATAB&v=APEucNU-cUaO_ENpj-N2gFCvkBypcYpdS1GM32h2CXla8E_eFwJ5eSo4Xkg1A5s4F8qX6HfqQ3-J8h66aJqOdv9NA-hcFO6leqZ-CqKTh6CSAg06NtkMzcC2eH_2ZVQvnKd188rghw7820x6BLFhMxaFzUhoDbdcBa8_p9pN9rTBLIh1mjHmWMM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3482 89 KB
31 KB 244ms
243ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:21 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3482 42 B
63 B 77ms
76ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BnpWTP5-akFV66nY_OINlmnRatoNqb-lgxKgRYI2NX3zaGUw9TnaE3ihRl8JtuGx8TPGZ_iImx42apTOF7aY-AmjgKqYncBn6TZbBtdD-MXXcoQV0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1474271/76103299/xbbe/creative/ Frame 3482 264 KB
80 KB 175ms
52ms Script
application/javascript 34.251.137.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1474271/76103299/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20123268692&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0igZCT3G_1pkHCoixOFfrYV
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.137.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-137-37.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 7716d48bf0a1208302e8d570aee3e690e691fe175718a0ba3feccca95db29910

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3482 3 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 3482 20 KB
8 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3482 203 KB
64 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 239C 16 KB
16 KB 81ms
79ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:38:05 GMT
x-content-type-options: nosniff
age: 316815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Dec 2024 17:38:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 239C 15 KB
15 KB 89ms
87ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:54:09 GMT
x-content-type-options: nosniff
age: 261851
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Dec 2024 08:54:09 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FEC5 398 B
225 B 65ms
64ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNWNiYACMAE&v=APEucNWL5IOJtvzW3I44LNOGTtbcSG3UQazT1bOr1y4CoNJS7XcFp1Hh-ZZrrP4HbhheDbWGbJ2w67PFTnhbYHIe81K1hWHV7dvJxb7DyPrkDzL8cIw4U7nTgUfQVy6rx-YtRU9aFbJFBj5aOLiB0DZXP1sXQh0NE9dwpeE4ThM06Vw_wlWTtYs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
expires: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4C70 89 KB
31 KB 203ms
202ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:21 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4C70 3 KB
1 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4C70 20 KB
8 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4C70 203 KB
64 KB 74ms
73ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C70 42 B
63 B 56ms
55ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DUrFF0k1DbDxWzrka486kKcSMUQHggfbEzxvaCKp0V_fjsgMLSjqX5BtLH96xtN2jT59st-Auboq-ZCEgHCK-1afpFUqrDCYE1HCSAJ8vhx7ASs18

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 5BA9 14 KB
1 KB 49ms
48ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 22 Dec 2023 08:57:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5BA9 2 KB
822 B 24ms
24ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 5BA9 23 KB
9 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:00:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38283
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 23:00:17 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 765E 143 B
166 B 28ms
27ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3596
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 08:38:24 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5BA9 3 KB
1 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:48:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:48:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5BA9 20 KB
8 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:54:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5BA9 203 KB
64 KB 93ms
92ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:38:20 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 5BA9 37 KB
15 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 19 Mar 2024 09:13:33 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 93DF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1&C=1

43 B
771 B

95ms
95ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXrxKpWxUvN0r52rMsCZj-Z2YbP5ID-SutXZuKLnTFBhAYDxR4vtmPOAuVZpJ5wsIKaH2GznQznmCfTzBH8sM5oEgg_OxQlSNdD6I9CH4H2EZsC0APdzBqzkX4IQVDmTf-Bea4T_JMZc8tIzMNN6FToXuotcjIGmNW9_Qmou_wFPcQjewM
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dr3v3nrp7cRffAIiI2aOP%2BNhTFmz98gfkgSA4zzRRJVRneujV5dGby3BP1E0L8ocjZ3RCG8vcX%2FxypKkaufpcYwfTsZ5sALxZfyVfNxIOihVJh5g%2FbeYH54sT8OE9J2%2Fa1PGha%2Bsa43z7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 839764323b9844fe-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5hCgXQpgsrJ9%2BKA8mEFGR5286e8522ITdseEpVOw4gOIwB4rdC99j%2F%2BgxMMubdq0CqAHlO4vHolBkb6mfBYWl2LxXZHbPm4c2TO8ufO%2FQ128f1RlJRAPiKHLlHMagKxndrPyFEqXkzDgwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1&C=1
cache-control: no-cache
cf-ray: 839764318f354480-TXL
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 93DF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZYVZDZmaR6fgqmQgRY9Q8QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1

43 B
733 B

81ms
80ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXrxKpWxUvN0r52rMsCZj-Z2YbP5ID-SutXZuKLnTFBhAYDxR4vtmPOAuVZpJ5wsIKaH2GznQznmCfTzBH8sM5oEgg_OxQlSNdD6I9CH4H2EZsC0APdzBqzkX4IQVDmTf-Bea4T_JMZc8tIzMNN6FToXuotcjIGmNW9_Qmou_wFPcQjewM
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zz56KYMM1CuekM6G%2FjgaUeTBBrmCiwSW0ZKuZj53xCOcuvf88Oa6cS%2Fagg90ZqU4XBl6FgZu21UjHYyVHy2bcmysZAspa1P9MCQnI3yX1uGlFyBYFi65QtKVhcMfB4hxIW0Wi%2F5owBH9Ig%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 839764327c4344fe-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxkktyVPN1ud5Rsfu_UlPE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 93DF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOlHcJczz3eUHySXE9b5tss&google_cver=1

43 B
842 B

28ms
27ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEOlHcJczz3eUHySXE9b5tss&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXrxKpWxUvN0r52rMsCZj-Z2YbP5ID-SutXZuKLnTFBhAYDxR4vtmPOAuVZpJ5wsIKaH2GznQznmCfTzBH8sM5oEgg_OxQlSNdD6I9CH4H2EZsC0APdzBqzkX4IQVDmTf-Bea4T_JMZc8tIzMNN6FToXuotcjIGmNW9_Qmou_wFPcQjewM

Protocol

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
an-x-request-uuid: ad39c214-f272-46ce-8092-09939fd97c97
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 84.19.175.183; 84.19.175.183; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEOlHcJczz3eUHySXE9b5tss&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 93DF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTI2MjUwOTA4NjAzNzAwNA%3D%3D

170 B
243 B

32ms
32ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTI2MjUwOTA4NjAzNzAwNA%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
an-x-request-uuid: 501dd525-43ea-4cd1-b40b-a1f63c677f47
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTI2MjUwOTA4NjAzNzAwNA%3D%3D
x-proxy-origin: 84.19.175.183; 84.19.175.183; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 64ms
51ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 09:38:20 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0D4C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHIMUZnAzGs_f0OM71gSVww&google_cver=1

43 B
105 B

32ms
31ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHIMUZnAzGs_f0OM71gSVww&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHIMUZnAzGs_f0OM71gSVww&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 0D4C 43 B
295 B 91ms
31ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 0D4C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEEXYDr95UkYJ4X_RuDOxotA&google_cver=1

23 B
163 B

52ms
52ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEEXYDr95UkYJ4X_RuDOxotA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 22 Dec 2023 09:38:21 GMT
pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEEXYDr95UkYJ4X_RuDOxotA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 0D4C 23 B
163 B 140ms
48ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGJaO3_QBMAE&v=APEucNXgsJP_GAA_kzu4sR1C9Bs3dh718_u1hPgDgE5SlBRzw91PL-OMAhRAKjD3FmMtRqvkhekTAwjfUOKddfLmuTKB7AVVkGZlml_ciS2Q5p5snp7BNgy-IO7yADUZ6HSdu2CpvQyoYykvAmLeLcWTbPk-02Nt3wJbYU0r2S2RM_E_uyZrygs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 22 Dec 2023 09:38:21 GMT
pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET

partner
sync.search.spotxchange.com/ Frame A16A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEA8yDaIwAz6cDrPFVk-rlwc&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame A16A 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame A16A 0
125 B 312ms
26ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjMrI38ATAB&v=APEucNU-cUaO_ENpj-N2gFCvkBypcYpdS1GM32h2CXla8E_eFwJ5eSo4Xkg1A5s4F8qX6HfqQ3-J8h66aJqOdv9NA-hcFO6leqZ-CqKTh6CSAg06NtkMzcC2eH_2ZVQvnKd188rghw7820x6BLFhMxaFzUhoDbdcBa8_p9pN9rTBLIh1mjHmWMM

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 765E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

35ms
34ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:21 GMT
expires: Fri, 22 Dec 2023 09:38:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:20 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 3AC4
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=Cx5OgC1mFZcTxKumjrr4P7aCS0AGEs6b0dIqKosurEte1usTMQRABILausZABYJWCgICYB6ABmdqBwgPIAQmpAtYcMLJqdLI-qAMByAPLBKoE9AFP0Dm-aQHk-qjoB5HFFjo13-bglDEHAZA...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228675181594955593168%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22:...

0
0

59ms
59ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228675181594955593168%22,%22debug_reporting%22:true,%22destination%22:%22https://sartorius.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22943746329%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226532415816374557105%22}&andc=true

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"8675181594955593168","debug_reporting":true,"destination":"https://sartorius.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["943746329"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"6532415816374557105"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 22 Dec 2023 09:38:21 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"8675181594955593168","debug_reporting":true,"destination":"https://sartorius.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["943746329"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"6532415816374557105"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame FEC5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEA7epZ2a-DKmc8h_LnTneSQ&google_cver=1

43 B
163 B

82ms
32ms

Image
image/gif

91.134.110.137
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEA7epZ2a-DKmc8h_LnTneSQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNWNiYACMAE&v=APEucNWL5IOJtvzW3I44LNOGTtbcSG3UQazT1bOr1y4CoNJS7XcFp1Hh-ZZrrP4HbhheDbWGbJ2w67PFTnhbYHIe81K1hWHV7dvJxb7DyPrkDzL8cIw4U7nTgUfQVy6rx-YtRU9aFbJFBj5aOLiB0DZXP1sXQh0NE9dwpeE4ThM06Vw_wlWTtYs
Protocol: HTTP/1.1
Server: 91.134.110.137 , France, ASN16276 (OVH, FR),
Reverse DNS: ip137.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEA7epZ2a-DKmc8h_LnTneSQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame FEC5 43 B
163 B 144ms
32ms Image
image/gif 91.134.110.137
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNWNiYACMAE&v=APEucNWL5IOJtvzW3I44LNOGTtbcSG3UQazT1bOr1y4CoNJS7XcFp1Hh-ZZrrP4HbhheDbWGbJ2w67PFTnhbYHIe81K1hWHV7dvJxb7DyPrkDzL8cIw4U7nTgUfQVy6rx-YtRU9aFbJFBj5aOLiB0DZXP1sXQh0NE9dwpeE4ThM06Vw_wlWTtYs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.137 , France, ASN16276 (OVH, FR),
Reverse DNS: ip137.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:20 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame BD0F 50 KB
19 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 09:05:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 261173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 09:05:27 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 239C
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C3HOuC1mFZaTgKtvHrr4PwPKW6AvfhsDPdMb03bGwEY7Pv9LFMRABILausZABYJWCgICYB6AB77CF3CjIAQmpAtYcMLJqdLI-qAMByAPLBKoE-AFP0HhLy9WXg45yvVCcixvEIrwCK_2zI7Z...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218093280926742710065%22,%22debug_reporting%22:true,%22destination%22:%22https://misumi-ec.com%22,%22event_report_window%22...

0
0

59ms
59ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218093280926742710065%22,%22debug_reporting%22:true,%22destination%22:%22https://misumi-ec.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210930444399%22],%2222%22:[%22true%22],%224%22:[%2212-22%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214379317452156963505%22}&andc=true

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"18093280926742710065","debug_reporting":true,"destination":"https://misumi-ec.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10930444399"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"14379317452156963505"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 22 Dec 2023 09:38:21 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"18093280926742710065","debug_reporting":true,"destination":"https://misumi-ec.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10930444399"],"22":["true"],"4":["12-22"],"6":["true"]},"priority":"500","source_event_id":"14379317452156963505"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame DA2E 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 09:05:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 261173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 09:05:27 GMT

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C48 50 KB
19 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 09:05:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 261173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 09:05:27 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F256 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6915458898263&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F256 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6915458898263&version=m202309260101&ct=76&x=1&cor=15260519776414052000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F256 109 KB
41 KB 84ms
84ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CKcZVVJDIelQDc_u3lXuKwobPik-8DXtLCq5_2YvCUbmBPOeNukU023LU9nsWR-6m-uikFoxIMXEoISGH6uB-c-O-WHfwulBpQPtID8lpcrkim56rXxzS1z2ztMO_KMR5b1mHm3ULw986T1oy8tpUL3ENebmdCTHQHh25N8irJTxt4qVc&dbm_d=AKAmf-Bfwy6BHGkTX0-l1-Dh9KuSFZI3W-7duS4i5p_KyEAGavBVf-mdatlKBerEj5iFzXBw6i_AqTKLMEPcYNJKcbYW7s1f1cQpUglN8cSIhcXDhKe8cvGCw2nfqhKDL93PCrXftiKUkYru5rEyAlZ4GBl0Tok0eGOHSM5S_go-0L_51_W0GhIlvTEGSmoO9OAGUZQGL18SxXjbTJzb7PizW8J6pQH9grbwr5m6JVgrYzXToRpEzkSTQaHTZCYu6VVcKUmn03xsHhMcd1ednc9qp2-DmPaTDCKW6h--PyTjXx_D0Yr6cEy8OW4OLkUeVXzJlRs7DzoSwCRo69XH4pd3PIncgt9A4szajKwwgWUlKiRJveYwG20gkQmuctp7c4244BrsPWPe3V7tPGiaLiz-ZMT2E74jxXkKe-x71rHmqCfrihr1qZ0LtNnlPGV3OOOXaatY_aWHzSbJeflFOu4qG0L8YaPoCXAxd5TCdJf2z4ptvpk7jJbxe8CEDCJM5lHuRH4WU56mDa9tcw3Y49IYRO1sMkiXhVCY_93BRF7mwVfqYzuHaBe9zkQR6jW35ike3IrJjp1BxTrn-RXhfYHi_tATyliS2lMwI2ZsY7npinE_3ipb7LaW3JnxfRRlbbKgQhjr_IILUoZH3BfO3zA6W9SGwe3NYrD9XjygXIsHW0hbBpNDKXyWzd3bUlfvbrzcCCAl7V2RerBS4mBZJ--eEuLxyMNTL_8vgvDh3CG4whhUMrU0e0zi0dQddlBtTZJqdZla8fhW9kHljpuFOOSPEhrQ_k0ZS5I6xXruQQJLMCPquo8cnl8sDofpzBeq6fs0dyDKYodP-II5sRn1I-7CCJ047v0Qfp6Zu3uKk8ENIM19GNPehkiYhNyzx_U95St1R0t639XdIUcrN9Da9WI7PvCQsUjD05PI4fFXeUYMzmm6xltwHZKsxLTSta2AepkpNQVOUO8MvK4fn5CnMMErxcAvqz3AesgTH0YVWxdWlg_CvP6XFqV1lNKPk7xvKYyw2x20jv-1b_PwiA2tODTKj8hYq4llEhabq-dycPcfPw30s5wVtnt1Nsa_qH-lI-0E81KomAbEXcb1l4ms3brCXwf-7gE09sVjhGTKsk9Vz5LePAXxXcxgABiaWwElt_FKDH_-OLkUH-mah0IwoStMJJa8-n4fZFPa0dXqD08WUPH-WWIimRmQ5MSqrfuysDdKOD_aQyYdhsfKjIJ8xAvI4Pgmc9n4sWuRyXVAJodnnArfNl3RdK3TzlEOqFlC20NBIQpMO3CYlQHNNWhKP8gIOHguaKHRe5dQM0s5U3RV4_nlUkdKhkg7ocu1Jq2js8fJzFSQ0yPub0rfBCx9MzP7GUIRj1kR43adoU3j0FQL1Y3QHRJzq7R1rydijdBCbj_p1GyB-r2mFsw1oDMZBKHTz34Q8lC_NiNq-_zTP1eWtxcw5DkSXxBur8h8IXg7BegmNNzPJT1x1mxmlVfVLuj-JoEcMDFg2CoiOzocpKJAujnhcKPCzya1K0jpcnc7-PotJ6q55cc9IT10V8GMj1VBVrdoC_7VbCihRGeousjfC4rw9u5TXcj2DMBspusLrG2t_VZrmXx9jHzwExRVwFHPiEwfCJ5xYn2gBAyfK8ekB-_QdXS6MRVMw2FFNjyFaH4wOOz7vJNKgHvy9CGX8uji--L9ieDDyspFUsc9uiPBq8CYkXwFBlsoamoWl0ZnK6lJzu9meDCZEmFePHCKnXb1crffQiZiqM3b_Bx_iW6ybXbQVpKuyGPQ0zgUWn2di29o4AkhCLD6r-6ZTIazJdjpK5OxJkVdi-RWQ0PG9fYQwexEx6-lFXrUGVVZQGdJgCPlBqB1DFEyx7T5F8dJliXOmmku7LcEsqOSim8d3ME96YvL-h8bPmdcp0frrp5_OEToCzL40WN2nhZDgVDQaTOaQtQ44RY139DJuyApBVtLelR0O3cJ-8Zb5kXp-CHIgqWjz1EqoujJF54n6e5WnfR9R05tVzqi_pj8Cpg1OaTzhQkcl0ttBWzoU8RKDZsLkufNuOWS-aME0W_6RuRhfMTsu2hOPe6g8pDn7H76euL2itj_48bP-_5Jx2PeYYycQ32YBqyN1IBiEdwfNUl7ccw3Vl8O7px5fxtA3yBPVmWuDGbGjb-HOK9Hrkee6Zef_L3pypd8gJA0dyzSiOTMMC2yPn7v4V4_PJZnVVF-fPNCMGYaGkX2QpYVZS6-lSWmDtymEOHNYwoCAvUbtWj9yBSjMcfvrNnhMA7pB3mNHtH9vOGiU89pHXhZjjgIc6yh6-I2Oi1iw6tSIZmw4GAkg_1N5ggUxSOoqdUKnLpyRR6AW56xwBUMa_Jps8Mf4mnwj8HQOkoqpUbAW8sGgfc9TdJ81YAbCUXQc1WsLjqaKde-Z0JUs0ksFmOvKevGt8y3VUTuG2x8ceANGj6sPb2hmrxInywIuL-9oDBKDwG60TQp1q5zGjBcxGHFtC4_bhoAe56pf9hcTjtEabwk8le9wO0iuTDdi1CNSEnOHXFFl4DvJr4qXSXGmTTiBA2oDnI8xHE0F6A7mCcuSdOcd-Z-zrf22k11p4blyjOktf7sEj4KjwqX2nmZqYMQ-tCBikjfCSWmnDEngcsU3J0I7yiANkGUH-s6Ka6MPYDcp58b3iYbiOOvhr2zemduyM8ICtEr2H4cVnKWkN0xYN_xgDgpBR15M5_fWS99KywjC-E6wBGEA0T-DtjJvU4aX7pOUrsbTt53Va97Brvg17TloCob7AJhBuNqEYEmS88b4BAuJgUbXSqe4NGDqEWIWKjS1Q7x5qxF-iTUxuJYOs1Nrg3dYPzJv6d57nNS7ARqP-8s0JjmoOoz-rHrczruLapmJk5r-nnioKFgKIe9l-J5sQ08JY3eOykCwmJik5Z2J_gELs0rWSkydFfV9wiluVzbYYwIwPIaJMBjYerG4QUucwpMVxpEupBI5Lh3fQ4FBl2T3vnDn5zZ4Y_-rMcsKNnkk9xtckbdZSS9HKk8J1iRsOz7mMqxlsRkYnLLN8OvuJkhBH4gNG_kb3d6x6PPKXxQ7zSEPSVPZjiAmSRG0H9GmMPTZ12mp0tGG5yW3LV7jIyXNUIfNr4vtzy_oGaVlmE6HDMQ85IMIaL4rTcpXYzE5IUwNDN8fNejLu7k4QnoaIn0LKY6ebBaD5e0LjfIt9MMST9PPhvC2FuDOgCUujep0E-ElDeJpWgOWT_tp6h_yT4QIb-f5niwYzc1-Whom7Pi0p12SnIN9FKmoxsMOPkm_keLjENUSVe6nkBVyL0kCHvzwVaKWNngIYH7tX3N4r1kNY04ld-Gbgdo2bbMyOhZgudlj5c3SJekGLtmZsjIsOhZpVWvPjwJGSFFgA9ff0kaXZkthId0UaJyq2LvmvgpV-EQH0Qwk7pk64gkyEOmRcc82qHIqzk4T7tM4Tt7qvm_nDXeFl6tQcC3Q5GEYCtx41WrMTF_izffx0SFThnDcoTGAqMQxvEGXV2uFLttJPRrHFiWA1dIqJ4vx2ZPLCPWJAXPSjtx7yhM3L0S0xJc3cfIa7UIJksTVo5lFVoFLNNiz1IjulGtbQVArcrCsk_RSJkz9rYv4Lx43LgNkGkSPI_ixhLiuJGHJmPwf-4M9uT_73j3cT7_uh_YHIU7XkPEgdGi3IHM5cpotFratoH_4Dvkvkhw3jtAGJL5OMg&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=15260519776414052000&adk=2988274606&idt=148&cac=0&dtd=11

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7ba24a003dd63b7c43ae72de4071e5a77040e9fbd6573ebb8bdb8d5d68b6997

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42185
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 58ms
58ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 09:38:21 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 58ms
58ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 22 Dec 2023 09:38:21 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 0A4C 50 KB
19 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 09:05:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 261174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 09:05:27 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1627455/73523888/ Frame F256 255 KB
77 KB 51ms
51ms Script
application/javascript 34.251.137.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1627455/73523888/skeleton.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0jUOjcb7QpH6-_mKM7EWtiB
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.137.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-137-37.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 09b556c6f2f0f263e5445d5a5ce916c4b596aba88259e2675c7ab0c79890b140

