zvonil.octo.net Open in urlscan Pro
104.21.234.133 Public Scan

Software

sffe /

Resource Hash

3f9015c499bd1271c846320ce7319c22a88caa022a240e8c9b2cc62d3a4361a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26983
x-xss-protection: 0
server: sffe
etag: "1097 / 880 of 1000 / last-modified: 1641807575"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 10 Jan 2022 16:52:02 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 224ms
75ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21c8f4f8849131c32459c19ebed46e58a02ee252d009cfdca796361cda8704df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51788
x-xss-protection: 0
server: cafe
etag: 16584961864834099405
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Jan 2022 16:52:02 GMT

GET
H3 200 pubads_impl_2022010407.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
118 KB 89ms
44ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4d964d6d34df7fde3554039d33b468b74afee14d6526a87b926688f0fc8d93c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120967
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 16:13:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 10 Jan 2022 16:52:02 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
122 B 90ms
46ms XHR
application/json 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ceaa931aee8fff06c481db02405b0d173cd680ccb22d7d6a3c9ea49c5b7cef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97
x-xss-protection: 0
expires: Mon, 10 Jan 2022 16:52:02 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/ 276 KB
99 KB 117ms
70ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvonil.octo.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f90b1d6f886480f7a961aa071ac28fc98a8a7347812f0acd5b2d3c7a51215b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101734
x-xss-protection: 0
server: cafe
etag: 6338342865683808284
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 10 Jan 2022 16:52:02 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220104/r20190131/ Frame 8C56 11 KB
5 KB 123ms
36ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220104/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73271f83e0d89e09da51434a964dde15ced7b91331f3b96357eb05ee81a85567

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 16:07:57 GMT
expires: Mon, 24 Jan 2022 16:07:57 GMT
content-type: text/html; charset=UTF-8
etag: 2196020943555189384
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4873
x-xss-protection: 0
age: 2645
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 135ms
49ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 134ms
47ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
12 KB 914ms
914ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2055215971416315&correlator=3982989329298092&output=ldjh&impl=fifs&eid=44752540&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_top&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1641833522&dt=1641833522698&dlt=1641833522209&idt=468&frm=20&biw=1600&bih=1200&oid=2&adxs=277&adys=193&adks=4116272111&ucis=1&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=760x-1&msz=728x-1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=false&fws=4&ohw=760&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d82c7499993492667200bdf8b0be96b2e9b42280740bd415c1cf908ade052085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12096
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 903ms
903ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2055215971416315&correlator=3982989329298092&output=ldjh&impl=fifs&eid=44752540&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_side_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1641833522&dt=1641833522702&dlt=1641833522209&idt=468&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=541&adks=1556906017&ucis=2&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=false&fws=4&ohw=300&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

990f7d0a63f5c91acb989ea1eba1bba7ddd2d404825a88c0ab8af9807f055de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9421
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 21 KB
10 KB 871ms
871ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2055215971416315&correlator=3982989329298092&output=ldjh&impl=fifs&eid=44752540&vrg=2022010407&ptt=17&sc=1&sfv=1-0-38&ecs=20220110&iu_parts=209694548%2Czvonki_side_300x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cookie_enabled=1&bc=31&abxe=1&lmt=1641833522&dt=1641833522703&dlt=1641833522209&idt=468&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=1914&adks=3260532487&ucis=3&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fzvonil.octo.net%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=false&fws=4&ohw=300&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

960ef662669219bdd4adcf1e65c1fff595731f2e24e35f161ba8211c7e4353af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9972
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvonil.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012111011823000/ Frame 8DF3 189 KB
55 KB 166ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 12602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55592
x-xss-protection: 0
server: sffe
date: Mon, 10 Jan 2022 13:22:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "11dee2040f5fc1d7"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Jan 2023 13:22:03 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8DF3 13 KB
5 KB 228ms
101ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 12602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4992
x-xss-protection: 0
server: sffe
date: Mon, 10 Jan 2022 13:22:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "858600ba27ef7413"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Jan 2023 13:22:03 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8DF3 89 KB
28 KB 232ms
104ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 12602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28555
x-xss-protection: 0
server: sffe
date: Mon, 10 Jan 2022 13:22:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a64e482645fd262b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Jan 2023 13:22:03 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8DF3 5 KB
2 KB 251ms
123ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 12602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1731
x-xss-protection: 0
server: sffe
date: Mon, 10 Jan 2022 13:22:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "cb4f0e89d7d37d9b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Jan 2023 13:22:03 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8DF3 40 KB
13 KB 252ms
124ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 12602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12826
x-xss-protection: 0
server: sffe
date: Mon, 10 Jan 2022 13:22:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0f988502fa2967b0"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 10 Jan 2023 13:22:03 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8DF3 3 KB
1 KB 131ms
46ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 15:55:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 10 Jan 2022 16:52:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Jan 2022 16:52:05 GMT

GET
H2 200 container.html Show response
ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DE81 6 KB
4 KB 143ms
44ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 10 Jan 2022 16:52:05 GMT
expires: Tue, 10 Jan 2023 16:52:05 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7740 6 KB
3 KB 142ms
45ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022010407.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 10 Jan 2022 16:52:05 GMT
expires: Tue, 10 Jan 2023 16:52:05 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ru.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 8DF3 3 KB
3 KB 123ms
40ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ru.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fed2d61088cba54be39b2069add7103160e31f07c950c0e2e7706d6d6dc9ebf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 05:59:37 GMT
x-content-type-options: nosniff
server: cafe
age: 39148
etag: 6726277462267614359
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3041
x-xss-protection: 0
expires: Tue, 11 Jan 2022 05:59:37 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 8DF3 344 B
807 B 122ms
39ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 06:46:14 GMT
x-content-type-options: nosniff
server: cafe
age: 36351
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Tue, 11 Jan 2022 06:46:14 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8DF3 0
0 78ms
78ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CVFCTMmTcYb3WLcG4gAfqvLLoB7rWpdNn_Z23k9ENkJLJ48IBEAEgxLTaOWCV4pCCoAegAaaCjO4CyAEJqQLGaKY7twGzPuACAKgDAcgDCqoE6QFP0OaHjbZZeaHCLQbqRTAlkDzbF07KVUqeMsdUSR-OZPV7g3qhP4blfY2BsYqgz2H5ASGYDhtLMyANSXyaonmRVYeEq-czDl-mrZRnExFnC-DadCV0pqGF5BJijmwhj_w442kBMsCZ72i1YpuAqhYx8VdbOvpvDcCVw3xLhcKfnxJjnK2NzUX42s9UqwR5lNfGs_-nrwnZ6EAeBByUToeYrFL24pddlf0Mo-6ehCKqgwPvLCyiiUFWPq04t2DXgx5ev24gx3sHJF5c4b5GVBYNwXNJuWnIunRDc8nO5Tb1rogMqrTsIcqB3MAE0KGz8McD4AQBkgUECAQYAZIFBAgFGASgBi6AB8L985EBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQ1P8J0ggJCIjhgBAQARgdgAoByAsBuBOIJ9gTDYgUA9AVAYAXAbIXHgocCAASFHB1Yi0yMzIwODQ4NTA4MDExNjA2GMSaKw&sigh=usBtyr6YFMg&uach_m=[UACH]&template_id=5000&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by: Host: zvonil.octo.net
URL: https://zvonil.octo.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s07-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 212 B
643 B 133ms
47ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=zvonil.octo.net&callback=_gfp_s_&client=ca-pub-2979533909392588&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvonil.octo.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

17a3feed32b9bf5ec3efa8eb8d4018268f6ce52cccf579e6d458bb0b5e8e6051

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 198
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 97ms
51ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FFB4 10 KB
5 KB 648ms
603ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522544&bpp=3&bdt=334&idt=2911&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&correlator=4546408942356&frm=20&pv=2&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MRshbHzpLB&p=https%3A//zvonil.octo.net&dtd=2926

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

431fdad54909614cc8d46870335d78b064438b27ea7db1ed389ab62986112059

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 16:52:06 GMT
server: cafe
content-length: 5122
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C9CA 25 KB
11 KB 644ms
605ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522547&bpp=1&bdt=337&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sBlaXXPKAg&p=https%3A//zvonil.octo.net&dtd=2929

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a953f47709e7923d6809c5c8b6ed054c6a6d879f307295e429bdb5820549488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 16:52:06 GMT
server: cafe
content-length: 11454
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 43C8 25 KB
11 KB 357ms
323ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641833525&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522548&bpp=1&bdt=339&idt=2930&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=Bf1oAm9rOe&p=https%3A//zvonil.octo.net&dtd=2933

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dcac42b9b2427f82e945f4078312e077082e526af2665ea660bbb86f888efd1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 10 Jan 2022 16:52:05 GMT
server: cafe
content-length: 11463
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/6655187706016649019/ Frame 8DF3 6 KB
6 KB 67ms
42ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6655187706016649019/downsize_200k_v1?w=195&h=102

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78554787beb8df10631d25f9b7639a38a7ceec911c9c27910b3dda59195e899b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 10:03:02 GMT
x-content-type-options: nosniff
age: 456543
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5724
x-xss-protection: 0
last-modified: Tue, 30 Mar 2021 13:24:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 05 Jan 2023 10:03:02 GMT

GET
DATA 200
OK truncated
/ Frame 8DF3 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 016c2c0accbbe81c1f60a0f1e04ef069a58be9c70dcf46cc2703906a8acf5325

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 8DF3 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 00c57a5af4b4c9aa090273458b3202fc99c6c8917714f1f33d2b92d943ca5fde

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 95ms
48ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvonil.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9C2B 0
16 B 52ms
45ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&adk=1812271804&adf=3025194257&lmt=1641833525&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fzvonil.octo.net%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522556&bpp=1&bdt=347&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90%2C300x250&nras=1&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=2952

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 10 Jan 2022 16:52:05 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 8DF3 21 KB
21 KB 161ms
78ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://zvonil.octo.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 10:56:24 GMT
x-content-type-options: nosniff
age: 539741
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 04 Jan 2023 10:56:24 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 8DF3 21 KB
22 KB 123ms
40ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://zvonil.octo.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 20:07:29 GMT
x-content-type-options: nosniff
age: 506676
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 04 Jan 2023 20:07:29 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 91BA 624 B
297 B 50ms
49ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiFs9e9ATAB&v=APEucNUneSEe7xVPVAQM0jcLr10pPTv3qcWsCdZTO4m_Tkj2Otxz_5bq-jycmiwX6tJ11LA5JPYcaLV7dfdRi_Bj5oOa96Nb3uJBBdgn_YPvq4DIjKW1vRCBAelPQo-jwH5OpNJjfW8h6Rgpay0-0y9mUOsPYco5yONsLO4QyuKggp71M_dL8PA