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame F256 111 KB
39 KB 66ms
22ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 22 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame F256 11 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CKcZVVJDIelQDc_u3lXuKwobPik-8DXtLCq5_2YvCUbmBPOeNukU023LU9nsWR-6m-uikFoxIMXEoISGH6uB-c-O-WHfwulBpQPtID8lpcrkim56rXxzS1z2ztMO_KMR5b1mHm3ULw986T1oy8tpUL3ENebmdCTHQHh25N8irJTxt4qVc&dbm_d=AKAmf-Bfwy6BHGkTX0-l1-Dh9KuSFZI3W-7duS4i5p_KyEAGavBVf-mdatlKBerEj5iFzXBw6i_AqTKLMEPcYNJKcbYW7s1f1cQpUglN8cSIhcXDhKe8cvGCw2nfqhKDL93PCrXftiKUkYru5rEyAlZ4GBl0Tok0eGOHSM5S_go-0L_51_W0GhIlvTEGSmoO9OAGUZQGL18SxXjbTJzb7PizW8J6pQH9grbwr5m6JVgrYzXToRpEzkSTQaHTZCYu6VVcKUmn03xsHhMcd1ednc9qp2-DmPaTDCKW6h--PyTjXx_D0Yr6cEy8OW4OLkUeVXzJlRs7DzoSwCRo69XH4pd3PIncgt9A4szajKwwgWUlKiRJveYwG20gkQmuctp7c4244BrsPWPe3V7tPGiaLiz-ZMT2E74jxXkKe-x71rHmqCfrihr1qZ0LtNnlPGV3OOOXaatY_aWHzSbJeflFOu4qG0L8YaPoCXAxd5TCdJf2z4ptvpk7jJbxe8CEDCJM5lHuRH4WU56mDa9tcw3Y49IYRO1sMkiXhVCY_93BRF7mwVfqYzuHaBe9zkQR6jW35ike3IrJjp1BxTrn-RXhfYHi_tATyliS2lMwI2ZsY7npinE_3ipb7LaW3JnxfRRlbbKgQhjr_IILUoZH3BfO3zA6W9SGwe3NYrD9XjygXIsHW0hbBpNDKXyWzd3bUlfvbrzcCCAl7V2RerBS4mBZJ--eEuLxyMNTL_8vgvDh3CG4whhUMrU0e0zi0dQddlBtTZJqdZla8fhW9kHljpuFOOSPEhrQ_k0ZS5I6xXruQQJLMCPquo8cnl8sDofpzBeq6fs0dyDKYodP-II5sRn1I-7CCJ047v0Qfp6Zu3uKk8ENIM19GNPehkiYhNyzx_U95St1R0t639XdIUcrN9Da9WI7PvCQsUjD05PI4fFXeUYMzmm6xltwHZKsxLTSta2AepkpNQVOUO8MvK4fn5CnMMErxcAvqz3AesgTH0YVWxdWlg_CvP6XFqV1lNKPk7xvKYyw2x20jv-1b_PwiA2tODTKj8hYq4llEhabq-dycPcfPw30s5wVtnt1Nsa_qH-lI-0E81KomAbEXcb1l4ms3brCXwf-7gE09sVjhGTKsk9Vz5LePAXxXcxgABiaWwElt_FKDH_-OLkUH-mah0IwoStMJJa8-n4fZFPa0dXqD08WUPH-WWIimRmQ5MSqrfuysDdKOD_aQyYdhsfKjIJ8xAvI4Pgmc9n4sWuRyXVAJodnnArfNl3RdK3TzlEOqFlC20NBIQpMO3CYlQHNNWhKP8gIOHguaKHRe5dQM0s5U3RV4_nlUkdKhkg7ocu1Jq2js8fJzFSQ0yPub0rfBCx9MzP7GUIRj1kR43adoU3j0FQL1Y3QHRJzq7R1rydijdBCbj_p1GyB-r2mFsw1oDMZBKHTz34Q8lC_NiNq-_zTP1eWtxcw5DkSXxBur8h8IXg7BegmNNzPJT1x1mxmlVfVLuj-JoEcMDFg2CoiOzocpKJAujnhcKPCzya1K0jpcnc7-PotJ6q55cc9IT10V8GMj1VBVrdoC_7VbCihRGeousjfC4rw9u5TXcj2DMBspusLrG2t_VZrmXx9jHzwExRVwFHPiEwfCJ5xYn2gBAyfK8ekB-_QdXS6MRVMw2FFNjyFaH4wOOz7vJNKgHvy9CGX8uji--L9ieDDyspFUsc9uiPBq8CYkXwFBlsoamoWl0ZnK6lJzu9meDCZEmFePHCKnXb1crffQiZiqM3b_Bx_iW6ybXbQVpKuyGPQ0zgUWn2di29o4AkhCLD6r-6ZTIazJdjpK5OxJkVdi-RWQ0PG9fYQwexEx6-lFXrUGVVZQGdJgCPlBqB1DFEyx7T5F8dJliXOmmku7LcEsqOSim8d3ME96YvL-h8bPmdcp0frrp5_OEToCzL40WN2nhZDgVDQaTOaQtQ44RY139DJuyApBVtLelR0O3cJ-8Zb5kXp-CHIgqWjz1EqoujJF54n6e5WnfR9R05tVzqi_pj8Cpg1OaTzhQkcl0ttBWzoU8RKDZsLkufNuOWS-aME0W_6RuRhfMTsu2hOPe6g8pDn7H76euL2itj_48bP-_5Jx2PeYYycQ32YBqyN1IBiEdwfNUl7ccw3Vl8O7px5fxtA3yBPVmWuDGbGjb-HOK9Hrkee6Zef_L3pypd8gJA0dyzSiOTMMC2yPn7v4V4_PJZnVVF-fPNCMGYaGkX2QpYVZS6-lSWmDtymEOHNYwoCAvUbtWj9yBSjMcfvrNnhMA7pB3mNHtH9vOGiU89pHXhZjjgIc6yh6-I2Oi1iw6tSIZmw4GAkg_1N5ggUxSOoqdUKnLpyRR6AW56xwBUMa_Jps8Mf4mnwj8HQOkoqpUbAW8sGgfc9TdJ81YAbCUXQc1WsLjqaKde-Z0JUs0ksFmOvKevGt8y3VUTuG2x8ceANGj6sPb2hmrxInywIuL-9oDBKDwG60TQp1q5zGjBcxGHFtC4_bhoAe56pf9hcTjtEabwk8le9wO0iuTDdi1CNSEnOHXFFl4DvJr4qXSXGmTTiBA2oDnI8xHE0F6A7mCcuSdOcd-Z-zrf22k11p4blyjOktf7sEj4KjwqX2nmZqYMQ-tCBikjfCSWmnDEngcsU3J0I7yiANkGUH-s6Ka6MPYDcp58b3iYbiOOvhr2zemduyM8ICtEr2H4cVnKWkN0xYN_xgDgpBR15M5_fWS99KywjC-E6wBGEA0T-DtjJvU4aX7pOUrsbTt53Va97Brvg17TloCob7AJhBuNqEYEmS88b4BAuJgUbXSqe4NGDqEWIWKjS1Q7x5qxF-iTUxuJYOs1Nrg3dYPzJv6d57nNS7ARqP-8s0JjmoOoz-rHrczruLapmJk5r-nnioKFgKIe9l-J5sQ08JY3eOykCwmJik5Z2J_gELs0rWSkydFfV9wiluVzbYYwIwPIaJMBjYerG4QUucwpMVxpEupBI5Lh3fQ4FBl2T3vnDn5zZ4Y_-rMcsKNnkk9xtckbdZSS9HKk8J1iRsOz7mMqxlsRkYnLLN8OvuJkhBH4gNG_kb3d6x6PPKXxQ7zSEPSVPZjiAmSRG0H9GmMPTZ12mp0tGG5yW3LV7jIyXNUIfNr4vtzy_oGaVlmE6HDMQ85IMIaL4rTcpXYzE5IUwNDN8fNejLu7k4QnoaIn0LKY6ebBaD5e0LjfIt9MMST9PPhvC2FuDOgCUujep0E-ElDeJpWgOWT_tp6h_yT4QIb-f5niwYzc1-Whom7Pi0p12SnIN9FKmoxsMOPkm_keLjENUSVe6nkBVyL0kCHvzwVaKWNngIYH7tX3N4r1kNY04ld-Gbgdo2bbMyOhZgudlj5c3SJekGLtmZsjIsOhZpVWvPjwJGSFFgA9ff0kaXZkthId0UaJyq2LvmvgpV-EQH0Qwk7pk64gkyEOmRcc82qHIqzk4T7tM4Tt7qvm_nDXeFl6tQcC3Q5GEYCtx41WrMTF_izffx0SFThnDcoTGAqMQxvEGXV2uFLttJPRrHFiWA1dIqJ4vx2ZPLCPWJAXPSjtx7yhM3L0S0xJc3cfIa7UIJksTVo5lFVoFLNNiz1IjulGtbQVArcrCsk_RSJkz9rYv4Lx43LgNkGkSPI_ixhLiuJGHJmPwf-4M9uT_73j3cT7_uh_YHIU7XkPEgdGi3IHM5cpotFratoH_4Dvkvkhw3jtAGJL5OMg&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=15260519776414052000&adk=2988274606&idt=148&cac=0&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:57:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:57:58 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame F256 31 KB
12 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F256 41 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 574393
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3482 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=842215393238&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3482 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=842215393238&version=m202309260101&ct=76&x=1&cor=15362904573536743000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3482 16 KB
12 KB 166ms
164ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BASi9PcbeFG_oOp2Y0I3bBeQJGkQFk81rOf1yhfpNPHRktG2z5xEasbPUaeyuGu5C_ap3q1Xml4aEejcnyM0rg0Ep7UzbAOpILni3aOUGlUVRTd9p5lb9rP4qQdS6xuzIKP-RPSwZPDWNyf7ShQ73QHTVt-ZtYT70r9yLPL-txyWlZaUs&cry=1&dbm_d=AKAmf-CMr7viB-3pqI2ZmrxK79dAI45uojR_5NSjvY_EzEfbIgZZ_G6nsj5BL2SZKUIlR4eldK1jkTjP6_DPtqz4D96iEMvwmpgIvPxu3bK4hoOesMovnhdWhPwumOYh2dEM1Gb2GUethXJXy_CDpAvXZaaw7gWnPxcNeTzpiYKtXOfqyeSNoq9r89-BoAXr5qVJ951oetPX3jr4s6MKV4TOVZozpLBDfR8_XlQu8bQNQD6s4gHb2pLmMcUpmnv8gxB5QBH0itCw9vMzFPNGRJ8zMxHiKTNmRZP6eItR3lVYqG98F7FSg1uditZuescwKJJzEL5e1b4C-FjBSnm9cJPArm6H1T9iJqPHmQfxGqOBws7skqTobfeNaQS_o_7HFpVNDJ8EUHsoNd0wUhGgnHwOoR2TqtgyY9WN7y18__o2CYAtAaEAMxm1uWedW6CWZCBknzpCUABFPgE7-xDCdVrrhRV9Vdm2TZMOrRlHwlBLa-E6e-pPN__3jxU5jicoyf1FwchVHVvmtwLCQp3F_JhilvIo1thGqB21p40pCaRSi3uS51wGAkX58Q2BIWY1uR2lUgrzTpx0HANWjQZnWviPiQtKulfKmW7tJVdL8M7TboUdjMSrDRnscQiWVEgMPE4lwx4ARSMq4U5AZalvliV218MONuwkrz3XRvdSZTDoq3HRkp6X2DqeD0n9tRyXosMMGPGNwT9zKQXNMerd_E_aEGOIJRqLUcNp6IDYExJsOa4qRCh2Q7rkSYET2_H74Y340w44E47lkisGZiE9JjqUCgnKuSzmXl8AHt5cgzivNG1Xg9MwLGtehCTpJOQ0G0mjLJY7oqoxZoi-KUDQ22Zg4g_AaG3H9yKtmOxp5uGyJbJ-vnboVORP-ULdyxrcQocIsPwrQxf-FKsDV69MD_CnilQYyjhFpL_YITVW5yNmkz6QMvcCt1ftjGT2Lcx1hNL-QVf5ZG5aG0UQ1veppqaPDod94wWQ91elxgVU10CQ_Hio1QUr2s7YrlMMPGZeeSNlTFrR_pqdAx47cew758ZdlLdx_mymSr_HS-jlzyTpDOjMjeBl0TcQWkkOGSYzCRnygGonAH8cGlqmxtEA_i7YIuzMuRL8aPZpyLfKLFpMuq0kltj4GpNBh5zq9pzIXy-XLP41p4TfAiE0NigcryU_eROXCRD41XGJndflxhuSI7_BmAZ1XogvjNPpJIGTiJwHjXrIOcCvTBxLEnyJLOZNa_l60Ow2KXaXxbkA_psHIc8Yw6UB9xgJXF78QX92EwbewwOenZBZPHDVYaHBAqwfh0MR4VrG2N3GHqi-kMtRczjB1bKnqBJoogTCOIEziYkcNAkcgltICFMdeUznLQVFRvJFdMayOeFXJkWitvumpMC9aTjxt2kvAHwFusX_3BApNq1PGO4T_9xAAquRm9zV55B6Ksql8_Vqm0xIdSzj7wdAzB46JtAqKa-PUp3MoBEqfMbcDrjbxR8KNwwpeL5mSsVLqk-1zSL7ezD17xxt0_PE94YLu2CuqOgr5eASL2aXoxKQONJH-SAprU0qZrQAG4NdNHHKNqIF6GkfsfqI_HMEPSGscUpQrQumkPV-8BHN1bltvhPHxed0ADbu4bPe6AY7R1tiCyArtCmHyGkBZr734bPipth5LVxb-tgqqMPixNU5840yftb27V8jtBJa8eHyqOnNPWGTCdwtUp1aLcGQIzVx3Xk4ByfVRc27NxhAz3R3M-Qn3sP8LHRGW3OzOlzSVy_kNXvdd1Nnhx27ziXStfJii1gfOlC64nSOtrQck9w6PQrysWzjr0qS0z1hWAcGJmGcOIW0Xgki89M2P02pCbIESuOOtJfWpb_BpNbknQNUi3tfURavYd61moiMn3zuPfPBcS6CVEKNWjM_089_M0CVN2pf5Lkskwz3etXozGGOtYbI-yrhBt9WtWE--XyK7_JlbjWjJiblBwOquhSsm1ijcta_3SnLh_TyAdB1snKMU80rbivOj3DzHn8bPB9bEYH68kK6yxSULLuMi_eitj064euzIqXha_XMyaXpsv1fMDEtYYxud_h0a-5ySUUXdZ5VF3U1r9uprPevYMIh_QjjyGvvS5vRWQsAhhFTnL4RO0f1mBY7nE4Tv0FXpK1nkQuUi5KnoqjcLtKXA4riYNxfXtVKYhdByN8EeSlqxaVrnOWfDg6yr-YZCrovAa74cw6f7AmElcHADRg5vMYQxN_nxeGcEVUmZnmQ7zT56PKf_kH-sTP7RVQ5Wt5AjdZxFPmqsRmLPIoq05b-E57THTVih7LzRE4S2VnQHayD0bKvvOTtJaOsvrSTtnY6kLbBkVBIlqSkF-veAhpUYRFPG4kVpik2SLMAAEhCwLLgVQXpMZmcHHZp-nkOli1DEJ60Cmpu41nyAatnPytS0RnfCimsDAM83NDVRdVn7LlcLBn2zn2syBiDZ_pw_57_qDcyWV0-mwObeSKDrUVlhlIMLALu1pAGxrqKKRZEB6n7ToLCB-e7LshtQnLwLVS4U2f6g5CO3maLBg_W-UVu7n2-6xJWUB1zQQVR4T0wwNe9cdXgLgVO3j5zq3Wwhy1JAT_YLg7wHYn0ZeQUMQykWVpoldb8EIlJPpOnc8Q0GBoV4pXVMqb6y2cq68Iw9bL4sQ15cSKMqkujDwvE00gNPaMAxG3-bCXlNw2wR5vS7FhHuP4uOy0PFZntCwBT5lp1B1fSGvAmMikeXbB4CrFqqtdekSjMQrbwt_FXEXFlhIRBahAhgXFMOCxDWApZoh81yQJ6KjCtkFB7w7vJ8_lVBs0yxWYwYokI9aSr6l2eQ_tsd4FO36AiO0V63DBORo5ZFSG13BaK_6v2WXqUszzBjnv-nSZIyIgSXgI6ooU3KyNhVsP-gT1jQfkaGmVes8TsIADiTUl3HHwohp6bP-msCwDAKcLo6oCSj4DpjwgQD-X6DbbEA1Bmyj9pcvDiqMgWvjTZXiq5XAU9KEhMLsM-MiFXX_akFGZBhwMT-dKzVJPcluXML1Lb0KE2f-wSgH05_zyfqw1OqQmyy3ZmmEo0AQOdT5kY5_V2AVxkzu9uA-LF2kUg0iPdhyQ5hFbsSVG9u1q8YT0Ni8Ue7Z-O6xeZ_kUVUx4q4oQ0sG-SiB7PO1tZ20-ps78vXfBPA5QdIhJjYp3BWyvZfw&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=15362904573536743000&adk=1684704083&idt=252&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

324af09d936cd80a9dc4019a0b0487eb2092fbe6880cab6f2ed4fa2977072bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE38 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1088679612356&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE38 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1088679612356&version=m202309260101&ct=76&x=1&cor=18019719485378800000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DE38 110 KB
41 KB 89ms
89ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C7ZQMhkb8yaiu0bJ-lmrL-DP3UOygGYcjIEUCV5hYU1IeY8IC9AfwQyma3GlTMljeduT9ltdpbGuTLpq8LGjgA87gBDROjzsc0OGYFLp6obZ4SeJoo9L8_Pq3uPxHKHKzA1hDYJyuhcSQ0V0wXxitj-RqnQYvyGlehSmnd6bQ3f5c1gak&dbm_d=AKAmf-CyA1wmIaKYXQWTFok776H9XsTFGPP5taHJFHGvBxjc3SWqe1OR9TJMvMydHD3iKEkddAcR-eZY0aIhIoy6vnJvmeRPxdimQFaQ5Ap3cCKyWmmdgP32IbmkYSo8j3aVHQ6ggdxULm1Ghn_FUBkRXE2hB87dSA92Gk6cNggFYZ1QLQgfJeTqQmHMo1r-Kvj36BOBL-t3dG01AfziEwLtxjbSdFMt9Jp4ua6z6By5fLzF4pNvem_-a3tIbuCqEXvyXMnEOpzYc47VcLQrKOIvvttF4mEIlNYeDoI9xjI8uMJL75qugQKgiB09YCZZzD0siMLvpZ-TKObQFjQ6Akyb5zQCjDLfOO-zC_x3BqxSUt2YeWpfBj--MLEC-4xPRFeyMkNcYVi-Npgz0-STybVtE0POU68ApDVH47vSFiWg1Xht5Otlsk1X47SAneTY16J_sCYu99dM9EJYERCnsqf7_kGAuQU_Sz6BBQTCraauidXF5vnSbJ94kAmsg8Z42pAC1Wpk5AzP3r-grJH8Exizj8llCNeO8NNL9frBncU2ShvCflSqzO4FqLYGLrM_1U5W7OJ1B9QpD2pogDtLfcw-nHznvLeo7dvgH3zyHDtkQK7DU0zm4knp9TMycZynqvcAU9oC7X8xQh-m2K3FNExvqphgunzvbnYb9UPm7aont_wVO5UF-WlAR5UXhji3jabkvzkXdRQE6BoRbfEUAzXYiOUQGIsStsGeM-fnLMJTtx_StGji61OvVEondcjcHsOykE4s5Mu9CVlIyLCy0T9x-eyvhuX_QM5rVqg6DY_CVgiuS5C6VuXZjeVavSGAXIbjxR-u8fKe49t5u0PPA1gFDJKAiI52DibYICwWssXnZPWiYjsbuHEr7CGmb-iaHIqErrvh7L_ZJ_fbjKdckCSgGsIXF8vayOZUxoSFWB-vPl1CgNOiOxpI_pUoKKipRhXd3ngHtb8KIgqx1UpCKErdDUMFZfm9BZRxQBJEh5svoB1Lwtya6mLbGvggROcCbEFEG2jA7vs1p_qwrnddgdhbJNCCGRchHOWyfAVlpFGD_SzyCjeZeiaVghBEO7RI4AkubbkkL0qbpQLojznPe7zgKqev8Jx9T43PpPt8sPLNgQtYmib94qZnuKtW_fGRIbun85FayStmyvtuFQ6MJb3EHiz8XiWD1y1NwOBcSzZftmLq_hvraz6lQSmJ7EQyvSQ6aa5pzzsCs8VVOo1Bob6HoC6ogDXyv0aG0KQtPKtDdWSG15XuQtSDJb48UgjQFw0nx1k-kGniqmOeeOfeHhzwhAzqcqzHV3cyMAIAeM2q_WJjF2dOvMa_ihravmSY0xma-nyFzQn67LxA16A6z7ytqpAL8GGTBjEA8OShAv_2eoLSzJ3NMwBH_ZfgPzia1HY0CEVIx0oz7qPzmMZPRtWwAfhMc5ZIPdN9VPlE5CbnkLq5NDV0fnHqstjdmNNPKBvFKLAm9b2pGdxJXPiKSFtQjPJVYZappFrHIa-f0p9fZqZZwk3zucG3_vu1svk99sVROzYvHsozL9Yd-44eZJbP_ctBV8ZzPBlLAtEs2FMIWv6egBdYpRrEz9v2MEEzhZhehmFmPTSVNjApdqswTphOmDKejcjpgkxQocImcYw6lMoMQJdKCFsd6KoILU1Uo9c4kDw6k5Q4WrnDwO33EtuNQ87igfnVanPf1HIeE8whOGEmMJ4OQZYGcYE4ZpZl0FU2gn7-DpXhrX1thJB2pkHQHB_WW5XpBh0j2AcL1tXlN7m8A5Q57OHW7M4j0FdrRNDs7O3pTD8kY9I13OdukxHG8jTzco3zyhpGESS2SDzH9vlTBL6g9l50GNwYYeIWWGXNfoRp6BZTLHlVYse8fkeh6BXVteTLJALZp7xDgHpdyvwjQ5DfDMFG5Oc99r2UbPMChhkvhVMesTYVX7NOn5vDngvZT4iunatsGSGoEDU7SR3zYe34Kay3hDu4vkilrRtRYBo9FA9NndzbPP3PcchKnQSDSDv4d4zA6U_BvjutWv0TcxQKltSie7Fsof-DJiUfdXkvaX4d7ldSRuB39vIOTHIAjmZt4PYg9S1jjC4gELW5Ud7SzcMaw2vS9DESH0f5yGQMuwWEM5QA8WSZ8YSmW0EuQ4wH99A74o4BOIXTm21WIrN9fauWKWJzdkGDRBlxJ7RPCa1v1TuIF7Odq2niP33-HH6D1uxTd4KxA6JWnUrkqIPgfUYVgtIW0sYzYeRxfLzO_W6slkA55XPfCHaiSpoe6OLIJjiuEUdn0zvTxUw-2dMWLdXTX2fvmAO_tn8Fc22BK8pWI6Ewa_gK29h1hs-MQXISnAsfIFKaNOVZoZkG06qiz1EZso4fTq3PUoOAghUrPC257QDjeZpm-lJWp5lCC0WOslQKgQTPpQ-IZ-QUEK-t8NJvSl1jfcy2s7TejhVNQndkpVNw_BCpmKlE5cJP7ECV5xMdjK4toMWhUKBhAkTh9jG3g_Kn4Mt8kDCjzEDiQZdgoYPdfgc9Mp7KAye0tVxCcffx2Qqbd683a_x_0rXFwCaFaIqhrCUtFPfCmKwDl0GJoeKD5OdbeC_so36FykSxkCgdEXVKzXEZVb5U86lhcxZEQ7FyrIalqTff0SUkNM-A8gXcBvTJOtFUVyBdcOniN0ys_TuT59R5yf7llRZq8UOFL3x6dpFH3n490_Wp1RL-BqPnFvY-djW_9Sjv7XrKD9xJNzxtkLJWb_SCgBeNbqu3nNhGVMsRKwgDVntNK6ZzIgBEQMU8Vdb0vewvWGck2tNe_hHDQkGCfDAFhCi1zJPkjrP1dToFzjhDyn47UI0RYcZxXUM0m82zBSyUn9_k7LduuwwXWfxZpX1ZzwX1_A3Gs6sfpxi_ic__zJ-6oYji9jSxukZp4qaJJ6LjHOtc8GW7aVBvFtk-_CtZGjpSJWR4yJ8V4coFlJuLNC4cCgcBh8OtBCR4OT5g3oXhVvaIyC6kgQ5ibS2wNar145gVVYeToWxEr3ljpFIYQ5FmIWdCt67PDYLWWekhdz027mHrxpD8gSUAGzNz_VbvwySl3UWGc8VQzT-2g9MzQTxq2lsPV0JzC5qr3A6Yp1UxpatmAnOoWrnVNW6iA9n4-NxNyzzuai8sFBs86o-i5QR4BL9tTYbbPaR7Tt6gbew0imZLQKeBa54f5UWHRfi0vxRBeeY7iULYbaayPtezWziicX0I02iFDnHpU3ONvcAuLvR2n2aS_pHN_lqPmQugrQOlmOE7J6vKKO6HX-FvzzAOLtQ4rIdmAbeqJMSjI6ue2RtpS4TGk3b4C_UFb0Mix_9Qm2pygWK3_Sak7GydhXdml_B-O_bPSR4yDrd2_0jNsoiswXWv2EiqDb9ht_XVJOT7ZabshiXEzAc0E1KaXCk5h3QF_P77JQs63iyun4_heMY5TW_73CfMyv-qAVs64CxPcDocjfL0FogsUqSD0IgOUH7VTXm9ucS8xzLweuwsbFpk2_87O4Qi5hBsG21tMDilVO0yKMGCapKAQE0KjW8OMzIymqyPcDS-eVwbiGZ1pLQTDOCe-wVZRsStASrRcoxgnmalMEwsVFKGvZF1wXpMzC5ERGDA8-_8F-ChXKdD5Ftih9Dnv8nafFJJGtW0oNG6GrXLGksVUvsrwh1QzP3FmBxD-2Hy5PqDLPxvOULx4RdkxQqt2EEkM0HJNtX1ljKRd5Y&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=18019719485378800000&adk=929882888&idt=287&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5012947c0bf9727931413f3d4dac33adf9f71e8a318630ae0d90a47ae7c302ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42383
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C70 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6596687120919&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C70 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6596687120919&version=m202309260101&ct=76&x=1&cor=14279165556893465000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4C70 96 KB
40 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATiWrtF_a7ShMjwWWWOeDNDinDhBk5ZxtIqer_PO3_DDCSXD-L1PPgcYiKxmCtljB02OY1PA3_-R_oj52bh36G0MQHKDEAkzPpmJBj6-hH_YzWuSGpwfSiRUOfXcdGTLoBBzk7Rk8Os_k16rgIT1l-LaZZllsdI8dXHIuscPOYCecntjI&dbm_d=AKAmf-CtA3VO6i4C8uq8ne06LGMeM0Xzaz24tQgroExbe-IvC7MzYtZqIDVVHvn4MwADM3QRsSAU9pLXul74wmu5tw89N_LfO8ZZPSkxD5igaUL5EbASGGSw78rvW3yDEgTkFwKkIvFoFh1O-5wvSbQFL2lkApvIcP4mJTVMkqwZ9umdBOUDwFNVp8Dslo6tu5Tx4_xFYaYC3DMjXuRf3lDyetU8R-h4-mYGif20YT32M8DPPtkp_EWixDYP5shwn6tMUNzk0ilBHWSKubpFKKtSBQHYONP07STIWjwrOxANb5J6F8Lq6nH9M9oDh75lHvOeZczQwUjJMJWcSe4fT0bsbL9xXniRdfHwxoNyYuZBcxNDcph8DTx3P7yYbrnzCGFndz2PKrXDt5Mgqka-a6OyQP4sMBkzOPsUsIqH34XZ_4wusX1BeqTc3Cp7_SYAD3ldsbBjCa947TPgGlmeArVP0wVcr7Aq1y_a-UtvAbDLZ-HV918NF25L6iti5QljlQih_X7Q2UBTXU_c_TOKEVB5NoUVXMJFETcTO8mYHrLBI4LyTbMSLPnCp6WGydTjo57p2KlCEq--ntHnm-8r5k3__bZKVUgRntdjaJJOqyAKqc8W7wOpe7EPWq969_CGLOPz-sSi7ep6McZujSy84Vy8T4tGWoJ-0a54gr8dneI09mofJl9E8DhIhE7EZIG0PjYPMjnu9iD6xk7nhNPLfCnB0pVk9lIk6J2k-lHER7fbhIQsLl6olXbc4aazux5OWYOiaxbP1U4ZnABJsykRIaj2PNuirqGF3u4fNNn_te-a803No0MKqNv9KbmwlsgfItrXHAUtmdsHMyNJVH8sPjMn0sEOZfdOhHU9Ps51kfbzxOBTwAVszUdHr28TJBPFntl9vvRNpZ0lRqVXhf8zH3He-2nV0VoKVnKXna6hxBjmbm6vhI7Vpp2EBNvciGe6Eh1GI6VQuTkdLDZnSMJqTwkrElofZiagjHlE9H5Xx9MGoHO-gCnB7o-85ZEYmwi-69FBBgzs5XSuAnncLk3xrj2t1SflcZrpq54uqQF6xN8euBzj9Pu2W06hJbV1J9WDQLaS39Kf6GUlnVdMSw22q92PP9FTbJk1bvK9UE4HkmJgIRE0zPcgoq7HcqwtpB0Z_Bv8RmfG0CsJb2Y5oGL_e5MjqgjON8fsv0J_N6Z80AVerZFaq2oHT1pr3o5I09QB4YsGI2NcThDOBXIPdADaCSAwyQ_AX-I9EgeBeekERXhIZABOFG2gqGPVBWcsbvMd8pJShQXKqH9JkG9Jig0CrIDZGdpouX_YprIEhRmPxtaQ7YBWawYuIlEgUdJBD6sVi8k1lhJu87G6Qdm3vZElVhNW_z_khBqOKZexIbFly2N9b_BRE21g4RlFbVGClUPu1njI7STYKJbdHyD4Kk5DLEYY61j1Ea3PcN4Llzg6Uf8sg-dcc_F6fl1rk0fLuBTGBZSQtuZkq6ODCWwJbQqwW7ODcKeXDbVW55LDDd73qLaUj35RQVaOlimxOO8Brqd1vkjiaA_RULJqENkjUAj-IBsgh6YyRIuQVD3Pfffa2DD0meAJsS5BXB1EuzXbIWka0WmDuWSqYvsjZV53byUkTR9ZCvQNTK2-A4YxHgFW7MmE9Ggcqq3fS6-7O49uiXYhH4TiAiLsDWLHf8mTQZhmsXw0zCXTRwQMHkvRrg498UJZkLVCxiw2G3vCvWdbNICOOqXJd0T8PqJch6sOjjkD7W48zR0Y1x12OLoIq5y_DyJqaWBpHeqhtLLcZjLpYp6bV67x15wRpNThMUxctGlb6LgFcIPiKwKS3MvCHFaerC-JUXtjX6OipuL83eIt-GsQhlOa8sk9K8ov6w5OiDq2WPgkaC-FrBC6Es7bbFWO9mXLlxKjEN-w5h_V78W6tZpvEjdXUqFSSYaFsi40seVGqvX0BOCTj5MuTQVDbUgoP4x5JhuuFi6RW_GvFNo_3Szc8WMxMmYcWndhiGGEkUvzEIMLUqAqi1Xf8FGs_J6gPsQz3WwgMu8PkxAus6OFDYDIHCLYNFX9cgVgIU1zBFSefyvq2zfRXoHnKfvLugwwWOb1uIHpq8SjCSHjamHfzea6NkNrHdMsUK4mug6Xvvaw0OEDGqZPC4fczwsMH8dn0wfdcz_gbRt33wiIamjv_c7CNknKugrrMfI3EL0TiiLEYYznQeeac4Ndwnx8RS9prL-z_X2RKkfvjZJvOqqsWpui57rWPhhmV8tpU3w-ESZ-386PVprwzaEzchPH8-wxuewLX3N8stQjPX9pteReALG8ND4tJ6BIkZGoT-JEnhYvOsJofJ9QxlVDlCuXW1ZcOg9YnU1Wy3ku8TdzGor70HpCnpx_Nub6JnHYC5tCSsNreK5BfyOjEKLEsyxlsHeCBs8qpNS2jM_xdLPzO0UWbLUtWl_XFrSjooMOe-1JGkEy-NTnHT3t9b1OSUc167vSUzFVgHdRZjcO61mFGFh7ob93XiBFPivHjEWCMDcjLdUwJs7T0llKHiiCSKHm5Y6qsxnT-MTTt1LR1Vfx_tL3r4AZz5bLae6WExPiMV3h3OkoeOsK0CaMU3smb29ZFuV2O7r3fefUS1If-Wth7Lwo7FFoOwW2Fl-OtQUolrMqtLaGY631pN01cvhfqhu5uGvwUiKEad9j-hzIoLFrV3KD1RmwN_badUvXgUz5MbhJE7wkEzXJi_A1Wauqrmz7E_UZtqsmuY3lmg5ALP4QURqF2RfrkF-R4pjy3LIavEdX3BsGC8rtO6JhgDWWWPUKflyBvLzBDDQfJxKZf61vateelN1P_fAQBb56qNEm7QhwA-QOvTBVukCrkbZ4bwRZ_yyvpF7OfiT7ei_EiRXuK28lb1l8YlqDCWKTDQ8piKho1wzaACO0BS5SHRIIKQ00Yw_mOJlUUxRs1XxE38blqD8ER7bU9mMuW3JFsEaWF7LUcsLzqW6G8nCatanHBRrFYiKJEVFjh41nOVl7TBE0EcllG4LI2s0LgzbmxPPYG4ffRWmRMgJhvyHj9aVqmEfLY_h6fZf7lJ-Tarq446gO_JBcKB7MaxKDI7pwOEU22MeD0ljnsNxrzMj7FDeZSkLdZS3TVRW0rhwNK9kPYxoJdai6Nv8gRQ_aDbJS1MWvwB3neZKjwlYRQbQAi6dT7Va6YjXJs6XKl4W3HhiAVwJcBDOqq-NnVkQQILOz89jQ79ACdSwZXmp-_yV2RVh6wDAYUDiGy-p3T5gsf94oTVzWO5i_mt9ML-iRgCXBpx0ClFOXPFcfDVJXxvxq5dMq6Aml6NE7M8JYL4wf1a8ltdV5lwDzoKuk1j8WiYZ0oLKWeKFeLW_674iQeCJSazs_U7yewrA8iuIGwy-coU8Sz5azXHzYeYRJ33lTA0bCdk5Gh_vAUdphstYXa02iPRPW5px-9sgoKOgPmUyZoW30jT3TvtBqdETPVkH52iomci83wpj2cDyO9R-KUTftjgTNPByBQ7DvyuDSYWrnyJrRfVU5PMuxqP9cMbyP7I-PFEh9kcHe895J5sxmKnYA8javbQQ0w-i_FTRxq5TCiEaUgAgz5gvB4rSWhziixgqZyD24cNFBmGB9XDmjpfc1Qn5e1Y92jVpdfluc36QgvwDZL-Dtw4M6BIMTzIrsh2Qk7Ntl&cid=CAQSTwAvHhf_o_bigzSXalo6xbGc2pfsSiUZntfirPK3RtahqL1EXg2RZly2MaNu64mlVm2l3Np7XEQFv4chl4gWH-jmjQQqQKzemMzmZzBOkJIYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=14279165556893465000&adk=1726166463&idt=212&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