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 10 Jan 2022 16:52:05 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DE81 74 KB
30 KB 100ms
99ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D7kJIoCajZOEvjFuyW6l9Nfs6PXHzLMoItPrmUQGJvBwysxhliY1KUqEnVUQtRgrteW9NU8YqXZ5db6uunLx3saipprHKn02k8SKjltzd-9gbID7KU5bQ66zztYDEvB1KZ3yuo_XpD2nMjTrh1052UzZpsqw&dbm_d=AKAmf-D8qlqAwUXe_uJAZHAbWGpOBfxIvVAvN2PdtIGe4B80XhDXIilR-DOBXPfP6WZmv-Oy9VXoj9AU_DvzAPAv8L8bLBsLW7NG0JCQujEJ4bAP49VlCcOgaMv2RzRbDuXDUdrip532YVFr1L9QLyR0dEQRSFWB6HPgulcDfp8mS2YzB851O8uymDIRa48v3ZMQyKkKA9273M3fvc9NLaHMu60JN_6_tO_N3ojfpxM9j4ROzYOy6SnPNgtNBpqsogwrBtAVrM8FZrqlJU9VQNf_q2TPPbtSW27t4C2FEoZXhGV-a7dl5Eb4AXXnjy6Fmd_iLrkNas2C9-s5waiEXIycHxbv6q90NIJOfc-Cc95CLTB6CXM4SwdMdN85vTDKak_EupjD0vlBNlJ5Jy5dZ7zdfAANM7X3mCz81XEcZnhzb29VPBDU_e10B7LOZeEjZ4wU2Dj5Qq2I2l8jWbB9LdZQ8aXzCL_abINasqTDLey0tx_TSURuY6cFYFXf8X3F47zAsILgmu8_i6nqdrpMU1SNYVS-S-V-pjLOJVKrCXWH9lmSrW1jTQ6Ll7SGGq0U_Z5CVQDSgQfx7lCFSf7XU3unweJGyTb0clgpN0dfGlD1PLDPeaGVNOQTVUu-xw5UCCg_OqCAQbPjuzlzdbkjetkqC-kVukuos7v2GE5e5MLvYjuwgpioOUQFVw5uJsLGQu_ZzlyWTk3TGmJzFctOsuQYEAqnuppqYt8oGxVmbg-JNMeqdUu2RzVufdUM9l6kDbNzC1ZwW4-GhVMU0miqmdiWmMy2goQiyN25IqujSg6iYMMV92YhTuYWtEeFXNWLgZ_2QWjVQbxR4Agk5XRuQmhkJISqakBLu0O3YygYxTecUSHgIoWo3sGaZAWkyGzyElu8KVHM6PXigesARtdUDn7GVrBf1gOaWkNG-9UUpz2RXYmDcexUPA8_8rNHm4fTNQnUGDgxSjsFmshN06XHAQiS8VZddjmtknS_GaoRCu6Q1RBURMufFVRBBUYuc5WyHwOzQJHHddl3ksTP7A4FTrDZKTd1peQJrTelmvNZzhtfeQ-Zzr9TpuI2oVO6q5US4JZlmgPxTzOcNAucpae3QYmNE7H3g4n0uZEZEQcHUuPeYllRPIdJ3kMlxdh-ZzRnhQsC-6zLjShE6kxIKXS7y0_OEUocg8RYBJiEr48sbr73hT-Yl7mAjQ_A02hi13Dju2_sh3-xWPUk0k2R701mLJ8mPYghckoVd6gS_2Bz0hjfhyzabSGyyp9t_8BLTaho8Kn1mi3Wf-y3LuFv0M3IjIsbCJRskclKwMj4Wr77NlCm4Vkmd48nz2W6ExW4-o3qdP4cukqUp5AaAD3ErZ9reU7pVHX8mMPr_BDL0TeTZZErWc88rCxq3CMJ6Py2rj61piFwz-mG0j9TqhuWIGYCJzr1OtDQIEp9hKb7THWmcJxXvZ17cRyxQMihPDaJVKjgP3t-8M8oaIDjp8CMUy36zyKn_tbKZj54X-37j6SNC8XezRmdtkv5EnBVTh32K8J_pLCWxqe0DmlzAp2VSUxXLNLkDOlYhvT1O-QPreXfKNVPKL6jdg3YfiQ4v-pGQnJnYW-F0zrbCAiSyUhnoI05HIHM1IS-cj_U_F__W2-453SvcP7nCM27lH8ktriD5XJ0IAxnkulpW-Evm1wRVagjtc1yr8NVCyjuoBRKIU1pCpXAZvBv6piGVh9BfPRaJ8cPe1qbX0F37PJDL-eZ7gvSIfHWZGe0lQBGQaPygKgmwSNmnnoYZBq8y6h-5y1pXx8R4Q2iDEi7_S3f6A3nU4YKU-2V9KLTXE3OtQghr6FwLtWLBDOu087hkZD7emzLKMC0AjUlNl0c-j0WTCgOeXZWIl1nCIysPDHLQwq0vpjhJddreAgQwxuTvyIXuGPTRofJaS6cBFoJJOJU5RwhqwgutaZvlqTv5fGS_ImJkvkyTW7XvkFkTv9XNDIzm3xXPrpKh0E9n1OsY7lDHXaZgxGrlfxU6VbdIvjIQKPcGJPAgpEZ7kciYYeHE4uVkK-B_TU6-RL6xylucvmCktoji-bW3Qan9kSOkQJ-knx2e5oLUso_Dn5Y8AhaeBwKHHA2vp0xiQV15evQZz_JJxkNg_0YO0m3O60TGwJ0gYKlNWyevAG03CFAozO9nCjVad2yniwrgsKQ_oy_1bgDr--b9k4rv_pLoeZVz7W_69Lmg5mCT0SaDpZywjTa7mxsom4FKyfYf_dtNvZyujrrR4nhLXhPkZ9ST12MN5lE5STgFgx2yu2sSSWAVcXP72_iWo6MJQilgiVPCvKMyEumm3lBHee58L4FRstuw8SIaiv4mUiyAunH_dAi_M66QLDyGyjfZmzMoxVn4QedPNFFTtmzLAkdSojSoUMbOyP9TW8eQqAbhzhemGEapgaC97XHdS65BhfiInp9_7IDBgWXbZeIIu9UM5ysQh1a8QLCz9UChU84p0uSoV-8a0UIEa-KVMC0fgobsuKxS3f2aBalbJJZ56w8uAM0hW9FOtrCbIZdPZ9utaiUEzls-Rgwp-GF4VbZ_qX_PpRFFALzGJlL7M-pZzR4CNRHHjCApsevgZnMF9BGD2TwGxWu2imafk-K0_tKPqFpmGM_xliqq-7HCicJnxvOT40No92T570Lesly7NWA65u6pqK6BI6WfmiyDwE8RQYoSp6RH_b5GUmUCpOG-w3eza-z-oStdaBi5TdKG3CSqMdIqWqH6nbzqLeCihjvRM7hvPHBl9aOFJaPG60KPdbDohMqK2sa5ghIxGa9rkQZvNsPhc4KSIg0igu4GeDS4Ej59_kRwDHlf_VwQisT2XYuUuisnnGJtKFyQvQ4YlCXk2f78jpyopD40_Y7ApCg-d6D4rAzS6tBvXbs1bi_mjjGdx3Md0PapImNnIUHo6KRiyYLEtXrOQfrmveK7R47QJLY00l7pVLjxIdlJe-akAPEjh0EZ1RQBaq4N8UGRjfYDYsOlnh1Um6Wzrak5BCPNnFTfZRhtIZOu0e5UxlX6vtUyaW05WAJmwMl7QEqaZiYWMHvgQZpQdXpAPY&cid=CAASEuRooL-rfUFpXdz9ZBVLYIqqKQ&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49ecc45680ffefaa7342c13f8f6f49d64af038b1f52714eb26f9c60e16a10630

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31075
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE81 42 B
63 B 72ms
72ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cq1MfnZNL5TMneq5MOxpV_xyD8Zur2b9bLmiWjVXKoR7GHoStUiZoNAwKfiOUaiEkIt2vYTrLbpxwcWmsjVT4kRCKQJS7DzLlNMD6EvYIBvRDtJaY

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame DE81 2 KB
1 KB 101ms
52ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:45:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame DE81 15 KB
6 KB 91ms
42ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:26 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DE81 120 KB
37 KB 139ms
54ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:05 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6337 624 B
297 B 51ms
48ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi0rta9ATAB&v=APEucNWR-atMK8RTJTWCA7V3VTpzqE8E_diqisHDFwyh5rBXWKg6c1GYxl6eE7tv506bVtOywBEwdd_U_sIHZ2NlzbZ5ILIijp27MEVlnHYtNTcfL3x89jjFqGNxiLs1SEhflXHzA7GZjbpUW7xxHJUlm62CerLzFnswOQ8nRdYqhJ7eTHEhLr0

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 10 Jan 2022 16:52:05 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 82AC 78 KB
31 KB 105ms
104ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BuvyRXbukgivzLrXn-cctjzd6NsWzZv0qtJUj9uG6Vo655EBxOCC1S7e4rArpk1pupyNXz3QE2KmUmGRxtxgVF6-mQF05DRnH-2xq1GZ1xhejLWdRa5vbNncV3MTcVzdSEeaVaOFtr55XBlWjDxB9iD4PlAQ&dbm_d=AKAmf-CbEnPt_B7YJnwEA_CprjT8ZI6MjicYsxnmrzHmthDM9gIiqB7pJ7I5wg_5HY7NRtoB-O1tAJM-bbyxYdrE_yIPe97npihblRmUvMPvugB0qjbr8I6VGqb1gcDbbnJSJE_uKLhKa7PIZHPe4QfL64Cgk0ThPe68PuE0ZSgU8SAJftCkEvn_ZM3O45qAOmaV_47c47J7SkfZfqpxI_hk9RbDjua5fOm33cOkSaxP4bWhN4moRSL7QtE5JmC2NYBsEFfGhUTLOXWiSYEJgGPNvLyb3WQkJYQSktssWchwbqKZBle5AHC95wxCmbojlgw3c4lqbUs94u86haiMiHOHqnS0oXyuSTs8OTxfbI5wc3huiFlOx_aZkEtggFsgA5dOYU4SJvSDIDL5icgp520kZSXhoQVbX2VMkkez4fTsJ4Vo6kIvZkfPkB0asOI8XMW3JBXxL-ypSUiLgFg3t-A7B5LTznJgfre08gyIwxLMnHsBNaZx4_fKkvQDRXE9MYkLnMudWku-wo-TXYG3yCQptzYrPgF--h35g0_z0SdA5MSiy0JAEjWNQVzFh1SEe5fn0Kppm73QPU0GBou_yAKkKGvKCxEz5m3B6UBroomQOadpMcvpxj6AwnV8bibHsHoHML7oc9evdtzXfohLtnXziUgf6ImP8Gpee-fh5w7C3BHTQxXfmuYbH64G1vbXemdrQngQyhgYDwkogx8YD9x7QK6U0xucKTHRW4leOpjbnug0nhm_wQGEcoQIQibbWlrRug2B-bJWfIY8N5EJxZpMyEO0YLFBEa2V1C1x5gfeUdbmO-5NvAsdvLDoR8BD_2op9_1VC-HTeE5Dz4jhgnM0sAoShgbS1-pbdSb3YY8qXXUGgw1frRM-7cFR-fRAwn26NMXBJLhfpZSz8ac82O40YRHVO-VQKyCqYu_5Cu0Tax9OT20MsQN7HhFmTP2kdIxHgLRZrjN2yO5TEm2ZjNhTI1Ksg5hoqSLvIBKWOSN6Ut3Qufgt4QN7zxCtkeXSFrTIsWcmv4TYe5I-84GNLsTPYLe7M-2IcqSRkarjhMwMtqySYZl21SAAelDL3rA2PRl1m0kvq6DgjnCOzrpy5gypAvulMLhTGnhE2YiPfh3cH3g1cStUKJWgxNR6xu8qklW-ROkS_P-vNGQghsQrmmQm_uqyW0sACtjFdkDTkayKYyXqYRrFg2W3EJKvup_1AdVAIczx9Sy0IOxCmrBwjhIt2TBgMF31aEioB1EffIWSmMdWzm0a-yjqLa-MwHsnYLWxrv7k_7ymtrr-UjHt9XDkV8nUMMLu-C5nhxrdcW0q_kj8192XqFdLfC3SEFxHqqvPWUALga1IJEt3pEGqm9b08PEsMhKO09vwdF8xd_OEXW8IfCJ-Ap45AhzP4ofCXfFE32j75PzkJ0VLYNYqsx_0gvbglHMSXzWD03pmRjJBPvaVvUJWcjXxCzhs1VHwmP2_S83s9h_gixUjh6Iu2g9JeeGMzSovf7A7UdxlKlvgtC3LPhcNDKb8KPOHJVVKTy7gr2EwoVRHeRt9bOu5uOpgxqaWLwimNC9IqcH_cHkkZAVXdVg7eb-y3BqXX6IBI0L_9X4tADZbxRqDt09mAAlf4KR4m6FL1J7YmNypeKSgsG899QElrJZQS_k5QTYhTdbuqaUzkzBEk3HU_tdTxl-QkOyvawhod4OccQ0tTPrt86iC1aMeccFMp__fjAIpkOmzkZi2ETvN_tQVA0TMEKm7AndUGryklkaIVBq7monerHHcYOR8aAU68X0U1ksKmF_BV2BIjK9niAjv8RrnD5fFaPKAmRgoT0VQmlIJLEKX33EwXNERaCXVDwVtQIqVRS3skjAGLK8pFZYJmbktff3OcBHJdy-Rtz8OMYPjI3UDNp6OL8UmskcnSAckPrZJlU3NuteWEFpd8KDmscA7njbcIBN05E6N_4jYHj18DMDOcd19D-m8EKiFXLxa55-UyzKbrw8bFGOM9hbevK7C2Nsic-lE5iwnINUaBz93DHtINR2W0X3d-2uRwJKojY1GwdUVH7J1gklXsvj8laOwpg1QcJoMf1v48Z6oZs-bfW75MtK8XTkgW9bHyeau0wtBCyBpu2HRV2unMbGYmtMa8g1rz7NTwHNfwQcFuAq5krSA6YlrmLdfeDx50l6RMu8eBlTvaSAcQGkCOB1lprV672f4zJt_i1J4-hR31_AH24sRi1drh4wuahq5I3Y4_A_y3navnqI69fw1RAryP7QiRbPDbFAWUPxI5nZ0VrNIfts5c9Vz5im_ziuAIZ5zRYAHDWXc-JGC997BvbpmYdB3D-EDUSaAtZLUQ-EpeRZDdjLfsf1Jlb8ZrvtTpQJF6OEl0pyUn6_4-KmvIYmPJrTjrjHCLrebT7FVmF_jwEwDX0GN15gf7rKg6hJQFAh5bCmJq8Sn1DCV3M_G328L3PPdztMKNbd5qBbxMOnihY2fOo4sI65Vx56X-hjSOXFeKpyFjZNRHAVzmkn1Oh13HdrCJH50XaIbbFA4FSis3ReDgkzEJA-1r6RmzlVKqtD5HC7zZ5-VS6aze1os46lfLrxjHA_sHBkS28JZpfoXVMKmX5vHDYwc_5pUfbjidpKbMEGLXb34nzF_EKDIriy97v5BU771gcoDF0_fifbwyOoa_01DPJq9ws-k1IVs1yiXzh6SAMa8SG0B-0pF5YcpR4A604QReFGdj89IyRCNHjO_rJ9ZoTh28CgI5QnY_iyzvcQuqIYZ4y_nyYIcli84fy-j403oKKJ70v9GckvXS96SCQ1W0y2XeidDrcR1Aa3UtRC-EW8yCsvPPj9RUKoF7a6eNCQ2IZwPjTVMQt0vrRIWBIb6rlJIo_KhVQ_mEDT0RAK3NSeJox3os-yH-tJYMkCFC6a2lkN4f8tBL5WU-s9ms5meEpWejTMrkVV5Sw2jebyt1h5JcHGtWkmt6Upw8k2XMGU2u17z_DFmRZTj4pbXiCB4ameitw4OkctHKW0CIpNL_a38JsSeZxaHiBKD2prnb5wtCoCuLLoERQ&cid=CAASEuRonDQzLPVJqOhSjhuUqTS9_Q&rfl=2%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3eadb59af8f318ed1ddb9e0a1e22544c7b84ef6230fd4b6e203ee8d650fe5a22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 82AC 2 KB
1 KB 90ms
51ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:45:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 82AC 15 KB
6 KB 78ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:26 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 82AC 0
0 135ms
44ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSo_GD94gPPIEPYmcE_8iLfGTFMjdSLFRLHoW4rbaMrchrq9VCi6xyI69qzMynweCa7rB6KdUrJ4u6yuCi1mg9_xkxhAw
Requested by: Host: zvonil.octo.net
URL: https://zvonil.octo.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 82AC 120 KB
37 KB 176ms
101ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:05 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 82AC 42 B
63 B 73ms
72ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BX_RCdrLLWO1hA96DGR5qY9FBJFN0jhprnbUV6mDpCOtcNu64uSkDZsw-uvaSBj79zNTKwjdxXuJl_r7GbpGOubHwvEEQfFMTuDB9ul_yxwFpzC9A