059e257950a33b11fdbbd77009f3e90e7e69a4e3c3cb0d694e847ba3d59116e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41230
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8DC1 38 KB
13 KB 22ms
22ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 260694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Dec 2023 09:13:27 GMT
expires: Wed, 18 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/17864851622750576224/ Frame 3B4E 6 KB
2 KB 22ms
21ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca212a6d45038b16f7e2ee85414d0f67362985095eac9dc26a34e96d1ea529b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 473786
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1847
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 16 Dec 2023 22:01:55 GMT
expires: Sun, 15 Dec 2024 22:01:55 GMT
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F256 0
0 121ms
64ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsudzVwFlzFrrCkpaLJR2EQ1C_Jg5DLE5eZ-g8pZpNrQeV9qpDKB8fPeRv6cehmlrc7gl2eEDY6WkHFhBAVEq8qjJlWy9zKKhDeASY-YSWYLi7LMbnJ6lOIJ-U8HARSy_qck-8RIcz6upOz7CZYkRtaIruGaJObktRInx_BoBwRPopdTCl8MUJnFYbsfgf05_a2f19U17J60hPhU9mbUm8mtbHBbKqVyOaJxI-z3kQM1fP94mK336xQw12q0IJ5CaRFnxnsHUtBQqnbSttZE39LHCkd3tuzs-tnHZcK1LlPY-pUtgjcEENHdpinBeizQMTowOdt2qaQAzTNanLTBe-ltKNTF6PI5CA0gRrrOGcMqE-MgmY5Q9GDYS6HaGW-VZtkf6ZWZjxTGzsdvwQ4RQzhLbal3piayRCiuVZz7-CPJ5KtaNrUzrZ2iDS_VChmP_mC8_Awd8j6IOLquSMSx3IIas3QfEND6sw2XnrLKrk8ORWbBxRS6hF0wmbgWyy5ieMA8eXC5xRN32-ZJRIxY5VjGx7cwuz5G1jmYcXTNDPiAGBBbAG66H7t0bKHdqKS0dRHrJ9JTTjdfL5gTGDMOvla6yTkT0o0E6REYYmrXVF4nJCwRlacV5UNmHJxtrYQx5BugLaJ_QdWrUouigkII3ke1hrZ2nDjg18qh9ddVAsV2Vg9ruanutCS7Kahv7SIKW93QZzwFI_fzfTGbwdJBfc-LXZrWgJR2V55gxy9GJqsaZNM2h_HboVUaz-b3pC3014pS93jvjo8xFFn_Bp1jFpZEW5Di_6zTe2tnn8Q6VkvkOaK9bbkppJXoub_GppKNWmNNEO6tVr7O6nmW-gVdYJHO4Pgs-QNb8VJZbGWJ0EtwjJj0zJaWPQ_BNiQRYlyLxefdrl1KSvLrQo_Fp_fhnIZVJgmaCp9W9VxMomj_aCBnux5foJ2AGiA3-_CVPB8SkAIffGM-SqULzIyRlNzW431TJEY5rFf3uGqwEXjCvtMPZwwtumzNa_Iv-wqBPhh1y0DOg5N87Q93qLer50fErCL7hKSkElVA291U-yQlgEoNHIA9Nzv2BCMJTlbwWmJ0pLEo2UwMv6D6iZXCRtws83lhopmnkt6CNsRVm76C014ey5_NTYi5Z6DvCZexN3J52EQbWr-VhMrgv-MuWbTbj0D93zx4eNOV7b2-3udJ0cNcZWql6bHPCRCfFb4aqvHl54zaF7U-M8dvQZYGgS7h-N9hTxmZE-i01Kuz2nCb_DBVrvR7i5OpCgoewBzT9VMICwPxhQRfPKr2DC7Zubwm-aabvltg1QPQDUApkrwGHr6NH3eD&sai=AMfl-YQqVVzaCdstmCPl_Eb1CoK6R2BBLXk60GoGKXD-bvv5kt71llxoXKaq4bqBHjlDff2N6pijSmlehmKLyfHHtJ283gxBKYc6IpXB89Sh_TnjahDij6wqlnrerW1wFvAqjThs26nP3gN1YMV-NvGw4R3mtGVAzb0eAJOcCx56x-J0pI0oYHqOtZ3Y0LSxI892ne2X0-_lWn-sKuGGH10bqFFVfiwXqeFo8mm9RcoDQqRGiQjhamxVv8kBtu45GQHQSJE3Sbbhlu6wUh4k5tnKSxfsqaV1ZGI25vSCHJglgg&sig=Cg0ArKJSzPgPoqgQ7zXkEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=104&cbvp=1&cstd=102&cisv=r20231207.57225&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame F256
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1627455/73523888/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/trav...
https://static.adsafeprotected.com/4.js?xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adContainerId=brand_safety_DVmFZbIB_KmO7A-L7ZnQCw&cbFunctionName=goog_wrapCb_DVmFZbIB_KmO7A-L7ZnQCw&true_pb=

1 KB
1 KB

95ms
47ms

Script
application/javascript

2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adContainerId=brand_safety_DVmFZbIB_KmO7A-L7ZnQCw&cbFunctionName=goog_wrapCb_DVmFZbIB_KmO7A-L7ZnQCw&true_pb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: vKEhI2DDF7x4y1d6KCleNAEq1uB6J8K1
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
date: Wed, 20 Dec 2023 19:39:30 GMT
x-amz-cf-pop: FRA56-C2
age: 136840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 13 Dec 2023 19:37:39 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: AUxl9IR4t6U3-q8Vi7914WFOzk-aU5p0pmson0jxnFgqSJOQEyv5yw==

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: nginx
x-server-name: app13.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?xsId=ABAjH0jUOjcb7QpH6-_mKM7EWtiB&ias_xappb=&adContainerId=brand_safety_DVmFZbIB_KmO7A-L7ZnQCw&cbFunctionName=goog_wrapCb_DVmFZbIB_KmO7A-L7ZnQCw&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 55D7 91 KB
23 KB 153ms
26ms Script
application/javascript 2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 7982951
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: wZH34d3FwuTH0WsMs91sFVW0W7Jwgi3w3akutp4yukmmdPIdYY8GRQ==

GET
H3 200 style.css
s0.2mdn.net/sadbundle/17864851622750576224/css/ Frame 3B4E 5 KB
2 KB 24ms
24ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d74871f1d66e7c0230449ab708d05f088e33d578275cfbc2e0d95529b689cfcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 15:47:00 GMT
date: Wed, 20 Dec 2023 15:47:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150681
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 3B4E 70 KB
25 KB 78ms
32ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1842800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25267
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-62b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nns3LO8w6wbEPfdXPmdWnIkGtdpvvIXQzumo04hGxIbV%2BomoSJI%2FRk01BpBsT5pPhlnjH%2BRbC7unn39JPBRMOV73do9RW2EtHsnEiUVsigKVlPWB9cMyOmhUQZme7YgD3Jp0ISYXW00qNAGS6sy8huIO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 839764339f799220-FRA
expires: Wed, 11 Dec 2024 09:38:21 GMT

GET
H2 200 CustomEase.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 3B4E 7 KB
4 KB 79ms
34ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/CustomEase.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2131109
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3299
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-ce3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pH85pJKMXSrS1%2ByKKPvcWJ3tisilvcyE1J1m80ETdpWhS7q3bwIO6AK96pyJS4DmV4nRkCJtafWoDpR7gOWwkmj%2FTApNFcCjrgit5TtNepscmb3FlDIDEAbXXhdMzfcOMSgod1ugZi60uw5KLwK4geBa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 839764339f7b9220-FRA
expires: Wed, 11 Dec 2024 09:38:21 GMT

GET
H3 200 dyson.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 2 KB
1 KB 26ms
26ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dyson.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 21 Dec 2024 08:29:30 GMT
date: Fri, 22 Dec 2023 08:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 rtbIcon.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 2 KB
801 B 25ms
25ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/rtbIcon.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 02:40:47 GMT
date: Tue, 19 Dec 2023 02:40:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 284254
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 771
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 dyson-v15s-submarine-stack.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 13 KB
4 KB 24ms
24ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dyson-v15s-submarine-stack.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12ff2ec39651e02b34ee26ae91b66614f3b981e5b8db58feb16115c2b6b201f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 09:12:58 GMT
date: Tue, 19 Dec 2023 09:12:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260723
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3980
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 1-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 31 KB
31 KB 24ms
24ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/1-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dee119ee49ab8771cf531190b1b186a092c709f799baf9ab566a3ca9778ea0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 19:23:06 GMT
date: Wed, 20 Dec 2023 19:23:06 GMT
x-content-type-options: nosniff
age: 137715
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31326
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 2-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 21 KB
21 KB 23ms
23ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/2-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d66ba6bc03128cc3ce96e393fc2b3f7c8bd2e73af8258ae6d6a5e6f2efb9848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 08:59:06 GMT
date: Tue, 19 Dec 2023 08:59:06 GMT
x-content-type-options: nosniff
age: 261555
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21613
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 3-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 25 KB
25 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/3-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de63bf5ecaf8695bae42a604e9808a63c55b0d62bdb3b4462c1530950772fc27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 08:56:48 GMT
date: Tue, 19 Dec 2023 08:56:48 GMT
x-content-type-options: nosniff
age: 261693
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25605
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 4-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 30 KB
30 KB 28ms
28ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/4-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

263403e6cea55abd488e73b1a3ed6fac18d6b3136572570953b3392504715123

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 05:10:36 GMT
date: Tue, 19 Dec 2023 05:10:36 GMT
x-content-type-options: nosniff
age: 275265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30924
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 arrow.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 192 B
191 B 26ms
26ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd99a285d81a12f549b741db9604416a669e2ee8accf00cd40c0b0344e9ba63f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 19:58:01 GMT
date: Mon, 18 Dec 2023 19:58:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308420
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 161
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/17864851622750576224/script/ Frame 3B4E 4 KB
974 B 25ms
24ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/script/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e24e46459c7d6e73401ab03d015d9819826b4d7e01d5dacb37c0264ebf8f069a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 20:28:32 GMT
date: Mon, 18 Dec 2023 20:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 306589
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 944
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F256 43 B
215 B 1274ms
1033ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=88457057-e4d8-9ffd-1318-194a20c3b365&tv=%7Bc:xwligH,pingTime:-3,time:57,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:26%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:57,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:26,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B52~0%5D,as:%5B52~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a1*.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1b1,idMap:1a1*,rmeas:1,rend:0,renddet:IMG.us,siq:26%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F256 43 B
216 B 1048ms
809ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=88457057-e4d8-9ffd-1318-194a20c3b365&tv=%7Bc:xwligI,pingTime:-6,time:58,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:58,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:26,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B52~0%5D,as:%5B52~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a1*.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1b1,idMap:1a1*,rmeas:1,rend:0,renddet:IMG.us,siq:26%7D&tpiLookup=ao:painthy.com*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1835641/76875435/ Frame 4C70 255 KB
77 KB 52ms
52ms Script
application/javascript 34.251.137.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1835641/76875435/skeleton.js?ias_dspID=3&ias_campId=1015029463&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20785736086&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gqGEW7Eahv3dmNqcfuOYuU
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATiWrtF_a7ShMjwWWWOeDNDinDhBk5ZxtIqer_PO3_DDCSXD-L1PPgcYiKxmCtljB02OY1PA3_-R_oj52bh36G0MQHKDEAkzPpmJBj6-hH_YzWuSGpwfSiRUOfXcdGTLoBBzk7Rk8Os_k16rgIT1l-LaZZllsdI8dXHIuscPOYCecntjI&dbm_d=AKAmf-CtA3VO6i4C8uq8ne06LGMeM0Xzaz24tQgroExbe-IvC7MzYtZqIDVVHvn4MwADM3QRsSAU9pLXul74wmu5tw89N_LfO8ZZPSkxD5igaUL5EbASGGSw78rvW3yDEgTkFwKkIvFoFh1O-5wvSbQFL2lkApvIcP4mJTVMkqwZ9umdBOUDwFNVp8Dslo6tu5Tx4_xFYaYC3DMjXuRf3lDyetU8R-h4-mYGif20YT32M8DPPtkp_EWixDYP5shwn6tMUNzk0ilBHWSKubpFKKtSBQHYONP07STIWjwrOxANb5J6F8Lq6nH9M9oDh75lHvOeZczQwUjJMJWcSe4fT0bsbL9xXniRdfHwxoNyYuZBcxNDcph8DTx3P7yYbrnzCGFndz2PKrXDt5Mgqka-a6OyQP4sMBkzOPsUsIqH34XZ_4wusX1BeqTc3Cp7_SYAD3ldsbBjCa947TPgGlmeArVP0wVcr7Aq1y_a-UtvAbDLZ-HV918NF25L6iti5QljlQih_X7Q2UBTXU_c_TOKEVB5NoUVXMJFETcTO8mYHrLBI4LyTbMSLPnCp6WGydTjo57p2KlCEq--ntHnm-8r5k3__bZKVUgRntdjaJJOqyAKqc8W7wOpe7EPWq969_CGLOPz-sSi7ep6McZujSy84Vy8T4tGWoJ-0a54gr8dneI09mofJl9E8DhIhE7EZIG0PjYPMjnu9iD6xk7nhNPLfCnB0pVk9lIk6J2k-lHER7fbhIQsLl6olXbc4aazux5OWYOiaxbP1U4ZnABJsykRIaj2PNuirqGF3u4fNNn_te-a803No0MKqNv9KbmwlsgfItrXHAUtmdsHMyNJVH8sPjMn0sEOZfdOhHU9Ps51kfbzxOBTwAVszUdHr28TJBPFntl9vvRNpZ0lRqVXhf8zH3He-2nV0VoKVnKXna6hxBjmbm6vhI7Vpp2EBNvciGe6Eh1GI6VQuTkdLDZnSMJqTwkrElofZiagjHlE9H5Xx9MGoHO-gCnB7o-85ZEYmwi-69FBBgzs5XSuAnncLk3xrj2t1SflcZrpq54uqQF6xN8euBzj9Pu2W06hJbV1J9WDQLaS39Kf6GUlnVdMSw22q92PP9FTbJk1bvK9UE4HkmJgIRE0zPcgoq7HcqwtpB0Z_Bv8RmfG0CsJb2Y5oGL_e5MjqgjON8fsv0J_N6Z80AVerZFaq2oHT1pr3o5I09QB4YsGI2NcThDOBXIPdADaCSAwyQ_AX-I9EgeBeekERXhIZABOFG2gqGPVBWcsbvMd8pJShQXKqH9JkG9Jig0CrIDZGdpouX_YprIEhRmPxtaQ7YBWawYuIlEgUdJBD6sVi8k1lhJu87G6Qdm3vZElVhNW_z_khBqOKZexIbFly2N9b_BRE21g4RlFbVGClUPu1njI7STYKJbdHyD4Kk5DLEYY61j1Ea3PcN4Llzg6Uf8sg-dcc_F6fl1rk0fLuBTGBZSQtuZkq6ODCWwJbQqwW7ODcKeXDbVW55LDDd73qLaUj35RQVaOlimxOO8Brqd1vkjiaA_RULJqENkjUAj-IBsgh6YyRIuQVD3Pfffa2DD0meAJsS5BXB1EuzXbIWka0WmDuWSqYvsjZV53byUkTR9ZCvQNTK2-A4YxHgFW7MmE9Ggcqq3fS6-7O49uiXYhH4TiAiLsDWLHf8mTQZhmsXw0zCXTRwQMHkvRrg498UJZkLVCxiw2G3vCvWdbNICOOqXJd0T8PqJch6sOjjkD7W48zR0Y1x12OLoIq5y_DyJqaWBpHeqhtLLcZjLpYp6bV67x15wRpNThMUxctGlb6LgFcIPiKwKS3MvCHFaerC-JUXtjX6OipuL83eIt-GsQhlOa8sk9K8ov6w5OiDq2WPgkaC-FrBC6Es7bbFWO9mXLlxKjEN-w5h_V78W6tZpvEjdXUqFSSYaFsi40seVGqvX0BOCTj5MuTQVDbUgoP4x5JhuuFi6RW_GvFNo_3Szc8WMxMmYcWndhiGGEkUvzEIMLUqAqi1Xf8FGs_J6gPsQz3WwgMu8PkxAus6OFDYDIHCLYNFX9cgVgIU1zBFSefyvq2zfRXoHnKfvLugwwWOb1uIHpq8SjCSHjamHfzea6NkNrHdMsUK4mug6Xvvaw0OEDGqZPC4fczwsMH8dn0wfdcz_gbRt33wiIamjv_c7CNknKugrrMfI3EL0TiiLEYYznQeeac4Ndwnx8RS9prL-z_X2RKkfvjZJvOqqsWpui57rWPhhmV8tpU3w-ESZ-386PVprwzaEzchPH8-wxuewLX3N8stQjPX9pteReALG8ND4tJ6BIkZGoT-JEnhYvOsJofJ9QxlVDlCuXW1ZcOg9YnU1Wy3ku8TdzGor70HpCnpx_Nub6JnHYC5tCSsNreK5BfyOjEKLEsyxlsHeCBs8qpNS2jM_xdLPzO0UWbLUtWl_XFrSjooMOe-1JGkEy-NTnHT3t9b1OSUc167vSUzFVgHdRZjcO61mFGFh7ob93XiBFPivHjEWCMDcjLdUwJs7T0llKHiiCSKHm5Y6qsxnT-MTTt1LR1Vfx_tL3r4AZz5bLae6WExPiMV3h3OkoeOsK0CaMU3smb29ZFuV2O7r3fefUS1If-Wth7Lwo7FFoOwW2Fl-OtQUolrMqtLaGY631pN01cvhfqhu5uGvwUiKEad9j-hzIoLFrV3KD1RmwN_badUvXgUz5MbhJE7wkEzXJi_A1Wauqrmz7E_UZtqsmuY3lmg5ALP4QURqF2RfrkF-R4pjy3LIavEdX3BsGC8rtO6JhgDWWWPUKflyBvLzBDDQfJxKZf61vateelN1P_fAQBb56qNEm7QhwA-QOvTBVukCrkbZ4bwRZ_yyvpF7OfiT7ei_EiRXuK28lb1l8YlqDCWKTDQ8piKho1wzaACO0BS5SHRIIKQ00Yw_mOJlUUxRs1XxE38blqD8ER7bU9mMuW3JFsEaWF7LUcsLzqW6G8nCatanHBRrFYiKJEVFjh41nOVl7TBE0EcllG4LI2s0LgzbmxPPYG4ffRWmRMgJhvyHj9aVqmEfLY_h6fZf7lJ-Tarq446gO_JBcKB7MaxKDI7pwOEU22MeD0ljnsNxrzMj7FDeZSkLdZS3TVRW0rhwNK9kPYxoJdai6Nv8gRQ_aDbJS1MWvwB3neZKjwlYRQbQAi6dT7Va6YjXJs6XKl4W3HhiAVwJcBDOqq-NnVkQQILOz89jQ79ACdSwZXmp-_yV2RVh6wDAYUDiGy-p3T5gsf94oTVzWO5i_mt9ML-iRgCXBpx0ClFOXPFcfDVJXxvxq5dMq6Aml6NE7M8JYL4wf1a8ltdV5lwDzoKuk1j8WiYZ0oLKWeKFeLW_674iQeCJSazs_U7yewrA8iuIGwy-coU8Sz5azXHzYeYRJ33lTA0bCdk5Gh_vAUdphstYXa02iPRPW5px-9sgoKOgPmUyZoW30jT3TvtBqdETPVkH52iomci83wpj2cDyO9R-KUTftjgTNPByBQ7DvyuDSYWrnyJrRfVU5PMuxqP9cMbyP7I-PFEh9kcHe895J5sxmKnYA8javbQQ0w-i_FTRxq5TCiEaUgAgz5gvB4rSWhziixgqZyD24cNFBmGB9XDmjpfc1Qn5e1Y92jVpdfluc36QgvwDZL-Dtw4M6BIMTzIrsh2Qk7Ntl&cid=CAQSTwAvHhf_o_bigzSXalo6xbGc2pfsSiUZntfirPK3RtahqL1EXg2RZly2MaNu64mlVm2l3Np7XEQFv4chl4gWH-jmjQQqQKzemMzmZzBOkJIYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=14279165556893465000&adk=1726166463&idt=212&cac=0&dtd=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.137.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-137-37.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 79caa1e63e147570f8cf571ceced748d8273b3cdfc6ea191f98f751c4778b42c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 4C70 31 KB
12 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATiWrtF_a7ShMjwWWWOeDNDinDhBk5ZxtIqer_PO3_DDCSXD-L1PPgcYiKxmCtljB02OY1PA3_-R_oj52bh36G0MQHKDEAkzPpmJBj6-hH_YzWuSGpwfSiRUOfXcdGTLoBBzk7Rk8Os_k16rgIT1l-LaZZllsdI8dXHIuscPOYCecntjI&dbm_d=AKAmf-CtA3VO6i4C8uq8ne06LGMeM0Xzaz24tQgroExbe-IvC7MzYtZqIDVVHvn4MwADM3QRsSAU9pLXul74wmu5tw89N_LfO8ZZPSkxD5igaUL5EbASGGSw78rvW3yDEgTkFwKkIvFoFh1O-5wvSbQFL2lkApvIcP4mJTVMkqwZ9umdBOUDwFNVp8Dslo6tu5Tx4_xFYaYC3DMjXuRf3lDyetU8R-h4-mYGif20YT32M8DPPtkp_EWixDYP5shwn6tMUNzk0ilBHWSKubpFKKtSBQHYONP07STIWjwrOxANb5J6F8Lq6nH9M9oDh75lHvOeZczQwUjJMJWcSe4fT0bsbL9xXniRdfHwxoNyYuZBcxNDcph8DTx3P7yYbrnzCGFndz2PKrXDt5Mgqka-a6OyQP4sMBkzOPsUsIqH34XZ_4wusX1BeqTc3Cp7_SYAD3ldsbBjCa947TPgGlmeArVP0wVcr7Aq1y_a-UtvAbDLZ-HV918NF25L6iti5QljlQih_X7Q2UBTXU_c_TOKEVB5NoUVXMJFETcTO8mYHrLBI4LyTbMSLPnCp6WGydTjo57p2KlCEq--ntHnm-8r5k3__bZKVUgRntdjaJJOqyAKqc8W7wOpe7EPWq969_CGLOPz-sSi7ep6McZujSy84Vy8T4tGWoJ-0a54gr8dneI09mofJl9E8DhIhE7EZIG0PjYPMjnu9iD6xk7nhNPLfCnB0pVk9lIk6J2k-lHER7fbhIQsLl6olXbc4aazux5OWYOiaxbP1U4ZnABJsykRIaj2PNuirqGF3u4fNNn_te-a803No0MKqNv9KbmwlsgfItrXHAUtmdsHMyNJVH8sPjMn0sEOZfdOhHU9Ps51kfbzxOBTwAVszUdHr28TJBPFntl9vvRNpZ0lRqVXhf8zH3He-2nV0VoKVnKXna6hxBjmbm6vhI7Vpp2EBNvciGe6Eh1GI6VQuTkdLDZnSMJqTwkrElofZiagjHlE9H5Xx9MGoHO-gCnB7o-85ZEYmwi-69FBBgzs5XSuAnncLk3xrj2t1SflcZrpq54uqQF6xN8euBzj9Pu2W06hJbV1J9WDQLaS39Kf6GUlnVdMSw22q92PP9FTbJk1bvK9UE4HkmJgIRE0zPcgoq7HcqwtpB0Z_Bv8RmfG0CsJb2Y5oGL_e5MjqgjON8fsv0J_N6Z80AVerZFaq2oHT1pr3o5I09QB4YsGI2NcThDOBXIPdADaCSAwyQ_AX-I9EgeBeekERXhIZABOFG2gqGPVBWcsbvMd8pJShQXKqH9JkG9Jig0CrIDZGdpouX_YprIEhRmPxtaQ7YBWawYuIlEgUdJBD6sVi8k1lhJu87G6Qdm3vZElVhNW_z_khBqOKZexIbFly2N9b_BRE21g4RlFbVGClUPu1njI7STYKJbdHyD4Kk5DLEYY61j1Ea3PcN4Llzg6Uf8sg-dcc_F6fl1rk0fLuBTGBZSQtuZkq6ODCWwJbQqwW7ODcKeXDbVW55LDDd73qLaUj35RQVaOlimxOO8Brqd1vkjiaA_RULJqENkjUAj-IBsgh6YyRIuQVD3Pfffa2DD0meAJsS5BXB1EuzXbIWka0WmDuWSqYvsjZV53byUkTR9ZCvQNTK2-A4YxHgFW7MmE9Ggcqq3fS6-7O49uiXYhH4TiAiLsDWLHf8mTQZhmsXw0zCXTRwQMHkvRrg498UJZkLVCxiw2G3vCvWdbNICOOqXJd0T8PqJch6sOjjkD7W48zR0Y1x12OLoIq5y_DyJqaWBpHeqhtLLcZjLpYp6bV67x15wRpNThMUxctGlb6LgFcIPiKwKS3MvCHFaerC-JUXtjX6OipuL83eIt-GsQhlOa8sk9K8ov6w5OiDq2WPgkaC-FrBC6Es7bbFWO9mXLlxKjEN-w5h_V78W6tZpvEjdXUqFSSYaFsi40seVGqvX0BOCTj5MuTQVDbUgoP4x5JhuuFi6RW_GvFNo_3Szc8WMxMmYcWndhiGGEkUvzEIMLUqAqi1Xf8FGs_J6gPsQz3WwgMu8PkxAus6OFDYDIHCLYNFX9cgVgIU1zBFSefyvq2zfRXoHnKfvLugwwWOb1uIHpq8SjCSHjamHfzea6NkNrHdMsUK4mug6Xvvaw0OEDGqZPC4fczwsMH8dn0wfdcz_gbRt33wiIamjv_c7CNknKugrrMfI3EL0TiiLEYYznQeeac4Ndwnx8RS9prL-z_X2RKkfvjZJvOqqsWpui57rWPhhmV8tpU3w-ESZ-386PVprwzaEzchPH8-wxuewLX3N8stQjPX9pteReALG8ND4tJ6BIkZGoT-JEnhYvOsJofJ9QxlVDlCuXW1ZcOg9YnU1Wy3ku8TdzGor70HpCnpx_Nub6JnHYC5tCSsNreK5BfyOjEKLEsyxlsHeCBs8qpNS2jM_xdLPzO0UWbLUtWl_XFrSjooMOe-1JGkEy-NTnHT3t9b1OSUc167vSUzFVgHdRZjcO61mFGFh7ob93XiBFPivHjEWCMDcjLdUwJs7T0llKHiiCSKHm5Y6qsxnT-MTTt1LR1Vfx_tL3r4AZz5bLae6WExPiMV3h3OkoeOsK0CaMU3smb29ZFuV2O7r3fefUS1If-Wth7Lwo7FFoOwW2Fl-OtQUolrMqtLaGY631pN01cvhfqhu5uGvwUiKEad9j-hzIoLFrV3KD1RmwN_badUvXgUz5MbhJE7wkEzXJi_A1Wauqrmz7E_UZtqsmuY3lmg5ALP4QURqF2RfrkF-R4pjy3LIavEdX3BsGC8rtO6JhgDWWWPUKflyBvLzBDDQfJxKZf61vateelN1P_fAQBb56qNEm7QhwA-QOvTBVukCrkbZ4bwRZ_yyvpF7OfiT7ei_EiRXuK28lb1l8YlqDCWKTDQ8piKho1wzaACO0BS5SHRIIKQ00Yw_mOJlUUxRs1XxE38blqD8ER7bU9mMuW3JFsEaWF7LUcsLzqW6G8nCatanHBRrFYiKJEVFjh41nOVl7TBE0EcllG4LI2s0LgzbmxPPYG4ffRWmRMgJhvyHj9aVqmEfLY_h6fZf7lJ-Tarq446gO_JBcKB7MaxKDI7pwOEU22MeD0ljnsNxrzMj7FDeZSkLdZS3TVRW0rhwNK9kPYxoJdai6Nv8gRQ_aDbJS1MWvwB3neZKjwlYRQbQAi6dT7Va6YjXJs6XKl4W3HhiAVwJcBDOqq-NnVkQQILOz89jQ79ACdSwZXmp-_yV2RVh6wDAYUDiGy-p3T5gsf94oTVzWO5i_mt9ML-iRgCXBpx0ClFOXPFcfDVJXxvxq5dMq6Aml6NE7M8JYL4wf1a8ltdV5lwDzoKuk1j8WiYZ0oLKWeKFeLW_674iQeCJSazs_U7yewrA8iuIGwy-coU8Sz5azXHzYeYRJ33lTA0bCdk5Gh_vAUdphstYXa02iPRPW5px-9sgoKOgPmUyZoW30jT3TvtBqdETPVkH52iomci83wpj2cDyO9R-KUTftjgTNPByBQ7DvyuDSYWrnyJrRfVU5PMuxqP9cMbyP7I-PFEh9kcHe895J5sxmKnYA8javbQQ0w-i_FTRxq5TCiEaUgAgz5gvB4rSWhziixgqZyD24cNFBmGB9XDmjpfc1Qn5e1Y92jVpdfluc36QgvwDZL-Dtw4M6BIMTzIrsh2Qk7Ntl&cid=CAQSTwAvHhf_o_bigzSXalo6xbGc2pfsSiUZntfirPK3RtahqL1EXg2RZly2MaNu64mlVm2l3Np7XEQFv4chl4gWH-jmjQQqQKzemMzmZzBOkJIYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=14279165556893465000&adk=1726166463&idt=212&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:42:27 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 4C70 11 KB
4 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:57:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:57:58 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4C70 0
0 70ms
69ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuS_cDXpnurtF_u5gLQrKeyjO3qu5fPEHzsFUI3mEWGu0k-COn-AXm4WfyuqJOSqt-AoiPfzTigbmOCbAp-2j7Jy3FwqvRO0nAeI_Gxt8zudjh0IyfTSeX4DhVjQq06SjUv5muPmy4IUC9plxHdm-PnOGf8tx16ozwt2Tc0ELcyChigsf8cobBE-mehNoEBUP5mLCizklBrwwvwXUbndwD_BHeJ0eHNBHNgVqG32yoH4ZPjpR0ZZ789wvhssFsuZ6QcJAdIKinIwYpxmncLIpFpc9NzSnuhW2HSkmzmtByTRnj7qgfH_f3jYEcUwdTXFjCZNWpG1OTVWdObO9b00NimmrDqnlAiqs3TXIbL_V1uq6y3a5afLQ8MVwEPh2BJzeqzoaAFx4vBwfUKtPtQpXmzZJDrL4cNnqkFOXVSdHHY4ys9s69B_OgHl_5FAgWyi2aZPCZbhoQvJTA-Hi0LgoA2Y5bGcFzV3_EO40YSBgBwHNUS3IfRnShcX2BrpAwsvmrhfST3ffU8G6TY-2u4ZJSj16_9RZv4rd8f02Ljj5COCWZN8JIB5JLAnrOIQ60oj0pfwBRfA78OA6QziT2hOi7toxO3dn4TF_1sKMNVvzlnTLDf65Ge6AbJ1v7mGDD6f5-N22YPaos_K4JhBnt4fJg3OMZTnmWxB3dk7ytS5s0Y1RNCt1TeNhyVICI9G3r2jGHOSoWtufIb8MLpibYoCRqNMTCik8B01Vrjz8-1CVihUIYMJ7EHfiv-Db22qmdOqtPuklHLmr56OFnJuNWxS6NKps_Y51DOAG1MHy7mXOn9QuDabUWlsI2wsmAl8Sj2dD1cwlUziJlEpIUf9wcupPMV1g9fO2n0dRC8M4DltYA8D3wclbv-p_svKzByyc44a79wFVnJ_8aEEOCcwY4FhL8Q635fTXTeQEA-J8CxI_YPBt-JZMp_ZKj5IglqR9xJGmdluspbsBS6XSH_238esWvxQK1GlzwFJK0Di06JA_by3tE2FdvWwjXuP3j-kNR9w6_7RkDsNwZ8qJZAnKB40N6IJ0ZRdFAoCtynoaUEFKv1-ieDYnTCZ_AfEZG2ChoXB2fdl3x0SjtermxyG1XBFHvRxwVRvfIe6uIGQpLa4OlgTapMaJxmEutQ1_7Sm-JFWMQhFWZ387MKeXUUjdNy78riPZdhP8qaW8hZVpJHPALNkxzcR__FcI5NWBbWix_VqcT6Y0qsn6WHWagPcIr8hQIfZXn7VZvWptd4MXva0SqnmxPU75FL6XIwiyRYfJYibXEk_-wNkV-MWHVOTMUKBaEUsG33MALg5wiEEpI_a7mMEKsGE_VM6zH71OuYZS7SgcXqiuKgFtgz&sai=AMfl-YRd4omaUXnopoUoDztPEgzrZyAlR1-vjRxe3JWzHErapwdrt7P9aqHr9rttzEi1Noh9ZaaU-NIQEE9UDgV6IMD-JbEkv-staDJUAM3_ptNCl4K40fF03jf5DTGfZM-vN_21zue-KNPHLBa_0UKdR65C2YfJJYzCspqlFG4pM6vDhMMxo85Ol274w8n0PE8Q3Ai2TYaFDcaseMwV7esQnrQjAomfnivNOPGDcOp5DFr56LLL-4b5L4KYOJmfHPTw6HCLlPnArVxTTwv7P5PvFGahnoSEPHNxf9e2VnaK2g&sig=Cg0ArKJSzI7bUrk_6FCOEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20231207.29385&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4C70 41 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 574393
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

GET
H3 200 18284960230220959889
s0.2mdn.net/simgad/ Frame 4C70 25 KB
25 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/18284960230220959889

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba35c06ed24c29d7b8057ec377228f0804fa8d0ff7256149975f02a483cfb4e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 17:04:29 GMT
date: Tue, 19 Dec 2023 17:04:29 GMT
x-content-type-options: nosniff
age: 232432
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25785
x-xss-protection: 0
last-modified: Fri, 01 Dec 2023 22:20:25 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
DATA 200
OK truncated
/ Frame 4C70 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba0a31207b277dc3f8c06928bec5a1f85f278a1b5f3efef1bb5a3f5e109e1858

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1627455/73523888/ Frame DE38 255 KB
77 KB 53ms
51ms Script
application/javascript 34.251.137.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1627455/73523888/skeleton.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0g5PUQQnxzHeKemaCGTwI0_
Requested by: Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.137.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-137-37.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f1c5ba798692f9d05754b789f60f8cbd27bbbaee87f4a0469f2f668ede1c5732