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 91BA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiFs9e9ATAB&v=APEucNUneSEe7xVPVAQM0jcLr10pPTv3qcWsCdZTO4m_Tkj2Otxz_5bq-jycmiwX6tJ11LA5JPYcaLV7dfdRi_Bj5oOa96Nb3uJBBdgn_YPvq4DIjKW1vRCBAelPQo-jwH5OpNJjfW8h6Rgpay0-0y9mUOsPYco5yONsLO4QyuKggp71M_dL8PA
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 16:52:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 91BA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YdxkNeIkyQHzpc45dXe5VQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiFs9e9ATAB&v=APEucNUneSEe7xVPVAQM0jcLr10pPTv3qcWsCdZTO4m_Tkj2Otxz_5bq-jycmiwX6tJ11LA5JPYcaLV7dfdRi_Bj5oOa96Nb3uJBBdgn_YPvq4DIjKW1vRCBAelPQo-jwH5OpNJjfW8h6Rgpay0-0y9mUOsPYco5yONsLO4QyuKggp71M_dL8PA
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 16:52:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 91BA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1

43 B
1007 B

38ms
37ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiFs9e9ATAB&v=APEucNUneSEe7xVPVAQM0jcLr10pPTv3qcWsCdZTO4m_Tkj2Otxz_5bq-jycmiwX6tJ11LA5JPYcaLV7dfdRi_Bj5oOa96Nb3uJBBdgn_YPvq4DIjKW1vRCBAelPQo-jwH5OpNJjfW8h6Rgpay0-0y9mUOsPYco5yONsLO4QyuKggp71M_dL8PA

Protocol

HTTP/1.1

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
X-Proxy-Origin: 185.213.155.164; 185.213.155.164; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f8e0aca3-41b5-4859-8e80-5560ef2966c9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 91BA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3

170 B
232 B

67ms
67ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
X-Proxy-Origin: 185.213.155.164; 185.213.155.164; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: aadf0a76-7ead-4546-8e57-38fccdc7828f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6337
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1

43 B
894 B

26ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi0rta9ATAB&v=APEucNWR-atMK8RTJTWCA7V3VTpzqE8E_diqisHDFwyh5rBXWKg6c1GYxl6eE7tv506bVtOywBEwdd_U_sIHZ2NlzbZ5ILIijp27MEVlnHYtNTcfL3x89jjFqGNxiLs1SEhflXHzA7GZjbpUW7xxHJUlm62CerLzFnswOQ8nRdYqhJ7eTHEhLr0
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 16:52:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6337
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YdxkNeIkyQHzpc45dXe5VQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1

43 B
894 B

28ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi0rta9ATAB&v=APEucNWR-atMK8RTJTWCA7V3VTpzqE8E_diqisHDFwyh5rBXWKg6c1GYxl6eE7tv506bVtOywBEwdd_U_sIHZ2NlzbZ5ILIijp27MEVlnHYtNTcfL3x89jjFqGNxiLs1SEhflXHzA7GZjbpUW7xxHJUlm62CerLzFnswOQ8nRdYqhJ7eTHEhLr0
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 10 Jan 2022 16:52:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4PSAeZg2vlHG0w3Lg_HFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6337
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1

43 B
1007 B

38ms
38ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARi0rta9ATAB&v=APEucNWR-atMK8RTJTWCA7V3VTpzqE8E_diqisHDFwyh5rBXWKg6c1GYxl6eE7tv506bVtOywBEwdd_U_sIHZ2NlzbZ5ILIijp27MEVlnHYtNTcfL3x89jjFqGNxiLs1SEhflXHzA7GZjbpUW7xxHJUlm62CerLzFnswOQ8nRdYqhJ7eTHEhLr0

Protocol

HTTP/1.1

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
X-Proxy-Origin: 185.213.155.164; 185.213.155.164; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 964e735e-41f8-414f-988b-a3b79a6085d0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEImDyondK4xFJRjtRlu5vBE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 6337
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3

170 B
243 B

62ms
62ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
X-Proxy-Origin: 185.213.155.164; 185.213.155.164; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4aaf3270-578b-4009-9d15-5c7fe2ecd256
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODMzOTIwNTQyNjcwODc4OTI3
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame DE81 169 KB
59 KB 136ms
37ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Origin: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 18:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81984
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:05:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/ Frame DE81 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D7kJIoCajZOEvjFuyW6l9Nfs6PXHzLMoItPrmUQGJvBwysxhliY1KUqEnVUQtRgrteW9NU8YqXZ5db6uunLx3saipprHKn02k8SKjltzd-9gbID7KU5bQ66zztYDEvB1KZ3yuo_XpD2nMjTrh1052UzZpsqw&dbm_d=AKAmf-D8qlqAwUXe_uJAZHAbWGpOBfxIvVAvN2PdtIGe4B80XhDXIilR-DOBXPfP6WZmv-Oy9VXoj9AU_DvzAPAv8L8bLBsLW7NG0JCQujEJ4bAP49VlCcOgaMv2RzRbDuXDUdrip532YVFr1L9QLyR0dEQRSFWB6HPgulcDfp8mS2YzB851O8uymDIRa48v3ZMQyKkKA9273M3fvc9NLaHMu60JN_6_tO_N3ojfpxM9j4ROzYOy6SnPNgtNBpqsogwrBtAVrM8FZrqlJU9VQNf_q2TPPbtSW27t4C2FEoZXhGV-a7dl5Eb4AXXnjy6Fmd_iLrkNas2C9-s5waiEXIycHxbv6q90NIJOfc-Cc95CLTB6CXM4SwdMdN85vTDKak_EupjD0vlBNlJ5Jy5dZ7zdfAANM7X3mCz81XEcZnhzb29VPBDU_e10B7LOZeEjZ4wU2Dj5Qq2I2l8jWbB9LdZQ8aXzCL_abINasqTDLey0tx_TSURuY6cFYFXf8X3F47zAsILgmu8_i6nqdrpMU1SNYVS-S-V-pjLOJVKrCXWH9lmSrW1jTQ6Ll7SGGq0U_Z5CVQDSgQfx7lCFSf7XU3unweJGyTb0clgpN0dfGlD1PLDPeaGVNOQTVUu-xw5UCCg_OqCAQbPjuzlzdbkjetkqC-kVukuos7v2GE5e5MLvYjuwgpioOUQFVw5uJsLGQu_ZzlyWTk3TGmJzFctOsuQYEAqnuppqYt8oGxVmbg-JNMeqdUu2RzVufdUM9l6kDbNzC1ZwW4-GhVMU0miqmdiWmMy2goQiyN25IqujSg6iYMMV92YhTuYWtEeFXNWLgZ_2QWjVQbxR4Agk5XRuQmhkJISqakBLu0O3YygYxTecUSHgIoWo3sGaZAWkyGzyElu8KVHM6PXigesARtdUDn7GVrBf1gOaWkNG-9UUpz2RXYmDcexUPA8_8rNHm4fTNQnUGDgxSjsFmshN06XHAQiS8VZddjmtknS_GaoRCu6Q1RBURMufFVRBBUYuc5WyHwOzQJHHddl3ksTP7A4FTrDZKTd1peQJrTelmvNZzhtfeQ-Zzr9TpuI2oVO6q5US4JZlmgPxTzOcNAucpae3QYmNE7H3g4n0uZEZEQcHUuPeYllRPIdJ3kMlxdh-ZzRnhQsC-6zLjShE6kxIKXS7y0_OEUocg8RYBJiEr48sbr73hT-Yl7mAjQ_A02hi13Dju2_sh3-xWPUk0k2R701mLJ8mPYghckoVd6gS_2Bz0hjfhyzabSGyyp9t_8BLTaho8Kn1mi3Wf-y3LuFv0M3IjIsbCJRskclKwMj4Wr77NlCm4Vkmd48nz2W6ExW4-o3qdP4cukqUp5AaAD3ErZ9reU7pVHX8mMPr_BDL0TeTZZErWc88rCxq3CMJ6Py2rj61piFwz-mG0j9TqhuWIGYCJzr1OtDQIEp9hKb7THWmcJxXvZ17cRyxQMihPDaJVKjgP3t-8M8oaIDjp8CMUy36zyKn_tbKZj54X-37j6SNC8XezRmdtkv5EnBVTh32K8J_pLCWxqe0DmlzAp2VSUxXLNLkDOlYhvT1O-QPreXfKNVPKL6jdg3YfiQ4v-pGQnJnYW-F0zrbCAiSyUhnoI05HIHM1IS-cj_U_F__W2-453SvcP7nCM27lH8ktriD5XJ0IAxnkulpW-Evm1wRVagjtc1yr8NVCyjuoBRKIU1pCpXAZvBv6piGVh9BfPRaJ8cPe1qbX0F37PJDL-eZ7gvSIfHWZGe0lQBGQaPygKgmwSNmnnoYZBq8y6h-5y1pXx8R4Q2iDEi7_S3f6A3nU4YKU-2V9KLTXE3OtQghr6FwLtWLBDOu087hkZD7emzLKMC0AjUlNl0c-j0WTCgOeXZWIl1nCIysPDHLQwq0vpjhJddreAgQwxuTvyIXuGPTRofJaS6cBFoJJOJU5RwhqwgutaZvlqTv5fGS_ImJkvkyTW7XvkFkTv9XNDIzm3xXPrpKh0E9n1OsY7lDHXaZgxGrlfxU6VbdIvjIQKPcGJPAgpEZ7kciYYeHE4uVkK-B_TU6-RL6xylucvmCktoji-bW3Qan9kSOkQJ-knx2e5oLUso_Dn5Y8AhaeBwKHHA2vp0xiQV15evQZz_JJxkNg_0YO0m3O60TGwJ0gYKlNWyevAG03CFAozO9nCjVad2yniwrgsKQ_oy_1bgDr--b9k4rv_pLoeZVz7W_69Lmg5mCT0SaDpZywjTa7mxsom4FKyfYf_dtNvZyujrrR4nhLXhPkZ9ST12MN5lE5STgFgx2yu2sSSWAVcXP72_iWo6MJQilgiVPCvKMyEumm3lBHee58L4FRstuw8SIaiv4mUiyAunH_dAi_M66QLDyGyjfZmzMoxVn4QedPNFFTtmzLAkdSojSoUMbOyP9TW8eQqAbhzhemGEapgaC97XHdS65BhfiInp9_7IDBgWXbZeIIu9UM5ysQh1a8QLCz9UChU84p0uSoV-8a0UIEa-KVMC0fgobsuKxS3f2aBalbJJZ56w8uAM0hW9FOtrCbIZdPZ9utaiUEzls-Rgwp-GF4VbZ_qX_PpRFFALzGJlL7M-pZzR4CNRHHjCApsevgZnMF9BGD2TwGxWu2imafk-K0_tKPqFpmGM_xliqq-7HCicJnxvOT40No92T570Lesly7NWA65u6pqK6BI6WfmiyDwE8RQYoSp6RH_b5GUmUCpOG-w3eza-z-oStdaBi5TdKG3CSqMdIqWqH6nbzqLeCihjvRM7hvPHBl9aOFJaPG60KPdbDohMqK2sa5ghIxGa9rkQZvNsPhc4KSIg0igu4GeDS4Ej59_kRwDHlf_VwQisT2XYuUuisnnGJtKFyQvQ4YlCXk2f78jpyopD40_Y7ApCg-d6D4rAzS6tBvXbs1bi_mjjGdx3Md0PapImNnIUHo6KRiyYLEtXrOQfrmveK7R47QJLY00l7pVLjxIdlJe-akAPEjh0EZ1RQBaq4N8UGRjfYDYsOlnh1Um6Wzrak5BCPNnFTfZRhtIZOu0e5UxlX6vtUyaW05WAJmwMl7QEqaZiYWMHvgQZpQdXpAPY&cid=CAASEuRooL-rfUFpXdz9ZBVLYIqqKQ&rfl=1%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/ Frame DE81 24 KB
9 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f974e8d6e570fde2dd07cee4041a1b83dc62b583b47a817c2caa29ada0f1c7e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:49:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9529
x-xss-protection: 0
server: cafe
etag: 16937460792814555877
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:49:26 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 82AC 169 KB
59 KB 166ms
79ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Origin: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 18:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81984
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 18:05:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/ Frame 82AC 8 KB
3 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BuvyRXbukgivzLrXn-cctjzd6NsWzZv0qtJUj9uG6Vo655EBxOCC1S7e4rArpk1pupyNXz3QE2KmUmGRxtxgVF6-mQF05DRnH-2xq1GZ1xhejLWdRa5vbNncV3MTcVzdSEeaVaOFtr55XBlWjDxB9iD4PlAQ&dbm_d=AKAmf-CbEnPt_B7YJnwEA_CprjT8ZI6MjicYsxnmrzHmthDM9gIiqB7pJ7I5wg_5HY7NRtoB-O1tAJM-bbyxYdrE_yIPe97npihblRmUvMPvugB0qjbr8I6VGqb1gcDbbnJSJE_uKLhKa7PIZHPe4QfL64Cgk0ThPe68PuE0ZSgU8SAJftCkEvn_ZM3O45qAOmaV_47c47J7SkfZfqpxI_hk9RbDjua5fOm33cOkSaxP4bWhN4moRSL7QtE5JmC2NYBsEFfGhUTLOXWiSYEJgGPNvLyb3WQkJYQSktssWchwbqKZBle5AHC95wxCmbojlgw3c4lqbUs94u86haiMiHOHqnS0oXyuSTs8OTxfbI5wc3huiFlOx_aZkEtggFsgA5dOYU4SJvSDIDL5icgp520kZSXhoQVbX2VMkkez4fTsJ4Vo6kIvZkfPkB0asOI8XMW3JBXxL-ypSUiLgFg3t-A7B5LTznJgfre08gyIwxLMnHsBNaZx4_fKkvQDRXE9MYkLnMudWku-wo-TXYG3yCQptzYrPgF--h35g0_z0SdA5MSiy0JAEjWNQVzFh1SEe5fn0Kppm73QPU0GBou_yAKkKGvKCxEz5m3B6UBroomQOadpMcvpxj6AwnV8bibHsHoHML7oc9evdtzXfohLtnXziUgf6ImP8Gpee-fh5w7C3BHTQxXfmuYbH64G1vbXemdrQngQyhgYDwkogx8YD9x7QK6U0xucKTHRW4leOpjbnug0nhm_wQGEcoQIQibbWlrRug2B-bJWfIY8N5EJxZpMyEO0YLFBEa2V1C1x5gfeUdbmO-5NvAsdvLDoR8BD_2op9_1VC-HTeE5Dz4jhgnM0sAoShgbS1-pbdSb3YY8qXXUGgw1frRM-7cFR-fRAwn26NMXBJLhfpZSz8ac82O40YRHVO-VQKyCqYu_5Cu0Tax9OT20MsQN7HhFmTP2kdIxHgLRZrjN2yO5TEm2ZjNhTI1Ksg5hoqSLvIBKWOSN6Ut3Qufgt4QN7zxCtkeXSFrTIsWcmv4TYe5I-84GNLsTPYLe7M-2IcqSRkarjhMwMtqySYZl21SAAelDL3rA2PRl1m0kvq6DgjnCOzrpy5gypAvulMLhTGnhE2YiPfh3cH3g1cStUKJWgxNR6xu8qklW-ROkS_P-vNGQghsQrmmQm_uqyW0sACtjFdkDTkayKYyXqYRrFg2W3EJKvup_1AdVAIczx9Sy0IOxCmrBwjhIt2TBgMF31aEioB1EffIWSmMdWzm0a-yjqLa-MwHsnYLWxrv7k_7ymtrr-UjHt9XDkV8nUMMLu-C5nhxrdcW0q_kj8192XqFdLfC3SEFxHqqvPWUALga1IJEt3pEGqm9b08PEsMhKO09vwdF8xd_OEXW8IfCJ-Ap45AhzP4ofCXfFE32j75PzkJ0VLYNYqsx_0gvbglHMSXzWD03pmRjJBPvaVvUJWcjXxCzhs1VHwmP2_S83s9h_gixUjh6Iu2g9JeeGMzSovf7A7UdxlKlvgtC3LPhcNDKb8KPOHJVVKTy7gr2EwoVRHeRt9bOu5uOpgxqaWLwimNC9IqcH_cHkkZAVXdVg7eb-y3BqXX6IBI0L_9X4tADZbxRqDt09mAAlf4KR4m6FL1J7YmNypeKSgsG899QElrJZQS_k5QTYhTdbuqaUzkzBEk3HU_tdTxl-QkOyvawhod4OccQ0tTPrt86iC1aMeccFMp__fjAIpkOmzkZi2ETvN_tQVA0TMEKm7AndUGryklkaIVBq7monerHHcYOR8aAU68X0U1ksKmF_BV2BIjK9niAjv8RrnD5fFaPKAmRgoT0VQmlIJLEKX33EwXNERaCXVDwVtQIqVRS3skjAGLK8pFZYJmbktff3OcBHJdy-Rtz8OMYPjI3UDNp6OL8UmskcnSAckPrZJlU3NuteWEFpd8KDmscA7njbcIBN05E6N_4jYHj18DMDOcd19D-m8EKiFXLxa55-UyzKbrw8bFGOM9hbevK7C2Nsic-lE5iwnINUaBz93DHtINR2W0X3d-2uRwJKojY1GwdUVH7J1gklXsvj8laOwpg1QcJoMf1v48Z6oZs-bfW75MtK8XTkgW9bHyeau0wtBCyBpu2HRV2unMbGYmtMa8g1rz7NTwHNfwQcFuAq5krSA6YlrmLdfeDx50l6RMu8eBlTvaSAcQGkCOB1lprV672f4zJt_i1J4-hR31_AH24sRi1drh4wuahq5I3Y4_A_y3navnqI69fw1RAryP7QiRbPDbFAWUPxI5nZ0VrNIfts5c9Vz5im_ziuAIZ5zRYAHDWXc-JGC997BvbpmYdB3D-EDUSaAtZLUQ-EpeRZDdjLfsf1Jlb8ZrvtTpQJF6OEl0pyUn6_4-KmvIYmPJrTjrjHCLrebT7FVmF_jwEwDX0GN15gf7rKg6hJQFAh5bCmJq8Sn1DCV3M_G328L3PPdztMKNbd5qBbxMOnihY2fOo4sI65Vx56X-hjSOXFeKpyFjZNRHAVzmkn1Oh13HdrCJH50XaIbbFA4FSis3ReDgkzEJA-1r6RmzlVKqtD5HC7zZ5-VS6aze1os46lfLrxjHA_sHBkS28JZpfoXVMKmX5vHDYwc_5pUfbjidpKbMEGLXb34nzF_EKDIriy97v5BU771gcoDF0_fifbwyOoa_01DPJq9ws-k1IVs1yiXzh6SAMa8SG0B-0pF5YcpR4A604QReFGdj89IyRCNHjO_rJ9ZoTh28CgI5QnY_iyzvcQuqIYZ4y_nyYIcli84fy-j403oKKJ70v9GckvXS96SCQ1W0y2XeidDrcR1Aa3UtRC-EW8yCsvPPj9RUKoF7a6eNCQ2IZwPjTVMQt0vrRIWBIb6rlJIo_KhVQ_mEDT0RAK3NSeJox3os-yH-tJYMkCFC6a2lkN4f8tBL5WU-s9ms5meEpWejTMrkVV5Sw2jebyt1h5JcHGtWkmt6Upw8k2XMGU2u17z_DFmRZTj4pbXiCB4ameitw4OkctHKW0CIpNL_a38JsSeZxaHiBKD2prnb5wtCoCuLLoERQ&cid=CAASEuRonDQzLPVJqOhSjhuUqTS9_Q&rfl=2%2Chttps%253A%252F%252Fzvonil.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/ Frame 82AC 24 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220104/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f974e8d6e570fde2dd07cee4041a1b83dc62b583b47a817c2caa29ada0f1c7e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:49:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9529
x-xss-protection: 0
server: cafe
etag: 16937460792814555877
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:49:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DE81 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 18:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 168382
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Jan 2023 18:05:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E4BF 1 KB
749 B 40ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 05:53:44 GMT
expires: Tue, 11 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 39501
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame DE81 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ddfa887e56ff4027feaf661b8db5abf89702463c113ccb1cdc00f0cb618eccd2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 82AC 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 18:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 168382
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Jan 2023 18:05:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2D9E 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 05:53:44 GMT
expires: Tue, 11 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 39501
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 82AC 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0f624ee5c3986ba48b87762f8f009a97c97933d29d857ce01deddb0735bc514

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 43C8 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641833525&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522548&bpp=1&bdt=339&idt=2930&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=Bf1oAm9rOe&p=https%3A//zvonil.octo.net&dtd=2933