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DE38 111 KB
39 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 22 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame DE38 11 KB
4 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C7ZQMhkb8yaiu0bJ-lmrL-DP3UOygGYcjIEUCV5hYU1IeY8IC9AfwQyma3GlTMljeduT9ltdpbGuTLpq8LGjgA87gBDROjzsc0OGYFLp6obZ4SeJoo9L8_Pq3uPxHKHKzA1hDYJyuhcSQ0V0wXxitj-RqnQYvyGlehSmnd6bQ3f5c1gak&dbm_d=AKAmf-CyA1wmIaKYXQWTFok776H9XsTFGPP5taHJFHGvBxjc3SWqe1OR9TJMvMydHD3iKEkddAcR-eZY0aIhIoy6vnJvmeRPxdimQFaQ5Ap3cCKyWmmdgP32IbmkYSo8j3aVHQ6ggdxULm1Ghn_FUBkRXE2hB87dSA92Gk6cNggFYZ1QLQgfJeTqQmHMo1r-Kvj36BOBL-t3dG01AfziEwLtxjbSdFMt9Jp4ua6z6By5fLzF4pNvem_-a3tIbuCqEXvyXMnEOpzYc47VcLQrKOIvvttF4mEIlNYeDoI9xjI8uMJL75qugQKgiB09YCZZzD0siMLvpZ-TKObQFjQ6Akyb5zQCjDLfOO-zC_x3BqxSUt2YeWpfBj--MLEC-4xPRFeyMkNcYVi-Npgz0-STybVtE0POU68ApDVH47vSFiWg1Xht5Otlsk1X47SAneTY16J_sCYu99dM9EJYERCnsqf7_kGAuQU_Sz6BBQTCraauidXF5vnSbJ94kAmsg8Z42pAC1Wpk5AzP3r-grJH8Exizj8llCNeO8NNL9frBncU2ShvCflSqzO4FqLYGLrM_1U5W7OJ1B9QpD2pogDtLfcw-nHznvLeo7dvgH3zyHDtkQK7DU0zm4knp9TMycZynqvcAU9oC7X8xQh-m2K3FNExvqphgunzvbnYb9UPm7aont_wVO5UF-WlAR5UXhji3jabkvzkXdRQE6BoRbfEUAzXYiOUQGIsStsGeM-fnLMJTtx_StGji61OvVEondcjcHsOykE4s5Mu9CVlIyLCy0T9x-eyvhuX_QM5rVqg6DY_CVgiuS5C6VuXZjeVavSGAXIbjxR-u8fKe49t5u0PPA1gFDJKAiI52DibYICwWssXnZPWiYjsbuHEr7CGmb-iaHIqErrvh7L_ZJ_fbjKdckCSgGsIXF8vayOZUxoSFWB-vPl1CgNOiOxpI_pUoKKipRhXd3ngHtb8KIgqx1UpCKErdDUMFZfm9BZRxQBJEh5svoB1Lwtya6mLbGvggROcCbEFEG2jA7vs1p_qwrnddgdhbJNCCGRchHOWyfAVlpFGD_SzyCjeZeiaVghBEO7RI4AkubbkkL0qbpQLojznPe7zgKqev8Jx9T43PpPt8sPLNgQtYmib94qZnuKtW_fGRIbun85FayStmyvtuFQ6MJb3EHiz8XiWD1y1NwOBcSzZftmLq_hvraz6lQSmJ7EQyvSQ6aa5pzzsCs8VVOo1Bob6HoC6ogDXyv0aG0KQtPKtDdWSG15XuQtSDJb48UgjQFw0nx1k-kGniqmOeeOfeHhzwhAzqcqzHV3cyMAIAeM2q_WJjF2dOvMa_ihravmSY0xma-nyFzQn67LxA16A6z7ytqpAL8GGTBjEA8OShAv_2eoLSzJ3NMwBH_ZfgPzia1HY0CEVIx0oz7qPzmMZPRtWwAfhMc5ZIPdN9VPlE5CbnkLq5NDV0fnHqstjdmNNPKBvFKLAm9b2pGdxJXPiKSFtQjPJVYZappFrHIa-f0p9fZqZZwk3zucG3_vu1svk99sVROzYvHsozL9Yd-44eZJbP_ctBV8ZzPBlLAtEs2FMIWv6egBdYpRrEz9v2MEEzhZhehmFmPTSVNjApdqswTphOmDKejcjpgkxQocImcYw6lMoMQJdKCFsd6KoILU1Uo9c4kDw6k5Q4WrnDwO33EtuNQ87igfnVanPf1HIeE8whOGEmMJ4OQZYGcYE4ZpZl0FU2gn7-DpXhrX1thJB2pkHQHB_WW5XpBh0j2AcL1tXlN7m8A5Q57OHW7M4j0FdrRNDs7O3pTD8kY9I13OdukxHG8jTzco3zyhpGESS2SDzH9vlTBL6g9l50GNwYYeIWWGXNfoRp6BZTLHlVYse8fkeh6BXVteTLJALZp7xDgHpdyvwjQ5DfDMFG5Oc99r2UbPMChhkvhVMesTYVX7NOn5vDngvZT4iunatsGSGoEDU7SR3zYe34Kay3hDu4vkilrRtRYBo9FA9NndzbPP3PcchKnQSDSDv4d4zA6U_BvjutWv0TcxQKltSie7Fsof-DJiUfdXkvaX4d7ldSRuB39vIOTHIAjmZt4PYg9S1jjC4gELW5Ud7SzcMaw2vS9DESH0f5yGQMuwWEM5QA8WSZ8YSmW0EuQ4wH99A74o4BOIXTm21WIrN9fauWKWJzdkGDRBlxJ7RPCa1v1TuIF7Odq2niP33-HH6D1uxTd4KxA6JWnUrkqIPgfUYVgtIW0sYzYeRxfLzO_W6slkA55XPfCHaiSpoe6OLIJjiuEUdn0zvTxUw-2dMWLdXTX2fvmAO_tn8Fc22BK8pWI6Ewa_gK29h1hs-MQXISnAsfIFKaNOVZoZkG06qiz1EZso4fTq3PUoOAghUrPC257QDjeZpm-lJWp5lCC0WOslQKgQTPpQ-IZ-QUEK-t8NJvSl1jfcy2s7TejhVNQndkpVNw_BCpmKlE5cJP7ECV5xMdjK4toMWhUKBhAkTh9jG3g_Kn4Mt8kDCjzEDiQZdgoYPdfgc9Mp7KAye0tVxCcffx2Qqbd683a_x_0rXFwCaFaIqhrCUtFPfCmKwDl0GJoeKD5OdbeC_so36FykSxkCgdEXVKzXEZVb5U86lhcxZEQ7FyrIalqTff0SUkNM-A8gXcBvTJOtFUVyBdcOniN0ys_TuT59R5yf7llRZq8UOFL3x6dpFH3n490_Wp1RL-BqPnFvY-djW_9Sjv7XrKD9xJNzxtkLJWb_SCgBeNbqu3nNhGVMsRKwgDVntNK6ZzIgBEQMU8Vdb0vewvWGck2tNe_hHDQkGCfDAFhCi1zJPkjrP1dToFzjhDyn47UI0RYcZxXUM0m82zBSyUn9_k7LduuwwXWfxZpX1ZzwX1_A3Gs6sfpxi_ic__zJ-6oYji9jSxukZp4qaJJ6LjHOtc8GW7aVBvFtk-_CtZGjpSJWR4yJ8V4coFlJuLNC4cCgcBh8OtBCR4OT5g3oXhVvaIyC6kgQ5ibS2wNar145gVVYeToWxEr3ljpFIYQ5FmIWdCt67PDYLWWekhdz027mHrxpD8gSUAGzNz_VbvwySl3UWGc8VQzT-2g9MzQTxq2lsPV0JzC5qr3A6Yp1UxpatmAnOoWrnVNW6iA9n4-NxNyzzuai8sFBs86o-i5QR4BL9tTYbbPaR7Tt6gbew0imZLQKeBa54f5UWHRfi0vxRBeeY7iULYbaayPtezWziicX0I02iFDnHpU3ONvcAuLvR2n2aS_pHN_lqPmQugrQOlmOE7J6vKKO6HX-FvzzAOLtQ4rIdmAbeqJMSjI6ue2RtpS4TGk3b4C_UFb0Mix_9Qm2pygWK3_Sak7GydhXdml_B-O_bPSR4yDrd2_0jNsoiswXWv2EiqDb9ht_XVJOT7ZabshiXEzAc0E1KaXCk5h3QF_P77JQs63iyun4_heMY5TW_73CfMyv-qAVs64CxPcDocjfL0FogsUqSD0IgOUH7VTXm9ucS8xzLweuwsbFpk2_87O4Qi5hBsG21tMDilVO0yKMGCapKAQE0KjW8OMzIymqyPcDS-eVwbiGZ1pLQTDOCe-wVZRsStASrRcoxgnmalMEwsVFKGvZF1wXpMzC5ERGDA8-_8F-ChXKdD5Ftih9Dnv8nafFJJGtW0oNG6GrXLGksVUvsrwh1QzP3FmBxD-2Hy5PqDLPxvOULx4RdkxQqt2EEkM0HJNtX1ljKRd5Y&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=18019719485378800000&adk=929882888&idt=287&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:57:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:57:58 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame DE38 31 KB
12 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DE38 41 KB
14 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 574393
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F256 43 B
215 B 1334ms
1144ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=88457057-e4d8-9ffd-1318-194a20c3b365&tv=%7Bc:xwlihv,pingTime:-2,time:107,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:463,beZ:464,mfA:466,cmA:467,inA:467,inZ:470,prA:470,prZ:484,si:489,poA:489,poZ:503,cmZ:503,mfZ:503,loA:520,loZ:522,ltA:569,ltZ:569%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:26%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:107,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:26,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B101~0%5D,as:%5B101~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a1*.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1b1,idMap:1a1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:26,sinceFw:80,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4C70 0
0 60ms
60ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuS_cDXpnurtF_u5gLQrKeyjO3qu5fPEHzsFUI3mEWGu0k-COn-AXm4WfyuqJOSqt-AoiPfzTigbmOCbAp-2j7Jy3FwqvRO0nAeI_Gxt8zudjh0IyfTSeX4DhVjQq06SjUv5muPmy4IUC9plxHdm-PnOGf8tx16ozwt2Tc0ELcyChigsf8cobBE-mehNoEBUP5mLCizklBrwwvwXUbndwD_BHeJ0eHNBHNgVqG32yoH4ZPjpR0ZZ789wvhssFsuZ6QcJAdIKinIwYpxmncLIpFpc9NzSnuhW2HSkmzmtByTRnj7qgfH_f3jYEcUwdTXFjCZNWpG1OTVWdObO9b00NimmrDqnlAiqs3TXIbL_V1uq6y3a5afLQ8MVwEPh2BJzeqzoaAFx4vBwfUKtPtQpXmzZJDrL4cNnqkFOXVSdHHY4ys9s69B_OgHl_5FAgWyi2aZPCZbhoQvJTA-Hi0LgoA2Y5bGcFzV3_EO40YSBgBwHNUS3IfRnShcX2BrpAwsvmrhfST3ffU8G6TY-2u4ZJSj16_9RZv4rd8f02Ljj5COCWZN8JIB5JLAnrOIQ60oj0pfwBRfA78OA6QziT2hOi7toxO3dn4TF_1sKMNVvzlnTLDf65Ge6AbJ1v7mGDD6f5-N22YPaos_K4JhBnt4fJg3OMZTnmWxB3dk7ytS5s0Y1RNCt1TeNhyVICI9G3r2jGHOSoWtufIb8MLpibYoCRqNMTCik8B01Vrjz8-1CVihUIYMJ7EHfiv-Db22qmdOqtPuklHLmr56OFnJuNWxS6NKps_Y51DOAG1MHy7mXOn9QuDabUWlsI2wsmAl8Sj2dD1cwlUziJlEpIUf9wcupPMV1g9fO2n0dRC8M4DltYA8D3wclbv-p_svKzByyc44a79wFVnJ_8aEEOCcwY4FhL8Q635fTXTeQEA-J8CxI_YPBt-JZMp_ZKj5IglqR9xJGmdluspbsBS6XSH_238esWvxQK1GlzwFJK0Di06JA_by3tE2FdvWwjXuP3j-kNR9w6_7RkDsNwZ8qJZAnKB40N6IJ0ZRdFAoCtynoaUEFKv1-ieDYnTCZ_AfEZG2ChoXB2fdl3x0SjtermxyG1XBFHvRxwVRvfIe6uIGQpLa4OlgTapMaJxmEutQ1_7Sm-JFWMQhFWZ387MKeXUUjdNy78riPZdhP8qaW8hZVpJHPALNkxzcR__FcI5NWBbWix_VqcT6Y0qsn6WHWagPcIr8hQIfZXn7VZvWptd4MXva0SqnmxPU75FL6XIwiyRYfJYibXEk_-wNkV-MWHVOTMUKBaEUsG33MALg5wiEEpI_a7mMEKsGE_VM6zH71OuYZS7SgcXqiuKgFtgz&sai=AMfl-YRd4omaUXnopoUoDztPEgzrZyAlR1-vjRxe3JWzHErapwdrt7P9aqHr9rttzEi1Noh9ZaaU-NIQEE9UDgV6IMD-JbEkv-staDJUAM3_ptNCl4K40fF03jf5DTGfZM-vN_21zue-KNPHLBa_0UKdR65C2YfJJYzCspqlFG4pM6vDhMMxo85Ol274w8n0PE8Q3Ai2TYaFDcaseMwV7esQnrQjAomfnivNOPGDcOp5DFr56LLL-4b5L4KYOJmfHPTw6HCLlPnArVxTTwv7P5PvFGahnoSEPHNxf9e2VnaK2g&sig=Cg0ArKJSzI7bUrk_6FCOEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=54&vt=11&dtpt=53&dett=2&cstd=0&cisv=r20231207.29385&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 8DC1 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 13:10:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73660
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 13:10:41 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 3482 41 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BASi9PcbeFG_oOp2Y0I3bBeQJGkQFk81rOf1yhfpNPHRktG2z5xEasbPUaeyuGu5C_ap3q1Xml4aEejcnyM0rg0Ep7UzbAOpILni3aOUGlUVRTd9p5lb9rP4qQdS6xuzIKP-RPSwZPDWNyf7ShQ73QHTVt-ZtYT70r9yLPL-txyWlZaUs&cry=1&dbm_d=AKAmf-CMr7viB-3pqI2ZmrxK79dAI45uojR_5NSjvY_EzEfbIgZZ_G6nsj5BL2SZKUIlR4eldK1jkTjP6_DPtqz4D96iEMvwmpgIvPxu3bK4hoOesMovnhdWhPwumOYh2dEM1Gb2GUethXJXy_CDpAvXZaaw7gWnPxcNeTzpiYKtXOfqyeSNoq9r89-BoAXr5qVJ951oetPX3jr4s6MKV4TOVZozpLBDfR8_XlQu8bQNQD6s4gHb2pLmMcUpmnv8gxB5QBH0itCw9vMzFPNGRJ8zMxHiKTNmRZP6eItR3lVYqG98F7FSg1uditZuescwKJJzEL5e1b4C-FjBSnm9cJPArm6H1T9iJqPHmQfxGqOBws7skqTobfeNaQS_o_7HFpVNDJ8EUHsoNd0wUhGgnHwOoR2TqtgyY9WN7y18__o2CYAtAaEAMxm1uWedW6CWZCBknzpCUABFPgE7-xDCdVrrhRV9Vdm2TZMOrRlHwlBLa-E6e-pPN__3jxU5jicoyf1FwchVHVvmtwLCQp3F_JhilvIo1thGqB21p40pCaRSi3uS51wGAkX58Q2BIWY1uR2lUgrzTpx0HANWjQZnWviPiQtKulfKmW7tJVdL8M7TboUdjMSrDRnscQiWVEgMPE4lwx4ARSMq4U5AZalvliV218MONuwkrz3XRvdSZTDoq3HRkp6X2DqeD0n9tRyXosMMGPGNwT9zKQXNMerd_E_aEGOIJRqLUcNp6IDYExJsOa4qRCh2Q7rkSYET2_H74Y340w44E47lkisGZiE9JjqUCgnKuSzmXl8AHt5cgzivNG1Xg9MwLGtehCTpJOQ0G0mjLJY7oqoxZoi-KUDQ22Zg4g_AaG3H9yKtmOxp5uGyJbJ-vnboVORP-ULdyxrcQocIsPwrQxf-FKsDV69MD_CnilQYyjhFpL_YITVW5yNmkz6QMvcCt1ftjGT2Lcx1hNL-QVf5ZG5aG0UQ1veppqaPDod94wWQ91elxgVU10CQ_Hio1QUr2s7YrlMMPGZeeSNlTFrR_pqdAx47cew758ZdlLdx_mymSr_HS-jlzyTpDOjMjeBl0TcQWkkOGSYzCRnygGonAH8cGlqmxtEA_i7YIuzMuRL8aPZpyLfKLFpMuq0kltj4GpNBh5zq9pzIXy-XLP41p4TfAiE0NigcryU_eROXCRD41XGJndflxhuSI7_BmAZ1XogvjNPpJIGTiJwHjXrIOcCvTBxLEnyJLOZNa_l60Ow2KXaXxbkA_psHIc8Yw6UB9xgJXF78QX92EwbewwOenZBZPHDVYaHBAqwfh0MR4VrG2N3GHqi-kMtRczjB1bKnqBJoogTCOIEziYkcNAkcgltICFMdeUznLQVFRvJFdMayOeFXJkWitvumpMC9aTjxt2kvAHwFusX_3BApNq1PGO4T_9xAAquRm9zV55B6Ksql8_Vqm0xIdSzj7wdAzB46JtAqKa-PUp3MoBEqfMbcDrjbxR8KNwwpeL5mSsVLqk-1zSL7ezD17xxt0_PE94YLu2CuqOgr5eASL2aXoxKQONJH-SAprU0qZrQAG4NdNHHKNqIF6GkfsfqI_HMEPSGscUpQrQumkPV-8BHN1bltvhPHxed0ADbu4bPe6AY7R1tiCyArtCmHyGkBZr734bPipth5LVxb-tgqqMPixNU5840yftb27V8jtBJa8eHyqOnNPWGTCdwtUp1aLcGQIzVx3Xk4ByfVRc27NxhAz3R3M-Qn3sP8LHRGW3OzOlzSVy_kNXvdd1Nnhx27ziXStfJii1gfOlC64nSOtrQck9w6PQrysWzjr0qS0z1hWAcGJmGcOIW0Xgki89M2P02pCbIESuOOtJfWpb_BpNbknQNUi3tfURavYd61moiMn3zuPfPBcS6CVEKNWjM_089_M0CVN2pf5Lkskwz3etXozGGOtYbI-yrhBt9WtWE--XyK7_JlbjWjJiblBwOquhSsm1ijcta_3SnLh_TyAdB1snKMU80rbivOj3DzHn8bPB9bEYH68kK6yxSULLuMi_eitj064euzIqXha_XMyaXpsv1fMDEtYYxud_h0a-5ySUUXdZ5VF3U1r9uprPevYMIh_QjjyGvvS5vRWQsAhhFTnL4RO0f1mBY7nE4Tv0FXpK1nkQuUi5KnoqjcLtKXA4riYNxfXtVKYhdByN8EeSlqxaVrnOWfDg6yr-YZCrovAa74cw6f7AmElcHADRg5vMYQxN_nxeGcEVUmZnmQ7zT56PKf_kH-sTP7RVQ5Wt5AjdZxFPmqsRmLPIoq05b-E57THTVih7LzRE4S2VnQHayD0bKvvOTtJaOsvrSTtnY6kLbBkVBIlqSkF-veAhpUYRFPG4kVpik2SLMAAEhCwLLgVQXpMZmcHHZp-nkOli1DEJ60Cmpu41nyAatnPytS0RnfCimsDAM83NDVRdVn7LlcLBn2zn2syBiDZ_pw_57_qDcyWV0-mwObeSKDrUVlhlIMLALu1pAGxrqKKRZEB6n7ToLCB-e7LshtQnLwLVS4U2f6g5CO3maLBg_W-UVu7n2-6xJWUB1zQQVR4T0wwNe9cdXgLgVO3j5zq3Wwhy1JAT_YLg7wHYn0ZeQUMQykWVpoldb8EIlJPpOnc8Q0GBoV4pXVMqb6y2cq68Iw9bL4sQ15cSKMqkujDwvE00gNPaMAxG3-bCXlNw2wR5vS7FhHuP4uOy0PFZntCwBT5lp1B1fSGvAmMikeXbB4CrFqqtdekSjMQrbwt_FXEXFlhIRBahAhgXFMOCxDWApZoh81yQJ6KjCtkFB7w7vJ8_lVBs0yxWYwYokI9aSr6l2eQ_tsd4FO36AiO0V63DBORo5ZFSG13BaK_6v2WXqUszzBjnv-nSZIyIgSXgI6ooU3KyNhVsP-gT1jQfkaGmVes8TsIADiTUl3HHwohp6bP-msCwDAKcLo6oCSj4DpjwgQD-X6DbbEA1Bmyj9pcvDiqMgWvjTZXiq5XAU9KEhMLsM-MiFXX_akFGZBhwMT-dKzVJPcluXML1Lb0KE2f-wSgH05_zyfqw1OqQmyy3ZmmEo0AQOdT5kY5_V2AVxkzu9uA-LF2kUg0iPdhyQ5hFbsSVG9u1q8YT0Ni8Ue7Z-O6xeZ_kUVUx4q4oQ0sG-SiB7PO1tZ20-ps78vXfBPA5QdIhJjYp3BWyvZfw&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpainthy.com%2F&ds=l&xdt=1&iif=1&cor=15362904573536743000&adk=1684704083&idt=252&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 574393
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 3482
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1474271/76103299/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67y...

74 KB
26 KB

209ms
65ms

Script
text/javascript

64.233.184.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_xappb=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

64.233.184.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wa-in-f156.1e100.net

Software

cafe /

Resource Hash

39ec8eb79e4ad39dcf3587139328fcc3f496ec7e57bebbe1de95f66d41e4c49b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25903
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: nginx
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 66F1 91 KB
23 KB 52ms
45ms Script
application/javascript 2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 7982951
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: J1lx8GPQprj8WpbAL9Fxp0ZzdzeCP6IcGCmafbfVjji_0qvrDHCYyg==

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2D36 38 KB
13 KB 21ms
21ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 260694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Dec 2023 09:13:27 GMT
expires: Wed, 18 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C70 0
20 B 56ms
56ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=44&d=1&s=1&f=0.01&bgai=Byn_-DVmFZci0DduzjuwPs6KlwAoAAAAAOAHgBAI

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 1279ms
1147ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwliit,pingTime:-3,time:37,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:13%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:37,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B32~0%5D,as:%5B32~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEKM+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,rmeas:1,rend:0,renddet:IMG.us,siq:14%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 1165ms
1034ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwliit,pingTime:-6,time:37,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:37,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B32~0%5D,as:%5B32~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEKM+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,rmeas:1,rend:0,renddet:IMG.us,siq:14%7D&tpiLookup=ao:painthy.com*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A69B 38 KB
13 KB 21ms
21ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 260694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Dec 2023 09:13:27 GMT
expires: Wed, 18 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17864851622750576224/ Frame FFDC 6 KB
2 KB 24ms
24ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca212a6d45038b16f7e2ee85414d0f67362985095eac9dc26a34e96d1ea529b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 473786
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1847
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 16 Dec 2023 22:01:55 GMT
expires: Sun, 15 Dec 2024 22:01:55 GMT
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DE38 0
0 67ms
66ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssxNRzU7dalhgH5NkwYT_-8VE6urUfauz0imCF6nmPQH4DROgc6MjRQrG_mCcphG1_G2PuoymA73qkRliB8iWXAqhswCuEPTfZGPto5RUD0vdw-2lYG7LfGCRKdyhNh3_ZzlKdrRelDDu73cYIxzKF0IHg2JnCnOV63YdhjRymIHODpNQzJkne6p8hLXDAUw0vU1TV3ngVxBrdeEh4LE9MXJ7FLLOP7fyZ8_wilLxHfjLOciIMuy7JaPAhTObr7LoP3s8csQ2-Hv4aaFDMZK5DafZWZ5pjwVA-5HDWq9ohZ3FpVRqJEhhI7tytY7tRF3uU7ES5AMFvkFQZHl-f1vVuei989LX4NdB5uVGg8pNLZP_fFo79IWtj4QE6bMRvLb-ecjGAg40TOFH9aq_jgykFyzplG7sks_sGVraRYfx6jg87JZtP00eUFQszj_kHuDdGiphX4Wd9ZNkm-J2ovdfVNWgvNYHqsPl0rQ5aTaIazf7lteTLJQCNVkEQsmMrDO0u50Mcspo0VAaih_62vdDRiVMIrXBmCUtx8TslkPTFZ_Hs2v3czAxaBMeq6WDEDQnBpbViwxWynoyZ9nWTW8BRJJVaMrC7SEXkmLmMCpdAsG7eoe0uzvUhKy0W-aI_C65n0n_JaILaG7154g2fSndKcEF9G_ogjbZdUgqtjvJbDKzeM2XD7EVGShx9199pZfJe-XVaIGTkE38Sux4rsrQ4R7TDuAdKikCtkfy_UP5Qt_F8Dzg3wlpte14J0KMVT9m4H2YR489MA5RPrb5uwg3qQCqVSRKdFDfhoqleT_cu0dWZrmhgCSSZ8OD1bywggVMljf4pJBj6H52JvLUjNU9pEt_Yc21zWSHRxwmP1tW5Izkf_OhipE0K9YNsKkB6_VOz2YIQs1bffEecFXl2CbKWktb0p2dFLiW6DrFjj3sNtF5qgHT1_3LNTYO_kzhaWIzpBqZ2NDEFCrg4G93hovoJXU5_CsDhdAN8Laok_I_0Bbc-1xhhkZKhmyMRVqljwyoSHsW1ej8EBlk3DC23MiOajrVS5wE5GJUX36LCmTguge5Avf03x11b2vX7RTzm3DoPk7T_PkWYS3t_yggXjDcWTHnz18K-YkQJjcymlbS9zH7uGZOPATl6N-a2genVZW7U8zuYYiu8d172QdnPqTgGidr_uEuObvb_DZ1Xdpy34drLR4CsRbyZjiF2StWJooe-gnc4rtIb6lNtkLRq4gh412sfGOzTc2d3qroxmebm3QWs2PKkEciZe-roFKD1hRQEgu84ua5D8a9qfC2m4kXwm_DtM98SyeGfGoOv6Pyt4Avx6&sai=AMfl-YS1z5YRW5Q7tdGX4hlfrP06gpv3W7JXU4AXCeArt8lsep_Tv91Sa6eXbXfXlS7WsvoO5a9M8OnVcVfwjAbDMiI5P66ZfWgVjhxpE1KUksevsR2BN2k45LOP3cqEEyP6ug_jz0vN9g8cD1Xpms4wrowujIeGRjmiGYEe2thMSJaeVzUWUJIfUFeylyLyybLBLi7O-Wk-pX7e4v3A5Ra26mecydE8QLnP1e25yJfMSg6xcRvY9v6UmbUCmKrHWRRT2wqZnNRdt5UnvqtU6OoIUK-3ipdzVXuvLtgjC1XiWg&sig=Cg0ArKJSzDSUYI1M8RlQEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=87&cbvp=1&cstd=86&cisv=r20231207.92017&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 4C70
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1835641/76875435/4.js?ias_dspID=3&ias_campId=1015029463&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20785736086&bidurl=https://painthy.com/trav...
https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=gcc_DVmFZci0DduzjuwPs6KlwAo&cbFunctionName=goog_wrapCb_DVmFZci0DduzjuwPs6KlwAo&true_pb=

1 KB
1 KB

37ms
37ms

Script
application/javascript

2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=gcc_DVmFZci0DduzjuwPs6KlwAo&cbFunctionName=goog_wrapCb_DVmFZci0DduzjuwPs6KlwAo&true_pb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: vKEhI2DDF7x4y1d6KCleNAEq1uB6J8K1
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
date: Wed, 20 Dec 2023 19:39:30 GMT
x-amz-cf-pop: FRA56-C2
age: 136840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 13 Dec 2023 19:37:39 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: r6qePDQ9DjkIvBTYP7Fl_Q4CsVQNrfdIaAaCDQk92JkYX2fmvuoP2Q==

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: nginx
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=gcc_DVmFZci0DduzjuwPs6KlwAo&cbFunctionName=goog_wrapCb_DVmFZci0DduzjuwPs6KlwAo&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 8108 91 KB
23 KB 125ms
125ms Script
application/javascript 2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 7982951
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: FEa1pP8FCp2bXEnwTN8H9M9rvrA-DEY9WT7aW6p9AG5ny_TnKYik9w==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 1233ms
1146ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwlijc,pingTime:-2,time:82,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:699,beZ:699,mfA:702,cmA:703,inA:703,inZ:706,prA:706,prZ:709,si:713,poA:714,poZ:728,cmZ:728,mfZ:728,loA:736,loZ:738,ltA:781,ltZ:781%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:13%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:82,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B77~0%5D,as:%5B77~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:IMG.us,siq:14,sinceFw:67,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 1109ms
1031ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwlijm,pingTime:-3,time:47,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:46%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:47,n:46,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~1,0~0%5D,as:%5B42~300.250%5D%7D%7D,%7Bsl:o,t:46,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WELv+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1%7C1b2,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:19%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 1108ms
1035ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwlijq,pingTime:-6,time:51,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:51,n:46,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~1,0~0%5D,as:%5B42~300.250%5D%7D%7D,%7Bsl:o,t:46,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B5~0%5D,as:%5B5~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WELv+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1%7C1b2,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:19%7D&tpiLookup=ao:painthy.com*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 style.css
s0.2mdn.net/sadbundle/17864851622750576224/css/ Frame FFDC 5 KB
2 KB 23ms
23ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d74871f1d66e7c0230449ab708d05f088e33d578275cfbc2e0d95529b689cfcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 15:47:00 GMT
date: Wed, 20 Dec 2023 15:47:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150681
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1854
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame FFDC 70 KB
25 KB 48ms
47ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1842800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25267
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-62b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B5UBenjeP88pWq9%2BE3SLOigTJMKKofprNfAN5AUh9ePpr28wO72nzQkOP9Sjm98Q2hqG0FAyw6TxiLNiEDq9qerc16bJu0A9ZxlBtxVtndmq51I5NqyiwqKrH2HngwcKVKRH5PxfjZlELHafJ80sS47u"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8397643488119220-FRA
expires: Wed, 11 Dec 2024 09:38:21 GMT