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:45:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 43C8 15 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 43C8 120 KB
37 KB 98ms
53ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:05 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DA48 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 08 Jan 2022 18:05:45 GMT
expires: Sun, 08 Jan 2023 18:05:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 168380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 43C8 0
0 78ms
77ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzxBqNWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoEwQFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-92PZR4IT_ddmaHIDiQFxizERyoMzdXrU4aEIPodrSfxwbLPdsQvsgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0yOTc5NTMzOTA5MzkyNTg4GAA&sigh=JoC7CeqBBXQ&uach_m=[UACH]&cid=CAQSOwCNIrLMS5oGqUP9PsJRa3eSkY26OZqmu2vwBHuPFE62UvxdSUSBRgmcytulEryT3QvBjtOjlhs_dONbGAE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641833525&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522548&bpp=1&bdt=339&idt=2930&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=Bf1oAm9rOe&p=https%3A//zvonil.octo.net&dtd=2933
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 16:52:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 43C8 0
0 66ms
21ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1kqf1w78j7by5eztnwcjwhf222r3c3vt936kjmerrvwtxs1syy5vb0s3hpxz6k4w8bjwa130k525kk4h9930sr5dtxm76x8q2abk73whf2nszyx7crvwr64kgw6j7w80kqg5r6wq7bwp6527wccq7y457w62srm6e26h7n9hrvz64wzaq8ryk2wzx1qdj3asdxprcnakgmbtbry2nj7rv38xgrnrtx5szns15fg6zjxre4nnadc3dpsw7ze665vgq82wf9x6yqfzw8by73347kb81p8b2v8cbhkdzg80ef7yqqqqmcdpjzbfm6gnwxec5rmbhhpnkmxdaqkgx9q03v1zfaf9hkk5d6srth5gc3xqk5rbbw3dxr0332tz89ndf1r959r1y0cfd5q27httdbbvwndgy&b=YdxkNQAIeJcKmu0CAAb-J5dzte_9p5WA8cxIzQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641833525&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522548&bpp=1&bdt=339&idt=2930&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=Bf1oAm9rOe&p=https%3A//zvonil.octo.net&dtd=2933
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
alt-svc: clear
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame 2316 2 KB
3 KB 73ms
46ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1grdgg7qhhv2b61cfdpbs49nz8p4nf7q7cmqefqahhw2prph1k78bggwgs5y6fm1h7bpq4r080mnhaecdc3zsycavnxbq0732zkhvphq0e7j3jzz10de85r3d7m2v6tswfq92d4zt55nw8jnc9gx57v0hcyzre1evajqpjsx1qdfc9nsy5kjsagnatj3p57kymaa7tmmyt20qys00caeae47ae41ansptcmvfr2kr0g1pgw8wc4amvzr4gx3tz36mzbtgk8ddqjpms0fzzarbypfmmeam3py76a0v4yj7rv7v196dqthqp6zxyyd7gpj22j8nkfyqhjeam308jhfndhwhc55768rq0erjsrmze8xh9a6qa6g8axzym4pdht1jwr36ty7jfxsav2k71dt7xmxzst5cx0a8kte0x0jc0asjkregm1xc&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

246f478f9070946829aa6e06825ee22c99e66edc39d9e83a55967585cd2b9829

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb769f10e6e5c92-FRA
content-encoding: br

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 75AF 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 05:53:44 GMT
expires: Tue, 11 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 39501
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame E4BF 35 B
464 B 44ms
8ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENMarM9BhpD-0pAEuBtwKUo&google_cver=1&google_push=AYg5qPI3CRug4VqYDQnsBlK35c15PD_cTMxGUPISdsp2T0Jhcpye5FGvOWFeGnYpODt7q4BymESwPdbYdrugg87PwPU0CFxcI2s

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame E4BF 43 B
324 B 52ms
19ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESENL9mOrINZMRLzH8YaP-FNI&google_push=AYg5qPJqW8fXNNs5L2hCbUPf7W8VemPK4v62F6T5f_obWY2qest-ERCHJLyTuV_byTqUAisO8JTbbpYSaPSPPeMWR_5xIecxkco&google_cver=1
Requested by: Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame E4BF 43 B
351 B 57ms
21ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEE8pNBmcUrIuN9yUbd5owK4&google_cver=1&google_push=AYg5qPJWjteAm5lG8hBxa-EPZFkNpSyIe_XPhZ70nTJovmZqh3E0p9eKKvNMHqw8_fHwZq5XxgnfISu2fZg18ciUQ2KuzEMg5rg
Requested by: Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 9jg8gvvjd6tmsghjh0e3p39g6lbr4ged

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E4BF
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-nfPdJeRSDu3026UApy3gA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

66ms
66ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-nfPdJeRSDu3026UApy3gA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKFO3PCEHXg6YSHhrLQwDyL2t0HOdaU2nqa_hYXUckrmInXyN0A2bzhymGdNAECOw3MsckgXyiKCUUrrOBBPKyBF8Z0wfm5

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-nfPdJeRSDu3026UApy3gA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKFO3PCEHXg6YSHhrLQwDyL2t0HOdaU2nqa_hYXUckrmInXyN0A2bzhymGdNAECOw3MsckgXyiKCUUrrOBBPKyBF8Z0wfm5
date: Mon, 10 Jan 2022 16:52:05 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E4BF
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEB4qQZ_jboTteEcAmdtmIWs&google_cver=1&google_push=AYg5qPKqGFGe7olXDFjKVWF4CeY9wrE_wWfomN3C9SG2qNwS5Tsu_vOCROS5Vz_-_YYhgjZC8J9...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRkctNy1FUjVU&google_push=AYg5qPKqGFGe7olXDFjKVWF4CeY9wrE_wWfomN3C9SG2qNwS5Tsu_vOCROS5Vz_-_YYhgjZC8J9StCDACphlbI5xc5SXnyArmHQ

170 B
188 B

78ms
65ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRkctNy1FUjVU&google_push=AYg5qPKqGFGe7olXDFjKVWF4CeY9wrE_wWfomN3C9SG2qNwS5Tsu_vOCROS5Vz_-_YYhgjZC8J9StCDACphlbI5xc5SXnyArmHQ

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRkctNy1FUjVU&google_push=AYg5qPKqGFGe7olXDFjKVWF4CeY9wrE_wWfomN3C9SG2qNwS5Tsu_vOCROS5Vz_-_YYhgjZC8J9StCDACphlbI5xc5SXnyArmHQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame E4BF
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_push=AYg5qPKNTjDs8vWQaZ0C4_tb-natzNNfaP9e6IJWw7bvpwiEvqmTaZWkWsrKLWPJn4wGNm2Ai2iS1WQHdtdmRagOGf...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E4BF
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELAhH9fe05YKefDSXMe-lYM&google_cver=1&google_push=AYg5qPLujcT5VR4xpTtcZWAd...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLujcT5VR4xpTtcZWAdHxeg66WUBcZcpjfF3RRHfBGNrWXjfO0nDHMcvEkAVsZBL2i6eobzvLFtFJY1l3xunLAW1HRJGxu6cg&google_hm=

170 B
188 B

65ms
65ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLujcT5VR4xpTtcZWAdHxeg66WUBcZcpjfF3RRHfBGNrWXjfO0nDHMcvEkAVsZBL2i6eobzvLFtFJY1l3xunLAW1HRJGxu6cg&google_hm=

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLujcT5VR4xpTtcZWAdHxeg66WUBcZcpjfF3RRHfBGNrWXjfO0nDHMcvEkAVsZBL2i6eobzvLFtFJY1l3xunLAW1HRJGxu6cg&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 09 Jan 2022 16:52:05 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E4BF 0
12 B 115ms
65ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K7eQAJFQ0nuEsj_TIilnGQi2BwWcKRFTf3NlFK1COPc9cKqXB4Q6Q3RIye0-X_QDku7KYTMg

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9253 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 08 Jan 2022 18:05:45 GMT
expires: Sun, 08 Jan 2023 18:05:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 168380
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2D9E 35 B
463 B 41ms
9ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENMarM9BhpD-0pAEuBtwKUo&google_cver=1&google_push=AYg5qPIQ445tmFN_ZV-3m_p-WgZimJCIu_epRUwBOT0FRm-BV1fTxrYi92EulQrnWpeZqvL3rnRA76p6pRtzUgctbhEoN2aWfKN0

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D9E
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIe3ANSQwQrk8_TyP0RSAl5uhTREyghNdo6O9Qbsnk1EYnJxzFvfV6DOJx8ICrUUmkyz-_FSFaE1kHqpYfD_DTpNz870vs&google_gid=CAESEEGBstv4XFkYlUq9uYDtsBQ&goog...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCLXI8Y4GEgUI6AcQAEIASm9nb29nbGVfcHVzaD1BWWc1cVBJZTNBTlNRd1FyazhfVHlQMFJTQWw1dWhUUkV5Z2hOZG82TzlRYnNuazFFWW5KeHpGdmZWNkRPSng4SUNyVVVta3l6LV9GU0ZhRTFrSHFwWW...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwYThZMy1Ocmc0X1J3UXlEck4xNEMxbVpFWUZtVW1td1hLdDhydklxYkY5QQ==&google_push

170 B
188 B

69ms
69ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwYThZMy1Ocmc0X1J3UXlEck4xNEMxbVpFWUZtVW1td1hLdDhydklxYkY5QQ==&google_push

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwYThZMy1Ocmc0X1J3UXlEck4xNEMxbVpFWUZtVW1td1hLdDhydklxYkY5QQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame 2D9E 43 B
135 B 58ms
26ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEE8pNBmcUrIuN9yUbd5owK4&google_cver=1&google_push=AYg5qPKeOKV6EU5_b4ArMn_8UVb3E_xY5l5h_wpGfyXwk7lQShg6P5aULoIrTSC3-Pnr3nhpJF9X2kDgcjThPwdwUe1f5wyNCEyy
Requested by: Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: fv5sva4o8rv494mqml5cl9nmftp0hte1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D9E
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=18khigilQyK-oB7S9mlx7Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

72ms
72ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=18khigilQyK-oB7S9mlx7Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ8199hQ23x5jgs3XvFLW0GNNPiljAzGTutSKzLb8OqhiT9FykJWn0zXPNYeFSpdXAOEdar7_daT9tOOBr56O4k6V6VZIsL

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=18khigilQyK-oB7S9mlx7Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ8199hQ23x5jgs3XvFLW0GNNPiljAzGTutSKzLb8OqhiT9FykJWn0zXPNYeFSpdXAOEdar7_daT9tOOBr56O4k6V6VZIsL
date: Mon, 10 Jan 2022 16:52:04 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D9E
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEB4qQZ_jboTteEcAmdtmIWs&google_cver=1&google_push=AYg5qPLwmhqnMhOBAhZboQEoTvHrOBf70UoCMY0OJpMzn3OaqdolyiJFusNb4qDCQK7d3bhqqL5...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRlYtMUktR1dINA==&google_push=AYg5qPLwmhqnMhOBAhZboQEoTvHrOBf70UoCMY0OJpMzn3OaqdolyiJFusNb4qDCQK7d3bhqqL5NrelI6N0ilxbKTs-D7bmfBAoI

170 B
188 B

70ms
70ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRlYtMUktR1dINA==&google_push=AYg5qPLwmhqnMhOBAhZboQEoTvHrOBf70UoCMY0OJpMzn3OaqdolyiJFusNb4qDCQK7d3bhqqL5NrelI6N0ilxbKTs-D7bmfBAoI

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHRlYtMUktR1dINA==&google_push=AYg5qPLwmhqnMhOBAhZboQEoTvHrOBf70UoCMY0OJpMzn3OaqdolyiJFusNb4qDCQK7d3bhqqL5NrelI6N0ilxbKTs-D7bmfBAoI
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2D9E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPJt9NFqUGYm5K-iozOH1ULbnuUNST9PS...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 2D9E 43 B
295 B 129ms
20ms Image
image/gif 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESECa-B3zY2_GPSiq5tR_UEUA&google_cver=1&google_push=AYg5qPKa0_lotenZ983NesFc9ErYcE1Mjj7DpqoFocKyXRnYTGzlIphM0ILuCLwYxi6hE-hyWR_XHiTPIvBHpkBbvz4WLlXP_rsp
Requested by: Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2D9E 0
12 B 102ms
55ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I-poSkUv0eA788j3erTkrtIO5FvBKO4EEepJaM-IdTYpYB7Kgq6u3DOxmnyFIjiyCanscm