GET
H2 200 CustomEase.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame FFDC 7 KB
4 KB 50ms
49ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/CustomEase.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2131109
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3299
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-ce3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LNK5dpw46A%2BDKF1%2BtL4491RpNauYPWEZZ3kOJjJHHKPrUrGg1%2Bwm2C0pzcoi%2B4whEI%2FKLksRNlsFR5NMO2plDmaGH66ul7daLes6G2FKFpffBArfZVQopmSIEbjJTimHsgZuAkuqxVAbTfkRQWtqJ%2Bf9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8397643488149220-FRA
expires: Wed, 11 Dec 2024 09:38:21 GMT

GET
H3 200 dyson.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 2 KB
1 KB 25ms
25ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dyson.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 21 Dec 2024 08:29:30 GMT
date: Fri, 22 Dec 2023 08:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 rtbIcon.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 2 KB
801 B 26ms
26ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/rtbIcon.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 02:40:47 GMT
date: Tue, 19 Dec 2023 02:40:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 284254
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 771
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 dyson-v15s-submarine-stack.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 13 KB
4 KB 25ms
24ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dyson-v15s-submarine-stack.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12ff2ec39651e02b34ee26ae91b66614f3b981e5b8db58feb16115c2b6b201f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 09:12:58 GMT
date: Tue, 19 Dec 2023 09:12:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260723
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3980
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 1-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 31 KB
31 KB 25ms
25ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/1-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dee119ee49ab8771cf531190b1b186a092c709f799baf9ab566a3ca9778ea0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Thu, 19 Dec 2024 19:23:06 GMT
date: Wed, 20 Dec 2023 19:23:06 GMT
x-content-type-options: nosniff
age: 137715
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31326
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 2-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 21 KB
21 KB 58ms
58ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/2-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d66ba6bc03128cc3ce96e393fc2b3f7c8bd2e73af8258ae6d6a5e6f2efb9848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 08:59:06 GMT
date: Tue, 19 Dec 2023 08:59:06 GMT
x-content-type-options: nosniff
age: 261555
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21613
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 3-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 25 KB
25 KB 68ms
68ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/3-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de63bf5ecaf8695bae42a604e9808a63c55b0d62bdb3b4462c1530950772fc27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 08:56:48 GMT
date: Tue, 19 Dec 2023 08:56:48 GMT
x-content-type-options: nosniff
age: 261693
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25605
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 4-min.jpg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 30 KB
30 KB 74ms
74ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/4-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

263403e6cea55abd488e73b1a3ed6fac18d6b3136572570953b3392504715123

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 18 Dec 2024 05:10:36 GMT
date: Tue, 19 Dec 2023 05:10:36 GMT
x-content-type-options: nosniff
age: 275265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30924
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 arrow.svg
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 192 B
191 B 77ms
77ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd99a285d81a12f549b741db9604416a669e2ee8accf00cd40c0b0344e9ba63f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 19:58:01 GMT
date: Mon, 18 Dec 2023 19:58:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308420
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 161
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/17864851622750576224/script/ Frame FFDC 4 KB
974 B 23ms
23ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/script/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e24e46459c7d6e73401ab03d015d9819826b4d7e01d5dacb37c0264ebf8f069a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 20:28:32 GMT
date: Mon, 18 Dec 2023 20:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 306589
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 944
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E48F 38 KB
13 KB 171ms
170ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 260694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Dec 2023 09:13:27 GMT
expires: Wed, 18 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame DE38
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1627455/73523888/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20492286635&bidurl=https://painthy.com/trav...
https://static.adsafeprotected.com/4.js?xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adContainerId=brand_safety_DVmFZdyoDc3UjuwP3JWJCA&cbFunctionName=goog_wrapCb_DVmFZdyoDc3UjuwP3JWJCA&true_pb=

1 KB
1 KB

26ms
25ms

Script
application/javascript

2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adContainerId=brand_safety_DVmFZdyoDc3UjuwP3JWJCA&cbFunctionName=goog_wrapCb_DVmFZdyoDc3UjuwP3JWJCA&true_pb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: vKEhI2DDF7x4y1d6KCleNAEq1uB6J8K1
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
date: Wed, 20 Dec 2023 19:39:30 GMT
x-amz-cf-pop: FRA56-C2
age: 136840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 13 Dec 2023 19:37:39 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: TEo4RQ_VhNAsjUF1kS2xd02m-4DIs0AFzV76Tgyx6FZ-72womCb4qA==

Redirect headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
server: nginx
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?xsId=ABAjH0g5PUQQnxzHeKemaCGTwI0_&ias_xappb=&adContainerId=brand_safety_DVmFZdyoDc3UjuwP3JWJCA&cbFunctionName=goog_wrapCb_DVmFZdyoDc3UjuwP3JWJCA&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 46E1 91 KB
23 KB 54ms
53ms Script
application/javascript 2600:9000:211e:da00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:da00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 7982951
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: Hxhk1deelej0ZmIa_SrhU1yhs27exvY3-yLXa09bjKp6xjbL4n0zGw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 1154ms
1145ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwliks,pingTime:-2,time:115,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:591,beZ:592,mfA:594,cmA:594,inA:594,inZ:596,prA:597,prZ:607,si:610,poA:611,poZ:623,cmZ:623,mfZ:623,loA:642,loZ:643,ltA:707,ltZ:707%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:46%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:115,n:46,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~1,0~0%5D,as:%5B42~300.250%5D%7D%7D,%7Bsl:o,t:46,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B69~0%5D,as:%5B69~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2,idMap:161*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:IMG.qs,siq:19,sinceFw:96,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 1254ms
1254ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwlikC,pingTime:-3,time:53,type:v,im:%7BpBlk:33%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:53,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B48~0%5D,as:%5B48~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEMF+11%7C12%7C131%7C141%7C151%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a11%7C1a121%7C1a13%7C1a14%7C1b1%7C1b2%7C1b3,idMap:191*,rmeas:1,rend:0,renddet:IMG.us,siq:18%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 1253ms
1253ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwlikF,pingTime:-6,time:56,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:56,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B51~0%5D,as:%5B51~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEMF+11%7C12%7C131%7C141%7C151%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a11%7C1a121%7C1a13%7C1a14%7C1b1%7C1b2%7C1b3,idMap:191*,rmeas:1,rend:0,renddet:IMG.us,siq:18%7D&tpiLookup=ao:painthy.com*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F256 0
0 61ms
60ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsudzVwFlzFrrCkpaLJR2EQ1C_Jg5DLE5eZ-g8pZpNrQeV9qpDKB8fPeRv6cehmlrc7gl2eEDY6WkHFhBAVEq8qjJlWy9zKKhDeASY-YSWYLi7LMbnJ6lOIJ-U8HARSy_qck-8RIcz6upOz7CZYkRtaIruGaJObktRInx_BoBwRPopdTCl8MUJnFYbsfgf05_a2f19U17J60hPhU9mbUm8mtbHBbKqVyOaJxI-z3kQM1fP94mK336xQw12q0IJ5CaRFnxnsHUtBQqnbSttZE39LHCkd3tuzs-tnHZcK1LlPY-pUtgjcEENHdpinBeizQMTowOdt2qaQAzTNanLTBe-ltKNTF6PI5CA0gRrrOGcMqE-MgmY5Q9GDYS6HaGW-VZtkf6ZWZjxTGzsdvwQ4RQzhLbal3piayRCiuVZz7-CPJ5KtaNrUzrZ2iDS_VChmP_mC8_Awd8j6IOLquSMSx3IIas3QfEND6sw2XnrLKrk8ORWbBxRS6hF0wmbgWyy5ieMA8eXC5xRN32-ZJRIxY5VjGx7cwuz5G1jmYcXTNDPiAGBBbAG66H7t0bKHdqKS0dRHrJ9JTTjdfL5gTGDMOvla6yTkT0o0E6REYYmrXVF4nJCwRlacV5UNmHJxtrYQx5BugLaJ_QdWrUouigkII3ke1hrZ2nDjg18qh9ddVAsV2Vg9ruanutCS7Kahv7SIKW93QZzwFI_fzfTGbwdJBfc-LXZrWgJR2V55gxy9GJqsaZNM2h_HboVUaz-b3pC3014pS93jvjo8xFFn_Bp1jFpZEW5Di_6zTe2tnn8Q6VkvkOaK9bbkppJXoub_GppKNWmNNEO6tVr7O6nmW-gVdYJHO4Pgs-QNb8VJZbGWJ0EtwjJj0zJaWPQ_BNiQRYlyLxefdrl1KSvLrQo_Fp_fhnIZVJgmaCp9W9VxMomj_aCBnux5foJ2AGiA3-_CVPB8SkAIffGM-SqULzIyRlNzW431TJEY5rFf3uGqwEXjCvtMPZwwtumzNa_Iv-wqBPhh1y0DOg5N87Q93qLer50fErCL7hKSkElVA291U-yQlgEoNHIA9Nzv2BCMJTlbwWmJ0pLEo2UwMv6D6iZXCRtws83lhopmnkt6CNsRVm76C014ey5_NTYi5Z6DvCZexN3J52EQbWr-VhMrgv-MuWbTbj0D93zx4eNOV7b2-3udJ0cNcZWql6bHPCRCfFb4aqvHl54zaF7U-M8dvQZYGgS7h-N9hTxmZE-i01Kuz2nCb_DBVrvR7i5OpCgoewBzT9VMICwPxhQRfPKr2DC7Zubwm-aabvltg1QPQDUApkrwGHr6NH3eD&sai=AMfl-YQqVVzaCdstmCPl_Eb1CoK6R2BBLXk60GoGKXD-bvv5kt71llxoXKaq4bqBHjlDff2N6pijSmlehmKLyfHHtJ283gxBKYc6IpXB89Sh_TnjahDij6wqlnrerW1wFvAqjThs26nP3gN1YMV-NvGw4R3mtGVAzb0eAJOcCx56x-J0pI0oYHqOtZ3Y0LSxI892ne2X0-_lWn-sKuGGH10bqFFVfiwXqeFo8mm9RcoDQqRGiQjhamxVv8kBtu45GQHQSJE3Sbbhlu6wUh4k5tnKSxfsqaV1ZGI25vSCHJglgg&sig=Cg0ArKJSzPgPoqgQ7zXkEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=410&vt=11&dtpt=306&dett=3&cstd=102&cisv=r20231207.57225&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 1248ms
1248ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwlikP,pingTime:-2,time:66,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:727,beZ:727,mfA:729,cmA:730,inA:730,inZ:732,prA:732,prZ:739,si:744,poA:745,bl:759,poZ:760,cmZ:760,mfZ:760,loA:782,loZ:783,ltA:792,ltZ:792%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:66,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B61~0%5D,as:%5B61~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a121%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2%7C1b3,idMap:191*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:18,sinceFw:47,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 2D36 39 KB
15 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 13:10:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73660
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 13:10:41 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame A69B 39 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 13:10:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73660
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 13:10:41 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DE38 0
0 59ms
59ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssxNRzU7dalhgH5NkwYT_-8VE6urUfauz0imCF6nmPQH4DROgc6MjRQrG_mCcphG1_G2PuoymA73qkRliB8iWXAqhswCuEPTfZGPto5RUD0vdw-2lYG7LfGCRKdyhNh3_ZzlKdrRelDDu73cYIxzKF0IHg2JnCnOV63YdhjRymIHODpNQzJkne6p8hLXDAUw0vU1TV3ngVxBrdeEh4LE9MXJ7FLLOP7fyZ8_wilLxHfjLOciIMuy7JaPAhTObr7LoP3s8csQ2-Hv4aaFDMZK5DafZWZ5pjwVA-5HDWq9ohZ3FpVRqJEhhI7tytY7tRF3uU7ES5AMFvkFQZHl-f1vVuei989LX4NdB5uVGg8pNLZP_fFo79IWtj4QE6bMRvLb-ecjGAg40TOFH9aq_jgykFyzplG7sks_sGVraRYfx6jg87JZtP00eUFQszj_kHuDdGiphX4Wd9ZNkm-J2ovdfVNWgvNYHqsPl0rQ5aTaIazf7lteTLJQCNVkEQsmMrDO0u50Mcspo0VAaih_62vdDRiVMIrXBmCUtx8TslkPTFZ_Hs2v3czAxaBMeq6WDEDQnBpbViwxWynoyZ9nWTW8BRJJVaMrC7SEXkmLmMCpdAsG7eoe0uzvUhKy0W-aI_C65n0n_JaILaG7154g2fSndKcEF9G_ogjbZdUgqtjvJbDKzeM2XD7EVGShx9199pZfJe-XVaIGTkE38Sux4rsrQ4R7TDuAdKikCtkfy_UP5Qt_F8Dzg3wlpte14J0KMVT9m4H2YR489MA5RPrb5uwg3qQCqVSRKdFDfhoqleT_cu0dWZrmhgCSSZ8OD1bywggVMljf4pJBj6H52JvLUjNU9pEt_Yc21zWSHRxwmP1tW5Izkf_OhipE0K9YNsKkB6_VOz2YIQs1bffEecFXl2CbKWktb0p2dFLiW6DrFjj3sNtF5qgHT1_3LNTYO_kzhaWIzpBqZ2NDEFCrg4G93hovoJXU5_CsDhdAN8Laok_I_0Bbc-1xhhkZKhmyMRVqljwyoSHsW1ej8EBlk3DC23MiOajrVS5wE5GJUX36LCmTguge5Avf03x11b2vX7RTzm3DoPk7T_PkWYS3t_yggXjDcWTHnz18K-YkQJjcymlbS9zH7uGZOPATl6N-a2genVZW7U8zuYYiu8d172QdnPqTgGidr_uEuObvb_DZ1Xdpy34drLR4CsRbyZjiF2StWJooe-gnc4rtIb6lNtkLRq4gh412sfGOzTc2d3qroxmebm3QWs2PKkEciZe-roFKD1hRQEgu84ua5D8a9qfC2m4kXwm_DtM98SyeGfGoOv6Pyt4Avx6&sai=AMfl-YS1z5YRW5Q7tdGX4hlfrP06gpv3W7JXU4AXCeArt8lsep_Tv91Sa6eXbXfXlS7WsvoO5a9M8OnVcVfwjAbDMiI5P66ZfWgVjhxpE1KUksevsR2BN2k45LOP3cqEEyP6ug_jz0vN9g8cD1Xpms4wrowujIeGRjmiGYEe2thMSJaeVzUWUJIfUFeylyLyybLBLi7O-Wk-pX7e4v3A5Ra26mecydE8QLnP1e25yJfMSg6xcRvY9v6UmbUCmKrHWRRT2wqZnNRdt5UnvqtU6OoIUK-3ipdzVXuvLtgjC1XiWg&sig=Cg0ArKJSzDSUYI1M8RlQEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=394&vt=11&dtpt=307&dett=3&cstd=86&cisv=r20231207.92017&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame E48F 39 KB
15 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 13:10:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73660
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 13:10:41 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8DC1 0
20 B 60ms
60ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BzRQQDVmFZbIB_KmO7A-L7ZnQCwAAAAA4AeAEAg&bg=!AgGlAU7NAAY3kmNgF5I7ADQBe5WfOMayl8COSgBJh3FaW8JBeeV_xB4CV0Qaq2ZXkPJ2xqJmbakHCmdOhNHrafhrWqCdAgAAAPpSAAAAAmgBB5kDOzVXDPKwh8e1Bd_PaAs4GB09OAmVDrfmrw1PBv7TvycuxoeGOgNsUZF98JlFUOg26RLsel9K9MpDgYSGghgcqXbHzed7zvd0-rnQgwoC50otyisIWKAraDSvdi6bumai-VL5-HL1XR2-4zy0-vmy7w45_NgeIHhJQCr86fDYBIoChJyVvnbSF_BIo_Sg5_LjuCRqx7WrYvidlN-Z6Wk7eQHv46dCb-ToSOrXxsPrr-NYOhRi5CnJIzfVfyO8thPy-F1SAKWGSUnbMVAK8KoW346zMWkE9UiGUlspS4bRnH1b-IcLrHJvCp-zRmZrIXRmRQ4cj5jLnl48htBtSV3B2tFOgWwB47SLfRCT9_quyUvmJeIxi73tgpnQTgtsUq8mDCPnSRDUB0VKxTFcpsVvAQ7HTIOK8_4aYwTubPMQ_DgtOnJ63yb8yb3XBgIcMyw1rWRQwjEBIkROJsi9mdFp69IgBgRgimuHT1ry8O7pnJIH5QcX4gvblimBwepKYoog5OTMdo4opFkem2e8mmPRH8GLzubgvfDCkLI4uJoY679ISWq5yw_uVTwWH8PvpDN7Z_JVFoootONlktHngPwThrQ8eg0ZsjHlH_jCx0E1oh7wRvwxTlDmxr7zDiaHqhkMK9KwP9hHDF2cpAsOzpSFG-OJVtXKDz8tvnKo_64-lDcWj07JZoYMRiF0e7GT0KUQdK8ehmbIkST8978ilCGgUbvzddl-hsRNkSbnZ7YNRCFvEvx_LMpt3k1kUtkXo3zRmSZTwqjoOYXpiJUOu8qrj5CPweiUrXJQauDOaQvjHFt3PEHhCgxJ_CNM_vu5B95p5DqpYg9JgBE2HlEIQionvAwMn6xrGxrvd62zgXCbu95xMriSO2henuO1LPitgJ6eCLolIIc21DGBtFvpein-ggmTleDeLCvwIeNZHOiEiScANek8xlVSh_ATedooEkxvYAjwlQznolPAtUGRU6tLGL7seX4tXXKd8FDE3pnKogMh1AEGE48P1o51GuOl8vIN8CCktuYIuVutTf8_D9svLwKBKSUtSRGklFEK7_B2i0kSRve7lpyC-nNbYtRlZMwzWFkO04C8jxs1DmIg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 1036ms
1035ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwliod,time:276,type:e,im:%7BpWait:4%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:276,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B271~0%5D,as:%5B271~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a121%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2%7C1b3,idMap:191*,rmeas:1,rend:0,renddet:IMG.us,siq:18,sis:253%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 3482 111 KB
39 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 22 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 3482 11 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1474271/76103299/xbbe/creative/adj?p=APEucNWXGRCsI5qLZ9x1t9Q0wdOybhwwla5aY2SkcSu9uJeH22qP_aU&d=CokBAKAmf-DNkPYEGxCQvXP7nf8LkPAcN4G0goQL7q7mh72HIGBkIIn2YLArdB4c4QVMZO5bI8ST7vHrGpRbmh67yxUl5BIum_lFVDfxnE0NajvBjmTAVPdalK45TxK3Ek0_h0mWi-xifz10tKPIg-xnLPmUnBm1HLYx8qzcxnbH2pVFpRMuc18uavwSqRYAoCZ_4F6tszRxKkl5nIpWRvI-T0peYmUOZS8kV8WnlYBjCd7BLZwh4GSPmLWFTcMw471rCJimanqIxYYiIGUNmufK6IASejL3vb9LrfLghFJrpB3vq1UfH2CqgRneTsC5U9Jp5dUNHCn7rucg-Bb43a2T0ETKWMvygVLLWerRrZaJ8AkJjfPF-QHUVJ4ycv0PXCvxdptZEnpF5sfsoJFMJBwNsqWogboFTTQ3XPF_52LxLCsRROtKj8z9G9bCMgguReKVzKqLpPA4twrftooaNnS7tJR6s3ZcHqGcQO8dSTsnCH2icXJFvoYEBIpmzjWvPReCdKd58WnXtLuPJuki79gd3DUblNxTOLN7YjzKqIsZ1U9WP2m8_Cs8M7OKycD6Emt6HE1wbY5JC9SbODgqZSRN1Pe9_6NtK3zc62ZEV-a9XD2M_1W3vI9aa3yCwqtEr852Muayh6ZpeiemwfHQN7sO0RgGQvsRbuPdpcmj2cUVMDAk289TdWLt-Q3_SUK5M1pc7zuGaAPZ17DgsW0OT_1xYSwwbO8duYuX_SqhBu73ZnKQiEgb8ESkDN5VyWDej3DlJ2ilBrgSF9dkueoYrjvXC-Wlmg2kOhD3_dlCw19Ml93DxVx02_waJ6K3e8j0FpFl18k_is8DpJq8JqUzFBFAjwC6YZuigkLPs3KZVSEppwXVULw6AGh3KOLyf7kG3KWwEHc9OoL-T-62ectNQeeyzmu6csoLlrQQUW0yghtJhet-8MJX-VOV8yjxVIpLDGLyERem1kII_2BvW6cqFOs5NjAQ4Ry17T-zut5q_gJL2RiciJySa3jis8CtIzfCqyH5_0aJSaO5f5nz8DqcsVM0deCSQ5P3Wr0RMYAWgW9PhBd448ljv4OyYzC6ebhEwBmk3USNI9WsERy7Jto2d4xjUbK8OgHBXClKrRk0cK4C5RoarCJkEJ0ib4KznCIsQlbSq73cnZngvn06s6rA5PUe9TE8C3TnsVzsWWp4L-kbpDNVJowbbqlOy6nUVKgMClsw85m71KBGtnjQzZOxBcUiAhI9Kv61sM9qBSu-DrcwV07rlIfGjjgIR27ey3qg9ftDmo885qoBEibPU1Ru34b58EsFq-jShRs3l61KkthIvksRV6v5V0kzA2gC1KI5Q7wrBfg09xK8toFhkVr8ldySooMHsBnphgMsoklb9cHzpgYBqp2heqNbmxOOdcWuLX47bkBzScxNvfXPFgy4LxwDSv8yZzaoP8fcpuLui2BNNWiefY6-nNdkggEx7BylHRHLRwkZOLZySGY37NyOkVRHkrvXWgWMCudfrhObBKqM_j9CGCwAUlqgJhto0qXBP14_uoA7pZE5C3NMEBii6GJi99xAQKuDeKbDbAL9zEnTwBmCtDazYTYZOd4gSi4v30CwJ1xSi8Z8N_bQ3sWOSH-eAAb4BSfsVJXZlP6fuwCPSozUfCk00pt18m1ypTAKUlfxNeWgFIBfCDsO22YpLOnsu2XCXqBH0kRfyLBAAqLwsQ-dn9SNDnkpFnph12zH7ym0q6E23nK7z_lyXtLDgfWg8fG_84pi7e0PlL0_mEwHkpORSTadAKV0R9_5ilLVU9myqppCoeckz4AGnKIZrFYvThbMeMmzeEtbW_J3iF8I4V8x1297VspQ4e-O5z2BBBgR7HPs5wDJwFe69tyJFC0r6dD8rWI1m8jBmN7ZkE5ezPggNjkYypG7ELqAF8ODL8AYMT7Bhka65FsOahaGxN6y-d3Faeg1PfT0WbwpSoLuN15TCqgcdFe6kHh1471bYirqQfI4b_kwo6gHv3R9w1_0H4q4Gu1D-GeO6ycyOgQiU4smTNjrs0Ly16ou7oyXYsBDmxBskmNH_qwng8d7N5tp3kM_3_CLMGSgJpA3kcek_c0k_muu2ZIuuowCMEPuO_r640YWhkaVcpY-OZBiB2FrBvtfhr-y7pUSkT-o9UvelC64KwUrGGEtdlsKteXjLylMUA0LEEp-5-Tvv7OLCu6750uW7qUjTSHGxBCvQaocplQBetkHkhgmf4Ttr5XOTxOvL8xTMLuGyiOHRjFcswJbk8nh6M1XRrNVjGJ5iok_xjIXYY7O4fyIkbT8yBS3L5OTybkzF5FFv5DTRbm8DPTNzP8dpyQA9xkH4fYH3-2ULE05fjxj_x9d3r_uKFsTXvQdrtzvddjPTWDlRBYzj6JxRuohnSE_R1FCEWP0dpkQ9ntjp8JGk7jmRG-OAmOmz8TPHSBfFtFeo2GOfmeY0eZVQxj3YNb9U0QmEEZAPiT38jhPchxRCmarU-8D5hP0kvre1KGK84Tb6nQxr4YCRlrQS7Lpcq9VxmmkMM2q7a6zuJeD8OFPriwR2IW-b-SUpV3GxtRCMiaRYm8eGPVutxX2krmzqUJBI5NIyklNnuWHi-faX7GMQ-S6PAzUXyKXUyN21Vi4nXvTDZvEO5n1P7H4JYVQJc8Abi4hf2FfYiEpZW7Es5lYD6YkQHVQU1ikMSVXKqsO6zxkOBqhhLxwbMAh94E8UiD0Mr3YJoWoWUrmli42pIvPHdC9Y5fTII6J0ui-1bfovcqQEtwN5VTbUJxnQE5bpDcOcNCbuKFpDr2OwjD8z6WWVYb4YeUnbjM6Mq4V0mjZtQ-WwGXXhgRav3G60AO1QrAS5z7qoih0i1XfiJ1jqnoS75hLQfsFGD66Nev95Jzm38Ay6EIwRWGwa0HwYGvard8MmX5wDespWODIdh50mmEAFdxAWlYb4aMxjIeBUvco8RdzrMQ-IemhCWzxmAuTX8DQgu5S2m_ZnjRG717h30gLtOTIwWj5C88DnR-MCy4scKrAVoUtwIEH1zmCR61VFjla0ASPnLFkQWmLoSxfj1mOGcoXZ1UHMzg5sApNeCaKuseVkoI9OtZ9em0cP9ds_ZA19Nr_Hnz6hp2Ujmk2Ie54_73OMyABCtCU6-sCjQWJPtPT0777KCjBGpRkOCYYurdYDOY2ZhMiF39pARdb1yWaqe9VNMD3rB_E_m0mdQb8P2St3tHDaJ9kOag0mMQyoe56nT4e9jPDVp3zNFWCa6GNv0tHiKqnLtLE817_VyvYPziQEwZ2ZGvSguUKqXaHQFJI0AvzTbGPcTmwWx8OPP1SEEjYiKkXSvVOQBAIMWUg0GCZV_Z1mnHVDUqIyaTaOyK4uYDScxb2hfauG6869VxxP5dv80TFNdfKKrIJTHNg2_QkFp4uwfxY9CXv6MtrYOJ1AfhpNxNLokJkOCqTX_u4QEO6paizfqIilLXqtS-qtsk0mHePV09mg2dlsGwRkZ1184_tPV1MtC2hzDuDbeHcFHLgTMtpIB2bdSJk_SLasNOABJRAfvHaHhAzXYNIY-Dxv5E0XmREl2bxa2EMXyHo4jtgKsblUmaEY2T5gFs2hmLxf4ZuK-cjRSgySVnvi08FlvqCKcYqifu2qMRA6Hv4nhvI3vC55bMEUq7tTcGCFpuW5N407qLTjYmMiNGBIddL6WMNl8mMPxeHUkgFslJJnTBnU3Tz47ICrQFz1N6qWbiRehLHVcdxIvVrOXu4RKQ5P2b8qi7PCwmhII9CQylBdoMvtgR87pzMT6NcjNbXyArpDnIv02PNGunifpqnc4_QbCAayvZmohx7aQXMJtFpHyvlx917r5YiZjKtCFR9B6ZN36VC6ZxDBjcKYJpI9k6bYDIb8CQVnJZuir8EcquWkaFmz-RhcTRIo2Ou-VkH7WmpYZoJUxaahTbwF7D4IMxZpTlCIfo1RBmU31nssZJow-pftNokLVKbL84KaTUHpRbya0JrfIaO_4DyvNd5t5B8GlUIBBJPAC8eF_94iVPnbSE6YF831P_UbwOnjuFHGmdkS_M-nw-qvj8ybE57HopDeHLi9_tLN66UT3lWrI0849BH95AH0uOUwozgV4AM1pl44lb1LBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-9779134835489781&ias_chanId=1&ias_placementId=20123268692&bidurl=https://painthy.com/travel-insurance-online-in-2023/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0igZCT3G_1pkHCoixOFfrYV&adsafe_url=https%3A%2F%2Fpainthy.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fpainthy.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231207%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1%23RS-3-%26adk%3D1812271801%26client%3Dca-pub-9779134835489781%26fa%3D1%26ifi%3D15%26uci%3Da!f%26btvi%3D5&adsafe_type=d&adsafe_jsinfo=,id:7534f3dc-bcfe-b38e-7138-8aefa1c80512,c:xwlii5,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-765c58974b-qk9mp,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tZ9WEKM+11%7C12%7C131%7C141%7C151%7C1611%7C17%7C1811%7C1812%7C1911%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:14,oid:d80d232b-a0ad-11ee-aa5b-6a5dfe2041ef,v:19.8.466,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 01:57:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 05 Jan 2024 01:57:58 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 3482 31 KB
12 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 04 Jan 2024 20:42:27 GMT

GET
DATA 200
OK truncated
/ Frame 3482 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a0de65d1dff32e4651c3da80ed0bdc2cb5116a6ccd6e59a11e63fced2ed7acb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D601 42 B
174 B 178ms
178ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuNyh9bhsXnHtSBMpOSk6wGsCGC7et_Obu1aayE5DR1_mxo8MhT4Bo9Iut6EItZu3Jto2GGq31wPxbWL_v25iEp6KFefxBHjHt1EW-W1n4n-Y1wFp2Bpxz-R0-rTLLDaO4dnowzJ5FnYqwdui2cPth7DyPD&sai=AMfl-YSCzHsTIeOcPdh3aqxll7-XfQVWghBP1SfIEw3hA-ZzTyz0od1ixqJ_UJZvJWm0GIFNP4__YuXbeu2FisqjONEFbeMIDKCUZ4Oc-L9CHbe3g8vD4J0JScWDlrNTiLVfNtCwGjvoADAC6pXzBlNd&sig=Cg0ArKJSzMWms1SAoabcEAE&cid=CAQSTgAvHhf_FOfV_tQmAp5jJelgnMIx6YBCw8TkIiiLBbGWE7MisKWWMcoXafC3fGNtxEH0DSJhgFgoNzVlJAsMv_R0fIkmihs_vogic5OMbxgB&id=lidar2&mcvt=1037&p=0,0,1118,325&mtos=0,0,1037,1037,1037&tos=0,0,1037,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=0.71&if=1&vu=1&app=0&itpl=22&adk=1459535944&rs=2&la=1&cr=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237899646&rpt=1150&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F256 43 B
215 B 910ms
910ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=88457057-e4d8-9ffd-1318-194a20c3b365&tv=%7Bc:xwliqi,pingTime:-10,time:652,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjEwOSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1703237901917%7C%7Ccf931b24841ce2528337326d6b176d24%7C%7Cf5ef61ca1e560a2377dfd6c236fd3eb9%7C%7Cb47dc675f1525ee2fb31ed9846d0ae95%7C%7C2c694f2de63591bc706512c9dddd8fc9%7C%7C2b9f79da258eae17ab77d0e32a7bcc9b%7C%7C51f18fdb4e9fc7970c6395765b5f943a%7C%7C68043555eb26b913244a758d3c81ed81%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 901ms
901ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwliqp,pingTime:-10,time:529,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjEwOSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1703237901925%7C%7C8c05252e5d718c56c23ca09bda3a9dbb%7C%7Cf5ef61ca1e560a2377dfd6c236fd3eb9%7C%7C53e8c1252dbc69553c67d5483bccb7d9%7C%7C33ebe49c67af6fb72992ff2d4f658c1e%7C%7C9db56dc1f07c0c18131395139fc5334d%7C%7C9e9df44164e93091c414eb7f41ef9770%7C%7C77154418acd2605c2dbc8733835576ed%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2D36 0
20 B 59ms
59ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Byn_-DVmFZci0DduzjuwPs6KlwAoAAAAAOAHgBAI&bg=!-vml-bbNAAY3kmNgF5I7ADQBe5WfOKEZM8nzg9JCL1ZmwAlinBo0HDjdwvvCKcAS8qv2XbBVKu7TM9QwIxeFdfsugW4FAgAAAHVSAAAAAmgBBwoAUFuMswbwvc3KBgDtAtFFS-jDhKCRtEjKMPe7SggJr43wQIhP9GkyxxOE3zxMydGGZCd8H07ha_noIHvEchFzQxvIv3vYNocK4jYO8roXrfabmQM_L3B-DRnHO16o7Gws8tBCv3KOVnUzC6WW2FLWZpFukEnPMX0SkQUm3ODYq95AuoU-evLE5z5910gRaBvUkMSNNS1Vv3ZnvDm8gcuxkO5Z-wv28dUyMhBl65H0TQIfyBtFlN-TsCuDxrh3WB2JMvpQSQ6u0YiCgCf2PnFlJNht9rLNxIJAj3WwhnwdwnKbsOxL-nVMOfNS2MSiF8JY2weZRAIk2AKphopsDgtxJV4U2gCKqK21c7bqpgJIF3QpJRkVYhoKTky_57eWlIcoP5_r6tCb2G-zOFTdniINoyxEHcU08B26KUV4UoJip5jdv1OZEsm4SSh8PzFW7DNfwRW_3L7x8IM8YfNmA6auBlQeAl1jgtjjJ0dsvPk2gRHCEe5_neEWYMC8ZEMmYjQzom8P7g8pOfzCLw257FGC959qZFraxhPAVykTtxNISoXXdeplTqObzKGFan7AvXd3QtYKE_trcXyzeR_4IiIIjSSPyjyyd9jtZplA0wfhxm18QFHvM934fq63yGiNBNBo7Y4c3_i7i6cbAIsgfwG1Gh2PnMfd2zhp-rmUTfkbiHP0CyNNfyRmZsdGm0vjSuc9HJljVeU_3yqIGsBDwrlt9VL2x_AlTCiZcPlucNinAVNxUJt-_GabVZBZL_oqOt6PL8ndYqUDn1OVsubh1e6R95ElQdqH-gnIiu5hBaplEly6pKgI_RNQma8XdN7df4kdS05GCvas9JrAAVuR-zG4rj7f73YPa1bG0eRWdonzuyYR1JkwT19H3OA8Cahl7lRHZ-BSfxjNEocBhyGru19FQRf8rdtjOELkTcCdxj5Nn1cCabZa22sJdYXLjh2qUBKEkgfA8A18AeQ7AH8kHR_19536eAtK6_HAwVPwbjsllK5ad5KYnWgnPma47JePx3elB-dAP-xVtJgMjcWqSZrDi6Ps25-fXR8I2-WkrKiqp5c2E3Kwe8L7EzSIg5vpEB6j2KIgSz8h6qAwNPHWznGCXEekJtTnwWzUNb3f0EuH8I2Khs1r2Svk9Nzjgm2vT9A8AhiGlPYRfpB7I3VjJZbdkpqAuKre4TI9OX2aG5VliKivP7a7GLvsvV-0lQjGethVCQ8F

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/ Frame 489A 253 KB
163 KB 24ms
24ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce6ffd9385e6ad26e64ae1ce4c80a459ec27056878301c6b941c10f43b58e742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 297847
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 166404
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 18 Dec 2023 22:54:14 GMT
expires: Tue, 17 Dec 2024 22:54:14 GMT
last-modified: Fri, 05 May 2023 12:39:01 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 3482 0
0 125ms
63ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsu1QuGTEQnADXEhLGrtwXIoctQluKu17LVngdSD3ubV60678ADsa8NwqCAdW1AuRmfShKyct-Ok1AVmxKP_cdfJiPzK-1gLMK5uJiqL2zyZdFYHz44pKstJsUvDAO958kgQ7BGFOJpEuno7vBaRhilgvakGt-Pq3E4tiyLu7j9-wxM7rMDkpIJ8GOEaA2l30CwciYvjyqXXGB8VpNxshBXzJHcE&sai=AMfl-YRp2lVHWeiJoCiwh0jFmHvGUAcilLNrGpbK6Vnx8HoWcLkbTmV9JF9bZJu5PsPkvhdVxmVoK8RxK977_YLsTEuygoBSjmFGuAXXY5bqwzbQvBYNUi0IuziANWHvnTKrqFWi93NJDZZWmqov7hAPSDJazKw&sig=Cg0ArKJSzFuowHgLh_DmEAE&uach_m=%5BUACH%5D&cry=1&crd=aHR0cHM6Ly9jaXNjby5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=122&cbvp=1&cstd=121&cisv=r20231207.75094&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A69B 0
20 B 59ms
59ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B1aOjDVmFZdyoDc3UjuwP3JWJCAAAAAA4AeAEAg&bg=!trWltfrNAAY3kmNgF5I7ADQBe5WfOLFq72Rcc0BnichqU2OAmRxLnWga7QFaIlme-JVZx_MrjTTcxj6R1FWvty0FncP-AgAAAMVSAAAAAWgBB5kDRWQtSPS8U0T9STplMErCDNft-iPZq0AfhT6vAMQxsgrksFIqeJpR0-IJv5yf2SGznhuIJh53kgXKNlTONZpEKQPqerkW_n0eMlQubs1Ate65r7jf93pu-cS10za7YmNobOCESBDkZbyRj6_8-JPCfGDxyVrALWq1tNT9zYnbitnO7Gky7V3X6FdlVi5kQ2R_WScN2drRlJ35Y6Kg-p_YZ3s9zMzhu-N6O1WlHO8zqhostpCQGujj2E_oDkTZoClfuFmLmNZdROrDsA2OMXJCvyQgA_X3LnyKiBrXFXzddx2Q6PzPSghW7BzNzJUCauK7upKpr9nYnG-8xNq27cS-HOhQ8Tq_rKZKaTnnKPPdQTbYHzqX3-o2J1kfi64colcakmkYgKAFLVS81ViOlaJYVWjdpmlLiqwGOqM2ALy2LV0-W5dB14ZU-uqluK9Bi5M6XgEqvB1P_xelYWq8rAKudZj5OBGBYwNHyeE0uaE2nXyU6IFmoSdcLqL5t00ImfvcRqEC9l9_Sl7H685Z6jB6O2TmCyy1_U-3phsvJSg_hzr2t4r3CcjZ6S0YVqLYHRiWjB2k6r33dRX82REHuMZS6zDBdUD7bUB9q4J8g8D3WY1JIfKcVzQeOcgUywRYgvKgKfjY1Jt73YLfqFYFVw4MC3WJLQW8Iqi6uTXjnsF5jmb0qV852cfIFnlbDX2z68t9xNa7KaxzxKtap0kTJz8Syhqes1a3Kv71ayVu63qizptKSCvHpN5l7lQJsGXEc9yHbL0HnFgDuGx3JMNA5uIOG09ol-p2_OwAtw-yt6tTd7JHfLSdwuXp1pi5FsJsxW5KHa1WexmIrlKLJtOK66z7jKEpBVyrYT6JxyAsdA8T6MEP6fVp3zS6MQtmYvkmt8GnwpxByL53OiGdyRzLy0kTRXGT_z0ic0Xl5x5hXH0H1JRHO_QcXlZb3Kt9prT9G2rHpAPKImGU5-SpyOhcl6vXmrl8jkBtv_U_5kRBNLJqw-FX1lzYGUgbkwzXqa0A7IPLiKK5dugeitj-MyiKEqjc-MKfE6UlI1H0Qg04cIy2poLQePgxAMfQquDxN0iXhfdvPjteklh0DyPssGFY2rV-T_JRlEpeSA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 239C 42 B
108 B 80ms
80ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstyhppkeL4tvBx6K5tTGRI_8GfvsRYGZ3JZxzvjdJTZkerVkLEKbatllGv6BJOIdaJEZ-Xltp-FjMYOI2PP_CCnREsiYljYenJU9qZi4NbzNoFy77kGqWSHUEe5hxytulF1HVZWxsor2AV3oFSEcc9wEDNi&sai=AMfl-YRS-rIHx_J4Sc_FQoqOkSVPtZoK4gBB2MofiQZW1zCB30tz8OpH6Jw2PaA9VeQxDC4AMZ2YxFW1NffdP75EyusbZIF1HDPjrkL5ILy_nAuciQ11Kex5WOIcDDR4xvZic0HvzYcX9-m_OAPOhwun5w&sig=Cg0ArKJSzDShxMXI15jwEAE&cid=CAQSTwAvHhf_66AOzxdWdI8_viWB7S5j2j6-rkhavFG942dPjGAzFMnCqxn-p5XgnZBT14APD7bRN1aRsKyFAztQk9pLRUvFRZfSoYzXLnAytHUYAQ&id=lidar2&mcvt=1003&p=0,0,280,760&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2167923837&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237899607&rpt=1341&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 489A 73 KB
73 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24366c51064fc57cb419cc93db561f43bf3461affb1d04deb4d552a7e2ba4956

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 489A 71 KB
71 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dfe1f9ce8410e9cd1eb921153319aa98dd53d12a6e4fb0efca81ab345bda814

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 3482 0
0 62ms
62ms Fetch
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsu1QuGTEQnADXEhLGrtwXIoctQluKu17LVngdSD3ubV60678ADsa8NwqCAdW1AuRmfShKyct-Ok1AVmxKP_cdfJiPzK-1gLMK5uJiqL2zyZdFYHz44pKstJsUvDAO958kgQ7BGFOJpEuno7vBaRhilgvakGt-Pq3E4tiyLu7j9-wxM7rMDkpIJ8GOEaA2l30CwciYvjyqXXGB8VpNxshBXzJHcE&sai=AMfl-YRp2lVHWeiJoCiwh0jFmHvGUAcilLNrGpbK6Vnx8HoWcLkbTmV9JF9bZJu5PsPkvhdVxmVoK8RxK977_YLsTEuygoBSjmFGuAXXY5bqwzbQvBYNUi0IuziANWHvnTKrqFWi93NJDZZWmqov7hAPSDJazKw&sig=Cg0ArKJSzFuowHgLh_DmEAE&uach_m=%5BUACH%5D&cry=1&crd=aHR0cHM6Ly9jaXNjby5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=218&vt=11&dtpt=96&dett=3&cstd=121&cisv=r20231207.75094&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: painthy.com
URL: https://painthy.com/travel-insurance-online-in-2023/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 TI-SD-WAN-SASE-eBook.jpeg
s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/ Frame 489A 10 KB
10 KB 23ms
23ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/TI-SD-WAN-SASE-eBook.jpeg?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5466a707c7ff62c2a9b99f70ea18b2a8a4a3770ba84a8b76fa19985b310599bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 22:54:14 GMT
date: Mon, 18 Dec 2023 22:54:14 GMT
x-content-type-options: nosniff
age: 297848
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10391
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:39:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 LogoLockup_Vert_RGB_Midnight.png
s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/ Frame 489A 2 KB
2 KB 25ms
24ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/LogoLockup_Vert_RGB_Midnight.png?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26aac5d5d23042d6be1ff609d56d7088d6412199b5d1656adbbd4450a7cbc8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 22:54:14 GMT
date: Mon, 18 Dec 2023 22:54:14 GMT
x-content-type-options: nosniff
age: 297848
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2354
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:39:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 770ms
770ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwlisv,time:659,type:e,im:%7Bpci:%7Btdr:525%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:14,o:646,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B641~0%5D,as:%5B641~728.90%5D%7D%7D,%7Bsl:i,t:646,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B14~100%5D,as:%5B14~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:14,sis:424%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt22.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E48F 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BooePDVmFZdvpDNGC1PIPyMqZyA4AAAAAOAHgBAI&bg=!0tGl0Z7NAAY3kmNgF5I7ADQBe5WfOJuQzyjqUrBgpIRXqBTgKjUtEx2kdd4iLNlpsSaZb1mYbxYv0MgWi8alJSWcfbeyAgAAAMxSAAAAAmgBB5kDEjq_-ZqUOP-wTCViFO0OulH8M0PX0Z8VwASM1N9vqZl6iI8dg6YM-O9pfZ1s1D4vI6XMEX3wwkp1kqmZ5Pmufn2NptLg8lUnLOal8CW4llg_AE5UElJNSlIdbZGiGxepBjIzk1GI7kTjQfmFqGNlq29MAB7mFqC6Pbht4k8n2sJWTOyNdYC85ZQzl1YN7gYaaAX-FPbeO-OT7I_H6LUPviHHN52J8-7w9ZEC3X1wVs2u7bhaaCpyTVx9P56rzhKMNO-8xoesOXuArRmcMYNbZ5aLjzLLPDKMDJ8_KHlrUw_vz8CSVfK3h9iOry7aYufmByD7QbHwLgKTkLn0tEGjkGJ6jkvFKetaXTXkf_S_QB9ljXlVd0Nwl2bUTmJv074CUFQ-y48v7RBbfbhmyUXzmc_f2x4lZL_j5ZLbZhdTNLEN9NisehWb_U4K2u5ZtqI4FiArTwzfyaAnk2d9HmiMrfdN83jzxuzMt-RT_PQEwLGsAKbQ2HPOBLIW-vTkxS1Yh2bXoIbQk82snDzSVcj3bUTCl8kRD5f_kQz7A3M0HDRqNchhxH_QyVwjTDFsPBmu8rKNsRQEDv1CEeM-I049AGr_rGDb78yPU-Q1VdZgViGHYe__ymqb2PBZURRnnp15V5uHYfOvmTshDxPP3MJGDwEc1EAy6H4HWEFJz2ki5fchmT5y_sptlLf2tbybDhKeSucLnQ_8hhIDSmsvHcRL9L313fXlFwgR1fkgDgYjNQHWPTfs2luvnoNDWOXFI53bg9y1mkbHcFK4Qv9AbJ2YRgEyabYqW_3Ct1JX9zg8XSEXDK_q6quZmMTZoC0pBRva2RleXXxdRGSKYiDjiVU6d0evEH0yjXlcCA-EIhrEdaJJCkb3pIUNhM9HYFuRzP7LD4HmXxwfb1Z6caCBEUt6VHbg9tmxf7uA5TwNInNY0A-lTHIbEdp1rXfFFYK-akH_cnoO3Q9O5h7d1UP8KcpCr4rdCA48zFme2J8SN5VLoatJ9uLlfVWNMDmwP1G1kWi4ZnmAx1F5mwQnLLqONciYT8Jc7g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 753ms
752ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwlisN,pingTime:-10,time:632,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjEwOSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1703237901917%7C%7Ccf931b24841ce2528337326d6b176d24%7C%7Cf5ef61ca1e560a2377dfd6c236fd3eb9%7C%7Cb47dc675f1525ee2fb31ed9846d0ae95%7C%7C2c694f2de63591bc706512c9dddd8fc9%7C%7C2b9f79da258eae17ab77d0e32a7bcc9b%7C%7C51f18fdb4e9fc7970c6395765b5f943a%7C%7C68043555eb26b913244a758d3c81ed81%7C%7C1663701684,sca:%7Bspg:88457057-e4d8-9ffd-1318-194a20c3b365%7D%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt18.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 TI-SD-WAN-SASE-eBook.jpeg
s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/ Frame 489A 10 KB
10 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/TI-SD-WAN-SASE-eBook.jpeg?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5466a707c7ff62c2a9b99f70ea18b2a8a4a3770ba84a8b76fa19985b310599bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 22:54:14 GMT
date: Mon, 18 Dec 2023 22:54:14 GMT
x-content-type-options: nosniff
age: 297848
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10391
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:39:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 LogoLockup_Vert_RGB_Midnight.png
s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/ Frame 489A 2 KB
2 KB 24ms
23ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/LogoLockup_Vert_RGB_Midnight.png?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26aac5d5d23042d6be1ff609d56d7088d6412199b5d1656adbbd4450a7cbc8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10059731364915184130/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-SDWANSASEeBookv1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 22:54:14 GMT
date: Mon, 18 Dec 2023 22:54:14 GMT
x-content-type-options: nosniff
age: 297848
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2354
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:39:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4C70 42 B
64 B 58ms
58ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstEMOQ4UvZa4wsMn2suWM3o7oNrmMtc6hxgXNYfJUhIA_8LcpAGId_giGD87De2OMHJCYqu9FVUtd3uuWC_G9MBXi7mD9G09-SKLM2d_8UfeAEbv5YAihQyoPqipsis01gm2jA3Y-GglpdODw7CoqsIvdOX&sai=AMfl-YT2mFYbeE3G9EJzft2c2yl-2E8T41L_Sm7LCIY8-b9_Z4mGFjj2kbiofCbL1CnEEyWuYMYyJ3XZfy8gu_vFIYhi_7AsOPoyUWhNQwFb221K_Tn3yd1mKisQjhfaAAyVE6Dqh9pDn9fRMWBR03PYxQ&sig=Cg0ArKJSzPKS-qmIDVeFEAE&cid=CAQSTwAvHhf_o_bigzSXalo6xbGc2pfsSiUZntfirPK3RtahqL1EXg2RZly2MaNu64mlVm2l3Np7XEQFv4chl4gWH-jmjQQqQKzemMzmZzBOkJIYAQ&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3612231468&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237900850&rpt=536&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 352ms
352ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwlize,pingTime:-10,time:959,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjEwOSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1703237901917%7C%7Ccf931b24841ce2528337326d6b176d24%7C%7Cf5ef61ca1e560a2377dfd6c236fd3eb9%7C%7Cb47dc675f1525ee2fb31ed9846d0ae95%7C%7C2c694f2de63591bc706512c9dddd8fc9%7C%7C2b9f79da258eae17ab77d0e32a7bcc9b%7C%7C51f18fdb4e9fc7970c6395765b5f943a%7C%7C68043555eb26b913244a758d3c81ed81%7C%7C1663701684,sca:%7Bspg:88457057-e4d8-9ffd-1318-194a20c3b365%7D%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 262ms
261ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwliAD,pingTime:1,time:1118,type:p,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:46%7D,%7Bpiv:100,vs:i,r:,t:117%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:117,n:46,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~1,0~0%5D,as:%5B42~300.250%5D%7D%7D,%7Bsl:o,t:46,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B71~0%5D,as:%5B71~300.250%5D%7D%7D,%7Bsl:i,t:117,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:19,sis:165%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4C70 43 B
215 B 262ms
262ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1835641&asId=338b214c-9f2d-52fc-50ff-4fb44c85dc9f&tv=%7Bc:xwliAE,pingTime:1,time:1119,type:pf,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:46%7D,%7Bpiv:100,vs:i,r:,t:117%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:117,n:46,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~1,0~0%5D,as:%5B42~300.250%5D%7D%7D,%7Bsl:o,t:46,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B71~0%5D,as:%5B71~300.250%5D%7D%7D,%7Bsl:i,t:117,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161*.1835641-76875435%7C1611%7C1612%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2,idMap:161*,rmeas:1,rend:1,renddet:IMG.qs,siq:19,sis:165%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9779134835489781&output=html&h=250&slotname=6557565023&adk=3612231468&adf=3057537806&pi=t.ma~as.6557565023&w=325&fwrn=4&fwrnh=100&lmt=1703237899&rafmt=1&format=325x250&url=https%3A%2F%2Fpainthy.com%2Ftravel-insurance-online-in-2023%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703237899372&bpp=1&bdt=771&idt=268&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C760x280%2C760x190%2C760x190&nras=1&correlator=5850829227916&frm=20&pv=1&ga_vid=1657473427.1703237900&ga_sid=1703237900&ga_hid=551342891&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1045&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079980%2C95320885&oid=2&pvsid=4329896297552133&tmod=215552153&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&fsb=1&dtd=269
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
DATA 200
OK truncated
/ Frame DE38 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f814876c307388523387b961a2dc8d13c41a2eedeed1c4331523bb8d7adf46e3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 dysonfutura-book.woff
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame FFDC 8 KB
8 KB 23ms
23ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dysonfutura-book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 14:16:50 GMT
date: Mon, 18 Dec 2023 14:16:50 GMT
x-content-type-options: nosniff
age: 328892
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7928
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 69ms
69ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