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 43C8 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e5305ba55a80fe5eb875d50cb22af7b0bf47e2bd9a7cc45a763d60ec1d37c5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4058801387234918400/ Frame 39BC 5 KB
1 KB 96ms
49ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79ded940c38b559eaa94f5858529d0ca998f72cef2411196875d3b7658e290fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1329
date: Mon, 10 Jan 2022 16:52:06 GMT
expires: Tue, 10 Jan 2023 16:52:06 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 01 Apr 2021 18:26:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DE81 0
61 B 178ms
80ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssp2L1IHGxUcJRJv9qXapTXg6bLm3tqBC8mTj7OLznDCjXxi_3Knf4Sc27c8AnFgN0mNqDm9BnB-qdt10d5xo9qk0pWVniI18KBw-Rxj33v69UkEcJuafDru3TCqdBiC21T4XyavCiJ4dEgAm6r9XHqn4aWBs4S4c7lu1FNCncboJXQ-U_uByjFPisllLZLFj0n06JszGWPcrqim5rk5JvBtvgjIqxdIkGXN1tvMAP7Y9UtymJTcMV-VlquzT6R4BgRkLPRrA5TYUw4dBpzI87VI0cwWLPfRY-7XyHgdqDDncGfnNRtlsa37vJcFP2Wj9MyGarwFSqTujl2vOfJ61g1gbe5b9rLeGsZg_xk6Sx9UF-q0Lh98qbyOJVt0gBpMM-JPw88RbYF9-t-w1mRGppB8jYwrwDkvqS_XPnvq7I1uoDeLXRX_qapUWOVnMk3qClDwSbW4A3iDDmOt1VJdJf3znJtIXPoaBQjwMDx2pOHKRl-v-j4HI_Xfjk3plYEXdbD-7JyexcCdRvgkJqRdznsiQBjcSYBmoSTAR-zLekMTBkHBD_JbxdPy1jU5GLNw6tlQlHo0A7BcWoROU8al4apRcjeoeNd5EhLSE11skq_oWOAWuvfaajZLdwNJdQVUhKDuAIsh6UP9sA4PIT_ryOLQxrZEtB61FtCoXEbCuthyt0RFLu2cbG6wfSuHH3D1WbEW42J8tZdyEhbZCBTD5BMSTWDa9wbz-wT4T2cUbOnLXy8IHTWtCSdlNIBz7VWnj8b1ynbVndkAMnWhMOqQL7fIfnnTCaF2Tz01zcKv2rV5F_leM3rdP8unQHCR5pX8hSK_MCRfePTrit1-tk23UK_5ds-LPVcomEFHQT_jMiri_Rf12s_dx0vclmhlrR7jm_iMUhkkLfLjCsAjV1W0WMdZxOV2fOeA_sGjkFIut5H9-hwctleM2omr9n3Ol-G9Uo_6OpINJbOUXdnibhGn7UmJiZz-lyAHoG7Cw_Yeta3yJ5UeYWOfNzxvrV1xbPFBN7zeceARXpUCQEX13tx3ghjshFDmOlm8kCj-_hHepj3KndMa3M1Ou6An8u95RI8H7FOvluCzRFhQLb_x3vtNvuO8vzIbiyVEydgrqJmp2oaJVVbXTTZGs_PyoBEN_9qHmTYZVyL6IuA7IkimNiFrd_HVC7dL6QtTWeN_WXTO6dIjTrZpsHdPrLhMB_1HX0&sai=AMfl-YQXZzDLDBMgP3ige2HH9OAvzvdP3fiAmhn--hNClqcTlQX5pKEGOF8jhZGs4y2BuX6LgkZz0EL1trIB3COXvAWE_2cSTqx3-m6X8JT0tO0qcx1MQIifqGpomOyuE87BKv7lQncKc_6fyW0D0QV7QmPOwfYbJA&sig=Cg0ArKJSzIc16e-SJSo9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=234&cbvp=1&cstd=229&cisv=r20220104.70369&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 10 Jan 2022 16:52:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 160x600.html Show response
s0.2mdn.net/sadbundle/351369470800822272/ Frame AFE6 43 KB
10 KB 78ms
50ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91cb10817eaea10d296e4c3e50982dbf69f460a6a5e0e80b39b83723c34b9d30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
expires: Tue, 10 Jan 2023 16:52:06 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 10 Jan 2022 08:56:37 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 82AC 0
571 B 160ms
80ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuHG3Lh-ENY6N8HVpks0ILd5CDJ6AMK0JeVr8qBi4pqcdg6h-FDehm9V8awZT8Duq1jWwpAuqourzxgxKzUcFV0ZmvKXEsV_n3yZFhTz6n_Ecb3kaCAYlzk-RFUd0smNGMkUdZYsSvr9Hl0ZTybPqXPqZTZ0bo9AhvQPAvk6lJ-SJafQBvD62D0ztT1YBvBrVRk5cllBxuWJpBkQj8euXtRQu5CczHZa_kJHVOzhhXkTaS7NIu7NgcNW56kMEWkfzDnK5knjE-gRAIcKQPBiX5HpVA_ohwUPVnq_pOpHlzAcU7eWx8ZI9Ag-_IDm556T7OZ5-oCMPp33Ziuq2j9wevXFI2T-O8iUL4R408FVahkpElpX6MBPsixhxnaVQwkLmbIbisQqkjmQRSb2tNn-otnI8iyS-4oQF-j7OOBz84DSZYlA8V8kXbQfbPLt3Wk77AdbzVzosuaSiGXKq9WNxx4WFb6iQ9ycA33VSGGaPi9u9Xk8BYy51JhBcaYm0SjREtXHzf1N1ozJOKcTp609N43iWE0UMMMh2ZrwKfAjq-bAFRp_yGaxY7ajjIX_H8wI2W3PxQ03XLDJ0W49MUO0zNU8yX8DwVq8sCyakKmwBRB8PS-HOZByKxgzAiYiWStwBHj1Ph08iZQ9I6l4E-s1_HPegUYiPBMh5Y-mcOnRpRnR0D8OSnfQKhY2Uv-Whan4dI2BjfjJumkNiaTx_XMyBRqzZhzJ8KnO_d5tMqtcp3r8gEpQdtpfIO-0sI22dnOM_VNpogryHw0qesl6-aCm11RsKQek9ZecZduIbSOtfJ5HKegJNpAGbFMJfoh49cTNnc6NTyRAlkACmkgwh7wYdR5nmPBS7W3MU3zGLkspg24GTCAOe48pCXiNjdV6XNgBQaRpyrgbFsnT37hkKi9MFGLH9CPEwqGIgco03CzPhaeATxu4vW905d5ifhvmSP_CUF78VprXFZOTGy3vZabmiYHHz9W2eCpKnllueVlk4EonYyaQ_irEMdY_UIDVvhLPdrE2Mjvr2zwReqceLQPSGgEcvaKhD-FvST54tK14YsfoDcL0lXo1d-CZTPS6sna5OmekjJgBq4GDpVJZ4uflVyh5s-O7gsa55WhGmU5d5GY989_Tp_2ZrU2GAHi_swrQgvRSiLTkw_NyOLigPHqZcYABiyWe9wBmlLZkuXWI0cr&sai=AMfl-YSg2ABEQP5WRh8_B95ZNW6h5rKJoHUmny_nZawErT96uzHJDDZ2XgeG-FyqJfKIsfU6mN38U_ov36KsGgPwU6u1VK5f1pPrI1p5et2GL-OWLC_M9x6QewQjPZp_EwhjPJSCafkDEumAnNc7eRtm1Bt49pGIqA&sig=Cg0ArKJSzNjlHEXq_DhAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=240&cbvp=1&cstd=237&cisv=r20220104.93982&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 10 Jan 2022 16:52:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dpixel
cms.quantserve.com/ Frame 75AF 35 B
210 B 12ms
9ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENMarM9BhpD-0pAEuBtwKUo&google_cver=1&google_push=AYg5qPLDiCkAl6viyaGQCN9VcYPfRSsnOwqKyVNPCbzEr5MWPCy7GFblugUd4xgSBMjrYwn3l_Q538NHywuS-h6b9kYMnkmswFg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 75AF
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEBz78_AkQjSh_64WJPOYuCU&google_cver=1&google_push=AYg5qPIqjKzFYpmC-_nfcKJ9hZSryc3iydvRjeFRDMWHqncWuEHWaGLbyjRw-hZKrZNQp4sKFLE1pe4I-fQ_DlF9Ssq0lSrnOko
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIqjKzFYpmC-_nfcKJ9hZSryc3iydvRjeFRDMWHqncWuEHWaGLbyjRw-hZKrZNQp4sKFLE1pe4I-fQ_DlF9Ssq0lSrnOko&google_hm=Q0FFU0VCejc4X0FrUWpTaF...

170 B
188 B

70ms
70ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIqjKzFYpmC-_nfcKJ9hZSryc3iydvRjeFRDMWHqncWuEHWaGLbyjRw-hZKrZNQp4sKFLE1pe4I-fQ_DlF9Ssq0lSrnOko&google_hm=Q0FFU0VCejc4X0FrUWpTaF82NFdKUE9ZdUNV

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIqjKzFYpmC-_nfcKJ9hZSryc3iydvRjeFRDMWHqncWuEHWaGLbyjRw-hZKrZNQp4sKFLE1pe4I-fQ_DlF9Ssq0lSrnOko&google_hm=Q0FFU0VCejc4X0FrUWpTaF82NFdKUE9ZdUNV
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 75AF
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

69ms
68ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLT0jJRZ1HRWLE7vwft_gBJx01J86jOh9qudzZQVpCTVfQWnIt-CoyiLCjxBgaRJhSZy_kwLfjbX1zn3m6tZXUo9EfNtYU

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLT0jJRZ1HRWLE7vwft_gBJx01J86jOh9qudzZQVpCTVfQWnIt-CoyiLCjxBgaRJhSZy_kwLfjbX1zn3m6tZXUo9EfNtYU
date: Mon, 10 Jan 2022 16:52:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 75AF
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEB4qQZ_jboTteEcAmdtmIWs&google_cver=1&google_push=AYg5qPKgZ4QqKO1gxSIp2izW7FTOehF0Gy5_LJBv4BtGg4g62JJxUk6nA8S8Z9LbofHgIa8qkpi...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHSDgtVy1DVFRa&google_push=AYg5qPKgZ4QqKO1gxSIp2izW7FTOehF0Gy5_LJBv4BtGg4g62JJxUk6nA8S8Z9LbofHgIa8qkpi7RrjXLuL2IqcWVtzhe3o7eA

170 B
188 B

66ms
66ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHSDgtVy1DVFRa&google_push=AYg5qPKgZ4QqKO1gxSIp2izW7FTOehF0Gy5_LJBv4BtGg4g62JJxUk6nA8S8Z9LbofHgIa8qkpi7RrjXLuL2IqcWVtzhe3o7eA

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHSDgtVy1DVFRa&google_push=AYg5qPKgZ4QqKO1gxSIp2izW7FTOehF0Gy5_LJBv4BtGg4g62JJxUk6nA8S8Z9LbofHgIa8qkpi7RrjXLuL2IqcWVtzhe3o7eA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 75AF
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&google_push=AYg5qPK4OrsWvRi0WfftHH8g1pGjTi5JwFmvW...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 75AF 43 B
296 B 46ms
20ms Image
image/gif 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESECa-B3zY2_GPSiq5tR_UEUA&google_cver=1&google_push=AYg5qPIEMGTDQz3E2fZ7o3liKBE8ujm2sljdtqZnoMQ9ebtaAoCAGxeI2i0-O2FQvopSgMphIefaxR9nsL8TxNMuj7s4Q4avySM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1641833525&psa=0&format=300x250&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522548&bpp=1&bdt=339&idt=2930&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90%2C728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=Bf1oAm9rOe&p=https%3A//zvonil.octo.net&dtd=2933
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 75AF
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELAhH9fe05YKefDSXMe-lYM&google_cver=1&google_push=AYg5qPIsLIXfutn8upzUa-2O...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIsLIXfutn8upzUa-2Og1Wm4xkRbzVGHl3dzWNYay0uydpa_PkGh43UQcmIR8m5O73QWIfkm2Ma4AHEXn14ddGDVrZvwid-&google_hm=

170 B
188 B

71ms
71ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIsLIXfutn8upzUa-2Og1Wm4xkRbzVGHl3dzWNYay0uydpa_PkGh43UQcmIR8m5O73QWIfkm2Ma4AHEXn14ddGDVrZvwid-&google_hm=