40cc98fb27af14e5197e755c56ceb2266a7538913a2fe94eba03f91410ca1c9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F256 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e661e720ec69ffcabb7e549ae6900c24768df3c057ac7656ce0cb1ed1909a236

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 113ms
112ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwliFE,time:1357,type:e,im:%7BpLoad:1317%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1357,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1352~0%5D,as:%5B1335~0.0,17~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:1250,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a121%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2%7C1b3,idMap:191*,rmeas:1,rend:0,renddet:svg.us,siq:18,sis:253%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3482 42 B
64 B 60ms
59ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssxzyTJlw1ZHUyCtXLre0geREzJ7cloN-RBFM_dhErtwOulT96Pw7QEnqKLTuiasDkB8LdC-xIAYudvcbQ6ZA01qQH8-6QkcEHRdJqCPlTqzSJaA_uN06MZQtlw3cehD8Urxzj-4Nv6yo0wRiYFyBpnz3uS&sai=AMfl-YSiDQk7joJ9SX9W3esM_AlX3mhPhsrwm4PlJbkPto8h3_JjviOtt51ABVt14F1Ytd3gI3uWf5j5GtcfBamlYX-AhERHeaGFddBuk4_W9LQeKrf4QYtTBLSEh3dC0_6ZL7LuzyBjAr1-jqZl2LzK4Q&sig=Cg0ArKJSzHxMsj_NvalOEAE&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&id=lidar2&mcvt=1008&p=0,0,90,728&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237900697&rpt=1154&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dysonfutura-book.woff
s0.2mdn.net/sadbundle/17864851622750576224/assets/ Frame 3B4E 8 KB
8 KB 23ms
23ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17864851622750576224/assets/dysonfutura-book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17864851622750576224/css/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 17 Dec 2024 14:16:50 GMT
date: Mon, 18 Dec 2023 14:16:50 GMT
x-content-type-options: nosniff
age: 328892
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7928
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 22 Dec 2023 09:38:22 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BEF3 13 KB
5 KB 22ms
21ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 45394
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Dec 2023 21:01:48 GMT
expires: Fri, 20 Dec 2024 21:01:48 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2A4F 829 B
996 B 35ms
34ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8644835a3015e2eded895105b716d421a6162c308bfb19d253e022f391058ef0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LtFLrVgJw5maHpCxfwkubg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://painthy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-LtFLrVgJw5maHpCxfwkubg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 22 Dec 2023 09:38:22 GMT
expires: Fri, 22 Dec 2023 09:38:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame BEF3 39 KB
15 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 13:10:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73662
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 13:10:41 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2A4F 0
0 56ms
56ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231207&jk=4329896297552133&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DE38 43 B
215 B 114ms
114ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=39e86ddc-4c62-47ba-3160-b597aedaae7b&tv=%7Bc:xwliJb,time:1576,type:e,im:%7Bpci:%7Btdr:1505%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:1576,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1571~0%5D,as:%5B1335~0.0,236~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:117,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C1612%7C1613%7C17%7C1811%7C1812%7C191*.1627455-73523888%7C1911%7C1912%7C1913%7C1a1.1627455-73523888%7C1a11%7C1a121%7C1a13%7C1a14%7C1b.1474271-76103299%7C1b1%7C1b2%7C1b3,idMap:191*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:18,sis:253%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BEF3 0
12 B 21ms
21ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?vNa-bA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 09:38:23 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 115ms
113ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwliJP,pingTime:1,time:1733,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:13%7D,%7Bpiv:100,vs:i,r:,t:646%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1087,o:646,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B641~0%5D,as:%5B641~728.90%5D%7D%7D,%7Bsl:i,t:646,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1087~100%5D,as:%5B1087~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:909,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:14,sis:424%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3482 43 B
215 B 116ms
114ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=7534f3dc-bcfe-b38e-7138-8aefa1c80512&tv=%7Bc:xwliJQ,pingTime:1,time:1734,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:13%7D,%7Bpiv:100,vs:i,r:,t:646%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1088,o:646,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B641~0%5D,as:%5B641~728.90%5D%7D%7D,%7Bsl:i,t:646,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1088~100%5D,as:%5B1088~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:909,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1a1.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1a14%7C1b*.1474271-76103299%7C1b1,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:14,sis:424%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F256 43 B
215 B 114ms
114ms Image
image/gif 2600:1f18:1aca:4282:f6ab:e265:5899:7930
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=88457057-e4d8-9ffd-1318-194a20c3b365&tv=%7Bc:xwliN8,time:2068,type:e,im:%7Bpci:%7Btdr:2005%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:2068,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:26,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2062~0%5D,as:%5B1600~0.0,462~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:917,fm:tZ9WEIG+11%7C12%7C131%7C141%7C151%7C161.1835641-76875435%7C1611%7C17%7C1811%7C1812%7C191.1627455-73523888%7C1911%7C1a1*.1627455-73523888%7C1a11%7C1a12%7C1a13%7C1b.1474271-76103299%7C1b1,idMap:1a1*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:26,sis:314%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f6ab:e265:5899:7930 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 60ms
59ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231207&jk=4329896297552133&bg=!6-il6KfNAAY3kmNgF5I7ADQBe5WfOEFjmZORvItAyDGpPKefhIdada3G3WVNppQrickmeafiSIllKHS9YjYQs7QxP2GdAgAAAERSAAAAAmgBB5kC44dZjvnVWIF-cSM3TUhilQwkMGso5oNEUrNapmx8_GM5J7jPWiDxaNgpzyr1b9KCqaZEDjtLoKaVBCexnPiWULlyx2BWYL9Tugq1859RkKOvanITErgsLwgY5HpC_hi5PBYeCtJEOW6Bab1F657PRQhEhj010xeGR5_oquvKVayC4pmbMAp_T-OG1TquC-6DNvN3sdbsp_MlKjvjcBwxHBexPxQVfygjVpVnEpdxTO55nrpF78HSCxzhv84IoBKqN-4PWj3UQkWv54ed5bY4fYBL1KZiUyWNPSG8UZ4Z6Dk_N_H6SnrINbRbryEtGtIyTL60bKS2L7-gvjXF1dSgU6AMir9x662JTsjVsPK2SNjsXStBWsYagLtI1Qy1HRvQcYwT7td8VW2VNbO43rn8RQzbMY-0ubgw83Ho3Aj8EWlTVh-V_vyJegk5svyGSVyIX8Jgi7FPgeznt_NkrUesjzgfiHjPMxVS-9RsmdrWFwnk1a7p2_zLO33hdnzriJFA8Gf8SJIOQjmo18dff13u6OB34IvIJOnIEFvMRnCDvPw7IU9Fk8wag4lTztYSVI2QUH7dcSMM-939-wubk726E96_K4t0MCZtsi4J83c6YFWWboEZ9QlHHIqWkjSqg3WqgU9Sr83ldyeTykCsbTKl2qOFaWj04U5pcSGfU8QX3SikHAuCIDfBdeP6Y6zYj20_PDYMsCZUkDIUQX_3u9IEOZy_uop5YahD2TCjpkhSyvRamaKOluEPJjfzWe8XZhvRpXa8_Nv9Oudrg5QluGf8RcpJPDFTkZwzZsfpoS3FqCaNCe73fAHnlpUkutXclcQnhGtI9Di_ZKoJIZ-tbAcdoDs149lAhi74wCX3tpvpUpZpAPvrRsuYsmvQK1EYGfrSwKapbdQ5HMWtwyTzPOjwHmPA9JQbzbKE2WNAnmljv_BylLBZlZ_cIfevwSZyo5AvKkfnON_Je_aGjCZq5FIz4gFg9Lk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://painthy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C70 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6596687120919&version=m202309260101&ct=76&x=1&cor=14279165556893465000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE38 0
20 B 58ms
58ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1088679612356&version=m202309260101&ct=76&x=1&cor=18019719485378800000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3482 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=842215393238&version=m202309260101&ct=76&x=1&cor=15362904573536743000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F256 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6915458898263&version=m202309260101&ct=76&x=1&cor=15260519776414052000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DE38 42 B
64 B 61ms
61ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1D004dnDCtzvfxBkKY5iD2iww4Ey6dFceIlwr7fW9QHJake7XzWqbHTitP3Osou3rho0m67ZY8v2ocANvkE6VsWatK8Fqz3_InPUzDtP7n_ENtxW9wtEnh6Jp0wojSp1XZVa6uogoTmuJvXklv0P0P34t&sai=AMfl-YRS-EzQT1b7QoZelqxJrJY4zZKvQWgQSnvJQ2UtGm7TY4Vnj9u_kxu1_fSCoE-WdhJ9W_tmkzIEQ8I2IDSsZzwe0XFBqM9-fQLowLVMR9f7Bn0Tbup4kRRfQ649uQQ-OqdY2Y1id67b6tQZnuhm-Q&sig=Cg0ArKJSzFawbrX4gxdLEAE&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&id=lidar2&mcvt=1030&p=0,0,600,160&mtos=1030,1030,1030,1030,1030&tos=1030,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237900787&rpt=581&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F256 42 B
64 B 61ms
60ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuJoSxt4GmR0I2FaG3oN5_NsWW9nVv1JSQltW_r2M2DYI4LOcLFV94lPb6JQaDoB7YxMtl5NO-u71stL6WFezd49PkztayVmd5Sqhd2PZFFMz_E-ul8MPW40RMJzAqGPyI7QuYlfUuSJsqJh4WJqM26JayN&sai=AMfl-YSkZ1LJjyyDUUoKmt-WDIJf84nTaFV1i42E3wUh0s0UeGTqfGucL7rFGvN-ciCS0AYwntE9IMaj7CYNw8ngZqRLZ8q_pxMuZCK1N76NUWMagVNIe6xzDsRIdfNmg93RGMmRQL7lkHKzf_ER9ZumAg&sig=Cg0ArKJSzOrwdzhWGo6-EAE&cid=CAQSTwAvHhf_eIlT520hOmBfN9T_1G8Dp47hRxpnZEvzPp8Pqr4_MmxOex6KQ3hy4vf7SzeulE95VqyNPOPQR_eQB9LjlMKM4FeADNaZeOJW9SwYAQ&id=lidar2&mcvt=1017&p=0,0,600,160&mtos=1017,1017,1017,1017,1017&tos=1017,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703237900804&rpt=374&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Dec 2023 09:38:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEA8yDaIwAz6cDrPFVk-rlwc&google_cver=1

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID

Verdicts & Comments Add Verdict or Comment

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
painthy.com/	1970-01-21 01:52:53	Name: cookieyes-consent Value: consentid:TklYT25wSEdEUzBhaFRVYWRKWHh3NDNjbTh2RGs2N0Q,consent:no,action:,necessary:yes,functional:no,analytics:no,performance:no,advertisement:no
.painthy.com/	1970-01-21 02:28:53	Name: __gads Value: ID=efe3db69d681e728:T=1703237899:RT=1703237899:S=ALNI_MbCc1QbxrDCTbXDrU8XTAXegyE9jQ
.painthy.com/	1970-01-21 02:28:53	Name: __gpi Value: UID=00000d25a872550e:T=1703237899:RT=1703237899:S=ALNI_MbVasJ8QOi1xImSyhqBka_VVJ4ItA
.doubleclick.net/	1970-01-21 02:28:53	Name: IDE Value: AHWqTUmwZzb7MJh4YhlWeT6F1hi7PCzk7AFl7amjTgUE-_PwV04Wk47-dNjQ8IRKDuY
.doubleclick.net/	1970-01-20 21:26:29	Name: APC Value: AfxxVi525yAusjL0EKyCvUGBL3maVtHIMdYbecSxQrCUBuX0R7wbJw
.adnxs.com/	1970-01-21 02:43:17	Name: XANDR_PANID Value: hepbGNm2wV-pW_WycxMeEmQW9F9ztye3nYNSw1gBVhKB0XIVQipSp562IJTLdTUeyjqJhcDsRCjlh4UKStYq1pQ_-FEE248DV8DL8iNw0hs.
.adnxs.com/	1970-01-20 19:16:53	Name: uuid2 Value: 5395262509086037004
.doubleclick.net/	1970-01-20 17:07:21	Name: DSID Value: NO_DATA
.adnxs.com/	1970-01-20 19:16:53	Name: anj Value: dTM7k!M41.D>6NRF']wIg2C'$fk9>F!]tbPl1M>e)ZlrFUfJ+tGXxomRcuFZIeNFIG<f]9I1p=)T'iP0^xDhX[KG06bpRzqF1`b`8j5]%S
.googleadservices.com/	1970-01-20 19:16:53	Name: ar_debug Value: 1
.casalemedia.com/	1970-01-20 19:16:53	Name: CMPS Value: 3316
.casalemedia.com/	1970-01-21 01:52:53	Name: CMID Value: ZYVZDZmaR6fgqmQgRY9Q8QAA
.casalemedia.com/	1970-01-20 19:16:53	Name: CMPRO Value: 3205

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEA8yDaIwAz6cDrPFVk-rlwc&google_cver=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
bid.g.doubleclick.net
cdnjs.cloudflare.com
cm.g.doubleclick.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
painthy.com
pixel.wp.com
rtb-csync.smartadserver.com
s.w.org
s0.2mdn.net
static.adsafeprotected.com
stats.wp.com
sync.search.spotxchange.com
sync.teads.tv
tpc.googlesyndication.com
ups.analytics.yahoo.com
us-u.openx.net
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
sync.search.spotxchange.com
104.18.36.155
142.250.184.194
142.250.185.66
142.250.185.70
142.250.186.98
192.0.76.3
192.0.77.48
2.16.97.41
2600:1f18:1aca:4282:f6ab:e265:5899:7930
2600:9000:211e:da00:8:48e:53c0:93a1
2606:4700::6811:190e
2a00:1450:4001:802::2004
2a00:1450:4001:80e::2003
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2001
2a00:1450:4001:827::2002
2a00:1450:4001:828::200a
2a00:1450:4001:82a::2006
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2002
3.75.62.37
34.251.137.37
35.244.159.8
37.252.172.123
45.130.41.84
64.233.184.156
91.134.110.137
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
059e257950a33b11fdbbd77009f3e90e7e69a4e3c3cb0d694e847ba3d59116e6
09b556c6f2f0f263e5445d5a5ce916c4b596aba88259e2675c7ab0c79890b140
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0dfe1f9ce8410e9cd1eb921153319aa98dd53d12a6e4fb0efca81ab345bda814
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
12ff2ec39651e02b34ee26ae91b66614f3b981e5b8db58feb16115c2b6b201f0
14a88cd6c4eb65f2c578d0837dfb685f9e13ed0922ea6e330a6ca9b049c7135e
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
16bd4f8cc85c694b70ca290fd071101d246279844894c414e95d2227dad653a2
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a0de65d1dff32e4651c3da80ed0bdc2cb5116a6ccd6e59a11e63fced2ed7acb
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
21887c5b83211b384496919a3ede8fc99cd6d6bab068bd714b00eb05cec0c056
23a4c8aea33bd9eea731a9d0e87b50d55fe312110213eea872ba5840d7588675
24366c51064fc57cb419cc93db561f43bf3461affb1d04deb4d552a7e2ba4956
25fdc7a17a7b3884e86c6f6b72b60288025980e5bcfff6b736f077902c1697ef
263403e6cea55abd488e73b1a3ed6fac18d6b3136572570953b3392504715123
26aac5d5d23042d6be1ff609d56d7088d6412199b5d1656adbbd4450a7cbc8ee
27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4
27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b
2c55dea800c7c131d9f3e3ac8a411abf3ca2b4fa836a7376aba3e99c43a621ba
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e120707b7a0de913a32da3e779b975bd342672ca68c9aa373029f38c90cfb56
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
324af09d936cd80a9dc4019a0b0487eb2092fbe6880cab6f2ed4fa2977072bf8
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b
38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642
39ec8eb79e4ad39dcf3587139328fcc3f496ec7e57bebbe1de95f66d41e4c49b
3bbbd3ceb6cbf0495b4d9fe60b57a782a5fbe36ce7afa4b392932bf376895c81
3d66ba6bc03128cc3ce96e393fc2b3f7c8bd2e73af8258ae6d6a5e6f2efb9848
40cc98fb27af14e5197e755c56ceb2266a7538913a2fe94eba03f91410ca1c9d
41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10
41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
5012947c0bf9727931413f3d4dac33adf9f71e8a318630ae0d90a47ae7c302ca
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
540aca79a214cb7275bb0745228ceb99da4b23c6059c954122e77c5ee2d5b26d
5466a707c7ff62c2a9b99f70ea18b2a8a4a3770ba84a8b76fa19985b310599bb
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43
566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a
566165820cb347905665472e5e57227f1a034c64299787686311ffa124d9082b
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5f1e32ac04df840c57d868c90453cf2e0cf6bdb178fc3832ee894713f932151f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
69886f9d2ea8e9e70cc316ba6c0cc4c65e86ef277a2fc3822897dfacccbc4026
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a
6c38dc17dbebb7e00014f3ea1025d5bb245baff733b50069eff5403b5dfaeeb8
6dee119ee49ab8771cf531190b1b186a092c709f799baf9ab566a3ca9778ea0b
712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca
714283149e025e488aa69bf74f407a2a348d71cc720f6856b3c1f9c7386fac01
7716d48bf0a1208302e8d570aee3e690e691fe175718a0ba3feccca95db29910
7787cbd48bce95bc4f53463c52f861ed80a912c3045b168c5aac679570321137
79caa1e63e147570f8cf571ceced748d8273b3cdfc6ea191f98f751c4778b42c
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8644835a3015e2eded895105b716d421a6162c308bfb19d253e022f391058ef0
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579
8f94cdf171f0d2852724afdf3e881daa15ea06c5b5de964d8e1096c5d8e8761a
9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5
9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a02263cf75c29f80fdb1b381769cd5ba8d13287b4c370eacb3bbd6df56a92912
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b
aaadde89b0db2f97f270379b4762e025c85a1a4d8a4c9ae2421ab48198cc3ae6
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ad386e83074906780dfa1feec2070ff6e11f15c07953ac3d8431300ae0ba175b
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b94fc1694c78a4372c6e2aa67654f88852dab05934ffbd06b07074b2d095161d
ba0a31207b277dc3f8c06928bec5a1f85f278a1b5f3efef1bb5a3f5e109e1858
ba35c06ed24c29d7b8057ec377228f0804fa8d0ff7256149975f02a483cfb4e8
c0a71ca2c2b80121a9db00dd745294b6a10f3904add5781197d3f6db69e4a574
c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682
c42289cfcff6130c6ba4ced9d20fd8a7934b83c319a9f7f328d257957f6e0c25
c7b61a975a191484f4e516677b6af322da437bbb71a15d7e46a4c650429af983
c7ba24a003dd63b7c43ae72de4071e5a77040e9fbd6573ebb8bdb8d5d68b6997
c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf
c883ef096af0d17835d6efe8698339884088b137e82c62febe290bbcafc2382a
c88b45fbea9fffd91d7dc5d44d9973a00b1d5b326eab6a8092b796e2bfad22bd
ca212a6d45038b16f7e2ee85414d0f67362985095eac9dc26a34e96d1ea529b5
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1
ce6ffd9385e6ad26e64ae1ce4c80a459ec27056878301c6b941c10f43b58e742
ceee574841dd9f8ff1f1d23a93e3115a2c6b0392f804f3c6b35fd6c53d754073
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d32bca53e7da6924a748ddf98feb0964c0b2b2c84b53da67840c82bf27c9ae2b
d6bd9bec24e304c7e1da425e52179d00e0b3da704014724d0bfb49a76be30cfb
d74871f1d66e7c0230449ab708d05f088e33d578275cfbc2e0d95529b689cfcd
d9ce958515e4c42199afa5f6f985d7038047c2ca5821147d68fe3604b138e5aa
db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d
dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b
dc94b334bdbade3c6e278dcb6568556f0ce413d97a49d046e94a67f56472f0ff
de63bf5ecaf8695bae42a604e9808a63c55b0d62bdb3b4462c1530950772fc27
df5c5714b3dfce783a2610ce20c6c76937dbaac7fa9e8d8255e96ff6d1e52020
e24e46459c7d6e73401ab03d015d9819826b4d7e01d5dacb37c0264ebf8f069a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b26a16f681d7081d0560b5cdef298914d55e8a4eaaab30020cb41c8a41c6e
e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9
e661e720ec69ffcabb7e549ae6900c24768df3c057ac7656ce0cb1ed1909a236
e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c5ba798692f9d05754b789f60f8cbd27bbbaee87f4a0469f2f668ede1c5732
f278bf82a64ac1a5ae8f69e06890047a914b3d0100bf856aabd758d2e15edf36
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f51adeaf2fb7ad0273ed1d9d4a0cd2472e9618db8929451c18327c6593d2b9b7
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f814876c307388523387b961a2dc8d13c41a2eedeed1c4331523bb8d7adf46e3
f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390
fc54199f625840bd1cb1b08713311057fbd0efb76c61889bd5b6ed1c9693df16
fd99a285d81a12f549b741db9604416a669e2ee8accf00cd40c0b0344e9ba63f
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

painthy.com Open in urlscan Pro 45.130.41.84 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

289 Requests

94 %HTTPS

44 %IPv6

20 Domains

29 Subdomains

28 IPs

6 Countries

4792 kBTransfer

11328 kBSize

13 Cookies

41 Outgoing links

Redirected requests

289 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

painthy.com Open in urlscan Pro
45.130.41.84 Public Scan

Screenshot
Live screenshot

Full Image

289
Requests

94 %
HTTPS

44 %
IPv6

20
Domains

29
Subdomains

28
IPs

6
Countries

4792 kB
Transfer

11328 kB
Size

13
Cookies

289 HTTP transactions
10 data transactions