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIsLIXfutn8upzUa-2Og1Wm4xkRbzVGHl3dzWNYay0uydpa_PkGh43UQcmIR8m5O73QWIfkm2Ma4AHEXn14ddGDVrZvwid-&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 09 Jan 2022 16:52:06 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 75AF 0
12 B 64ms
63ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LEq2iEuBDYBo7ldiaMV9yasNNS4BT5ErDH9S4bkQZwVH7Uyx1YsibggQg_7Rz62aRbPAqziA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js Show response
pagead2.googlesyndication.com/bg/ Frame DA48 35 KB
13 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7821e6a538cc11ee4c5fea34be8c61b4b888c96338f6f0d22be66b5519c7615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 14:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Jan 2023 14:54:00 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 2316 81 KB
11 KB 60ms
47ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1grdgg7qhhv2b61cfdpbs49nz8p4nf7q7cmqefqahhw2prph1k78bggwgs5y6fm1h7bpq4r080mnhaecdc3zsycavnxbq0732zkhvphq0e7j3jzz10de85r3d7m2v6tswfq92d4zt55nw8jnc9gx57v0hcyzre1evajqpjsx1qdfc9nsy5kjsagnatj3p57kymaa7tmmyt20qys00caeae47ae41ansptcmvfr2kr0g1pgw8wc4amvzr4gx3tz36mzbtgk8ddqjpms0fzzarbypfmmeam3py76a0v4yj7rv7v196dqthqp6zxyyd7gpj22j8nkfyqhjeam308jhfndhwhc55768rq0erjsrmze8xh9a6qa6g8axzym4pdht1jwr36ty7jfxsav2k71dt7xmxzst5cx0a8kte0x0jc0asjkregm1xc&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1grdgg7qhhv2b61cfdpbs49nz8p4nf7q7cmqefqahhw2prph1k78bggwgs5y6fm1h7bpq4r080mnhaecdc3zsycavnxbq0732zkhvphq0e7j3jzz10de85r3d7m2v6tswfq92d4zt55nw8jnc9gx57v0hcyzre1evajqpjsx1qdfc9nsy5kjsagnatj3p57kymaa7tmmyt20qys00caeae47ae41ansptcmvfr2kr0g1pgw8wc4amvzr4gx3tz36mzbtgk8ddqjpms0fzzarbypfmmeam3py76a0v4yj7rv7v196dqthqp6zxyyd7gpj22j8nkfyqhjeam308jhfndhwhc55768rq0erjsrmze8xh9a6qa6g8axzym4pdht1jwr36ty7jfxsav2k71dt7xmxzst5cx0a8kte0x0jc0asjkregm1xc&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%26client%3Dca-pub-2979533909392588%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 615376
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Mon, 03 Jan 2022 13:55:50 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6cb769f18e6d2bce-FRA
cf-bgj: minify

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 2316 36 KB
13 KB 36ms
25ms Script
application/javascript 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1grdgg7qhhv2b61cfdpbs49nz8p4nf7q7cmqefqahhw2prph1k78bggwgs5y6fm1h7bpq4r080mnhaecdc3zsycavnxbq0732zkhvphq0e7j3jzz10de85r3d7m2v6tswfq92d4zt55nw8jnc9gx57v0hcyzre1evajqpjsx1qdfc9nsy5kjsagnatj3p57kymaa7tmmyt20qys00caeae47ae41ansptcmvfr2kr0g1pgw8wc4amvzr4gx3tz36mzbtgk8ddqjpms0fzzarbypfmmeam3py76a0v4yj7rv7v196dqthqp6zxyyd7gpj22j8nkfyqhjeam308jhfndhwhc55768rq0erjsrmze8xh9a6qa6g8axzym4pdht1jwr36ty7jfxsav2k71dt7xmxzst5cx0a8kte0x0jc0asjkregm1xc&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b98c8f3aa7cc2835be32fd3a1488ba31a3de35a3fa0dd643a092c2846c613017

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=i2G9+Q==, md5=KT4B161Aam0qyQ5N1n+FMQ==
date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 69823
x-guploader-uploadid: ADPycdsOKTGHIoWahD0TZTQoYWUEfcQg0132oq9AD9469QffPzMPQd5lf_jiilD5Vec202kqqI-Hxsh29ygvyTXNSQg63d9QPA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 02 Nov 2021 14:54:41 GMT
server: cloudflare
etag: W/"293e01d7ad406a6d2ac90e4dd67f8531"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sxt7OUeS7KOOYllVtZRuJycVO0yjxgSJmxe320cetK9iqiWs4Re5FcN1%2BJDWER%2F0CKCxNNADd13TTLeq5Yd%2ByvVARwMYbU5AdWqQ3QHpFJpMZAu8fAytZOOKaCaPVJiTN%2Fa0%2FUQ%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1635864881199576
content-type: application/javascript; charset=utf-8
expires: Sun, 09 Jan 2022 21:28:23 GMT
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length: 11933
cf-ray: 6cb769f18fb95c92-FRA
cf-bgj: minify

GET
H3 200 94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js Show response
pagead2.googlesyndication.com/bg/ Frame 9253 35 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7821e6a538cc11ee4c5fea34be8c61b4b888c96338f6f0d22be66b5519c7615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 14:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Jan 2023 14:54:00 GMT

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 2316 3 KB
4 KB 84ms
53ms Image
image/png 2606:4700:20::ac43:444e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 10333931
x-guploader-uploadid: ADPycdu4kVh88oPygz4q2L0gysGWlMlIFE5YReoxzb2pqvToqgh3BYrLqoA2iyx1syc2mGJLpBFm-K4K9hJXRMmcJywY3ItGvg
x-goog-storage-class: STANDARD
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3262
x-goog-meta-
last-modified: Wed, 09 Jun 2021 12:35:14 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vnzXErbAIbZ2B%2FhVOsiq6kaQgdsIqGj2Y6EWg%2FtF2xRTMLfVT1KBVaKBuRcPuuWEobjD5xBhfBUCnkl90Qg9wJ1d2SAy3c0l2AU4nOZA9yVGI4Y5nfB%2FcyfY%2FUTCRgmLSPMDYhY7EyQliN0Eo9KunS5M"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1623242114099744
content-type: image/png
cache-control: public, max-age=31536000, immutable
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 6cb769f279ed8bb7-FRA
expires: Tue, 13 Sep 2022 02:19:55 GMT

GET
H3 200 main.css
s0.2mdn.net/sadbundle/4058801387234918400/ Frame 39BC 951 B
437 B 43ms
43ms Stylesheet
text/css 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4058801387234918400/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb77c53aa954104a3d2223906f0778b95a229f01a50da5fb71d4eb15924ba35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 19:53:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507511
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 408
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 18:26:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Jan 2023 19:53:35 GMT

GET
H3 200 Enabler_01_242.js Show response
s0.2mdn.net/879366/ Frame 39BC 107 KB
37 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_242.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7effa4abb1004ac11058d1fc73b1ebb9cbf993bc96dd96be50ba81ba895bd69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 20:30:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73317
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37452
x-xss-protection: 0
last-modified: Thu, 06 Feb 2020 15:49:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 20:30:09 GMT

GET
H3 200 O2O_GDCS_18_003_ML_300x250_pkr.js Show response
s0.2mdn.net/sadbundle/4058801387234918400/ Frame 39BC 8 KB
5 KB 56ms
56ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4058801387234918400/O2O_GDCS_18_003_ML_300x250_pkr.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

366c4f5bbac08ff7b48f42657b407bb0f8e69a59d4583eaad69d499fb76f2e9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 16:09:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 520932
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4612
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 18:26:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Jan 2023 16:09:54 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame AFE6 118 KB
40 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 20:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71926
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 20:53:20 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame AFE6 60 KB
24 KB 79ms
79ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H3 200 frame.html Show response
ad4m.at/ Frame 9741 2 KB
2 KB 45ms
45ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-type: text/html; charset=utf-8
x-guploader-uploadid: ADPycdul5Ccw7d7rhgjk4K-9bNVBIMJUbbihzRGNqm4eKjFMeeucQ20B3FnwIcyOYympdB6UUlF8mlNguKXZm3TvRLI
expires: Mon, 10 Jan 2022 17:52:06 GMT
last-modified: Wed, 06 May 2020 15:09:30 GMT
x-goog-generation: 1588777770164783
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1681
x-goog-meta-
x-goog-custom-time: 1970-01-01T00:00:00Z
content-language: en
x-goog-hash: crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class: MULTI_REGIONAL
age: 94010
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBQTujpP9aqUJkWANKgMWkY7lsbHgI%2FJx27ywl4kQ8YLEaUJ0LzKNIEUEOTu%2Bx9sOPKVIHeQU%2B8UGD7kF1txzHUf%2BnUpX06vezTuMkWA4vg79O2A6%2BzrIIHZLODPXaysu7Q4yZ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6cb769f2785b2bce-FRA
content-encoding: br

GET
H3 200 delayed_impression_vu_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/impression/ Frame FFB4 17 KB
7 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/impression/delayed_impression_vu_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522544&bpp=3&bdt=334&idt=2911&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&correlator=4546408942356&frm=20&pv=2&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MRshbHzpLB&p=https%3A//zvonil.octo.net&dtd=2926

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3b31cac154e2d93e29bae439fdf51ceccf4ecb9f5ce1cf4e1b230aa93cb2541

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 11:22:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7542
x-xss-protection: 0
server: cafe
etag: 14927170169065611122
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 11:22:27 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame FFB4 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:45:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame FFB4 15 KB
6 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FFB4 120 KB
37 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame C9CA 2 KB
1 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522547&bpp=1&bdt=337&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sBlaXXPKAg&p=https%3A//zvonil.octo.net&dtd=2929

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
server: cafe
etag: 9753579932288205849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:45:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame C9CA 15 KB
6 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6485
x-xss-protection: 0
server: cafe
etag: 13366392639478751132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jan 2022 16:51:26 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C9CA 0
0 97ms
48ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRzWNQ2y8YtpEgU2S85VpyHgKKnhawwkrLCG8VkOX_ozAvrxS6pKBw0sJl4SMyaApP5d5fh3r2tG8o1fOqm2T1SfytKzA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522547&bpp=1&bdt=337&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sBlaXXPKAg&p=https%3A//zvonil.octo.net&dtd=2929
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C9CA 120 KB
37 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78bac7c2d4ad157ca2d43d12d1cdc08ab7943d3535287108ed9e6b8ff9da523

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37632
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641385868096614"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C9CA 0
0 81ms
80ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CCIiyNWTcYfqUI8fG6wTa04TwDMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAsZopju3AbM-qAMBqgS6AU_QeY2NOG2yhuisaYL19HpyS6yL60pwR6vVllZ2DjVzUtUranxnRPkNEQyEZWpwGNjlwUYx0LhkMzhZDUp97HpfBPNmJIniKdPARJsrAUqWAF4wA3evAn9rMhMXKY1ffOhiKK-DuUN-ironGCHsw5g-cpfca_dL9SsndVqwGH1nVRawQ9F9MKeFpQBmjRlHgZu4DilHp4EA4OfV2flrwv_0eJxtkLEEnthHJHHoVUPZbxJAUu1uyC1xCIAG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMjk3OTUzMzkwOTM5MjU4OBgA&sigh=abIt_tr_aNk&uach_m=[UACH]&cid=CAQSOwCNIrLMh0WXL9dbqkpSstamn2JbUxIZLTpNmJ0liBazXLvxvBBD-tI2PZ6Nz25W0QXLkPw0b2eB6Kz9GAE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522547&bpp=1&bdt=337&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sBlaXXPKAg&p=https%3A//zvonil.octo.net&dtd=2929
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 16:52:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame C9CA 0
0 92ms
50ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EN6BMNgFWp2DYgICAAAASV-pTuvRD9cQNWTcYRDOr0MAm6YsoamzABI&wp=YdxkNQAIynoKmuNHAAEp2npywCSJQt-TMglwGQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
server: Kestrel
server-processing-duration-in-ticks: 296831
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 69F4 162 KB
52 KB 195ms
153ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIynoKmuNHAAEp2npywCSJQt-TMglwGQ&u=%7CDUzBKHzfmDz%2F5J%2FmhxnyPSPlVKvPdHV7PhX4g7P9cVg%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbzim9cAw_Y5iWQiPQEmhFHCW7ka1o6UFoQkNJDYKUOA-Gg2hN6hUqU52Dp4BfGB7UlcBwMTgT0GCja8huy3YP1UJ8y2Ewy2-e1Vu6CIHPhr2tcqtX_ntsrlx49xXHkns7OyElQiLjiXT-CmHpAZTW05bHT79yFaW_p2PZLnJ1lXwZHtCNQ26HElS1JsGF1DJAfKZVxknrsfassj2AzkVUQ7bmGpGlNFdxSvEUjIGViRshHfa1TqJApK_dGfmfQ1dtOLyf0-uTe3UnjWRvEa-mfubRJd1HdfBGQJa5eZ23fZxmCbMOQoM_KXsRDq-ozXZpRdro8Amjc8KFoU3vQofpI6cD_qv8VxKrf81Y8iu_EpX1-9CiI2sdM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmb2tNWTcYfqUI8fG6wTa04TwDMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAsZopju3AbM-qAMBqgS9AU_QeY2NOG2yhuisaYL19HpyS6yL60pwR6vVllZ2DjVzUtUranxnRPkNEQyEZWpwGNjlwUYx0LhkMzhZDUp97HpfBPNmJIniKdPARJsrAUqWAF4wA3evAn9rMhMXKY1ffOhiKK-DuUN-ironGCHsw5g-cpfca_dL9SsndVqwGH1nVRawQ9F9MKeFpQBmjRlHgZu4DikFpaCSZ2hJykb31lwkRTqVmaUOKNJpPPNcnX5_na1efvXrYqlit70U5IAG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1OBMFxl2d9gVZu14LU39rAQSSoNw%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

377c452d6a216d38720dc7a3ab8104950d774e64c047bee1e3ebf443506ba4df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=xkCcIyahwQj0MFNynNrIe2RvCghJDWbaNScmtRkVAyAquE3viX-O6T7zTMPa1E4nq8W9riL-ClU1mfTOtGDjz4GmBDGDqw05iQtWIiWh06gtvlGfEGs5a_RB5Fpl7ob-PBd_S6Mhk7rF_4dZnG1o9_fQJLwMvUV2yg7qGi64KuhEH42Xo2G3CYskFTkxgHtVvu2vsxlBt9ZxLbiC7t6rTAZRGXYMkrE2OYr9poUGoctJtw56wRFomgbG3BRtGLpEkMUooQ"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 125646015
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2BC4 1 KB
749 B 40ms
40ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 05:53:44 GMT
expires: Tue, 11 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 39502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ Frame 39BC 94 KB
33 KB 122ms
40ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 15:06:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33507
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Jan 2023 15:06:39 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame A86B 192 KB
56 KB 152ms
152ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIfOgIu-T_AARQNMSQfXAi9_7YTEmKVQ&u=%7CDUzBKHzfmDxHKVVWyplevKB1UtRtQyukpvTGsrDx%2B9k%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbP3qvTSeNBAxVWJSebxayJ0HX3AQOIxCJ64MSc--FOnC5L97O63YXKZtocpPpVbwblO_4P7du5f7Czn0BEVkENB16YvAnIo0C2tMdfPPsenrNtPfLptHPP2d8JUpBCUZbiiExYd5PmD-KwLmd-poQXzs9gsdsDMGNg9nwQ3bY_VPrPdvbzLdHxIdKVkbXNKxJI_LlZB8oFmNe9jNsOlfPvHmuZtFKs-_0OG5GVwwn0Pd-8q1w2UGGXV-1uyJ86QyO9TUSzGc3rGK0MHn6XdsEGn5JznXC5DvOxSG5mgYeI_3Qrq_PAH-43Xh0TcvN9AtR5cJNeg_OgOHRvDOaEbuHyi7eoZkE9gAMoIiMyM6j6mePUMz_yRAXB&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCP6j9NWTcYej5If_J7_UPtKCRuAXJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAdW20uoDyAEJqQLGaKY7twGzPqgDAaoEvQFP0CWfZXdnJYGYWunsOgUarjeuQaUzKlIBaNi-Tjrs6h7Z4TkbLoszG-8Y00l72Uf3oK8frc9ZszjoNY0XNPKJAz3Vs_DJuAuSGNy-UXxdYPwdVwqCIvORaTpjSzH5L9eqJAsZeOHQk5JrrT9yDPV6F0S5VlTrAA_sCNWfAwnyWURaMQ98blx-iGFEu3VKkz90hbCWSTrL7mX_cv4J7IJ1I_iyOxAy0eMyOYY7mE6HaTxaC1Z1CjYQzj60epGABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_13j7IJUo8QW0_81oxXG46xI4eY5Q%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

60eefa63fce5af7942fc8fbb5b5223cf38a6a0f269d6dac10b4537cb01d95889

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Mon, 10 Jan 2022 16:52:05 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=lLT2riahwQj0MFNy8IXJZJIV98EwARa66RcFZSx1hCUkCp3lhRR8gjUBkyxfzQTs_UH9MGBnm6qonKTwb6dicZm_SpjHXDb4-AKJqGSuzCV2lVpHOTUn0NalVaJxQKOipVHA1hsgKdFkISas1A03kgDds0QIY-Vct6cdZK0U3tC3DwT58RJPe7xDFx-oKMwXpROpSCtdrOa6Ylq90Kn7x1yi706LQ_on-CcRyAlV8kPcXOXOjVnWe3IL6YeyIKvv5dmGXg"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 128999450
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E64A 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 10 Jan 2022 05:53:44 GMT
expires: Tue, 11 Jan 2022 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 39502
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FFB4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7674f81b8bc4427bdb174b7d44c8ba0bba102c89623a6968ea38e86d05582c9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C9CA 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31cf34c745e103a07b8c96194c71c859d8caaf0ed9ed5cdf65a0fa51c09d4464

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 82AC 0
23 B 125ms
77ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuHG3Lh-ENY6N8HVpks0ILd5CDJ6AMK0JeVr8qBi4pqcdg6h-FDehm9V8awZT8Duq1jWwpAuqourzxgxKzUcFV0ZmvKXEsV_n3yZFhTz6n_Ecb3kaCAYlzk-RFUd0smNGMkUdZYsSvr9Hl0ZTybPqXPqZTZ0bo9AhvQPAvk6lJ-SJafQBvD62D0ztT1YBvBrVRk5cllBxuWJpBkQj8euXtRQu5CczHZa_kJHVOzhhXkTaS7NIu7NgcNW56kMEWkfzDnK5knjE-gRAIcKQPBiX5HpVA_ohwUPVnq_pOpHlzAcU7eWx8ZI9Ag-_IDm556T7OZ5-oCMPp33Ziuq2j9wevXFI2T-O8iUL4R408FVahkpElpX6MBPsixhxnaVQwkLmbIbisQqkjmQRSb2tNn-otnI8iyS-4oQF-j7OOBz84DSZYlA8V8kXbQfbPLt3Wk77AdbzVzosuaSiGXKq9WNxx4WFb6iQ9ycA33VSGGaPi9u9Xk8BYy51JhBcaYm0SjREtXHzf1N1ozJOKcTp609N43iWE0UMMMh2ZrwKfAjq-bAFRp_yGaxY7ajjIX_H8wI2W3PxQ03XLDJ0W49MUO0zNU8yX8DwVq8sCyakKmwBRB8PS-HOZByKxgzAiYiWStwBHj1Ph08iZQ9I6l4E-s1_HPegUYiPBMh5Y-mcOnRpRnR0D8OSnfQKhY2Uv-Whan4dI2BjfjJumkNiaTx_XMyBRqzZhzJ8KnO_d5tMqtcp3r8gEpQdtpfIO-0sI22dnOM_VNpogryHw0qesl6-aCm11RsKQek9ZecZduIbSOtfJ5HKegJNpAGbFMJfoh49cTNnc6NTyRAlkACmkgwh7wYdR5nmPBS7W3MU3zGLkspg24GTCAOe48pCXiNjdV6XNgBQaRpyrgbFsnT37hkKi9MFGLH9CPEwqGIgco03CzPhaeATxu4vW905d5ifhvmSP_CUF78VprXFZOTGy3vZabmiYHHz9W2eCpKnllueVlk4EonYyaQ_irEMdY_UIDVvhLPdrE2Mjvr2zwReqceLQPSGgEcvaKhD-FvST54tK14YsfoDcL0lXo1d-CZTPS6sna5OmekjJgBq4GDpVJZ4uflVyh5s-O7gsa55WhGmU5d5GY989_Tp_2ZrU2GAHi_swrQgvRSiLTkw_NyOLigPHqZcYABiyWe9wBmlLZkuXWI0cr&sai=AMfl-YSg2ABEQP5WRh8_B95ZNW6h5rKJoHUmny_nZawErT96uzHJDDZ2XgeG-FyqJfKIsfU6mN38U_ov36KsGgPwU6u1VK5f1pPrI1p5et2GL-OWLC_M9x6QewQjPZp_EwhjPJSCafkDEumAnNc7eRtm1Bt49pGIqA&sig=Cg0ArKJSzNjlHEXq_DhAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=516&vt=11&dtpt=276&dett=3&cstd=237&cisv=r20220104.93982&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FFB4 0
17 B 76ms
75ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cp33NNWTcYej5If_J7_UPtKCRuAXJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAdW20uoDyAEJqQLGaKY7twGzPqgDAaoEugFP0CWfZXdnJYGYWunsOgUarjeuQaUzKlIBaNi-Tjrs6h7Z4TkbLoszG-8Y00l72Uf3oK8frc9ZszjoNY0XNPKJAz3Vs_DJuAuSGNy-UXxdYPwdVwqCIvORaTpjSzH5L9eqJAsZeOHQk5JrrT9yDPV6F0S5VlTrAA_sCNWfAwnyWURaMQ98blx-iGFEu3VKkz90hbCWCzjqfOJw7u22cJbW88UUwxkm21U4F565LIa6z87lFXptj5yU3YGABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI5Nzk1MzM5MDkzOTI1ODgYAA&sigh=iy6iTx1xdhI&uach_m=[UACH]&cid=CAQSOwCNIrLMDvHMdkfK-AfBsxSmVM437NYHJWprjfhHXWNbw8uYj-WOSJoR_5KE5lb4KseHgB0yRK8Dyl1-GAE&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522544&bpp=3&bdt=334&idt=2911&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&correlator=4546408942356&frm=20&pv=2&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=MRshbHzpLB&p=https%3A//zvonil.octo.net&dtd=2926
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 10 Jan 2022 16:52:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame FFB4 0
125 B 51ms
16ms Image
text/plain 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EN6BMNgFWp2DYgICAAAA6tM_jvcn4xUQNWTcYUO3uA__FMS9ptZHABI&wp=YdxkNQAIfOgIu-T_AARQNMSQfXAi9_7YTEmKVQ&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
server: Kestrel
server-processing-duration-in-ticks: 214434
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENMarM9BhpD-0pAEuBtwKUo&google_cver=1&google_push=AYg5qPLCMU12KwdTxNf229L3Xcb_tOS50mne6cYnpkilCShhcs6ckGEasZ...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLCMU12KwdTxNf229L3Xcb_tOS50mne6cYnpkilCShhcs6ckGEasZdpX7Yzbcnh6KA94DvmuOFkb0ZojpEH0DZ0D-JRWg&google_hm=zWhXkdUd...

170 B
188 B

70ms
69ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLCMU12KwdTxNf229L3Xcb_tOS50mne6cYnpkilCShhcs6ckGEasZdpX7Yzbcnh6KA94DvmuOFkb0ZojpEH0DZ0D-JRWg&google_hm=zWhXkdUd7UbVosCZq08BXA

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLCMU12KwdTxNf229L3Xcb_tOS50mne6cYnpkilCShhcs6ckGEasZdpX7Yzbcnh6KA94DvmuOFkb0ZojpEH0DZ0D-JRWg&google_hm=zWhXkdUd7UbVosCZq08BXA
pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIOkeYM...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIOkeYM...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDA0MTI4NzQxMTAyMA%3D%3D&google_push=AYg5qPIOkeYMsljn924dSmnbr5RgQSmvsoLNyl6YZQtGlq7B_32G4rJ5EQ7nH4GxsibDkb...

170 B
188 B

71ms
70ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDA0MTI4NzQxMTAyMA%3D%3D&google_push=AYg5qPIOkeYMsljn924dSmnbr5RgQSmvsoLNyl6YZQtGlq7B_32G4rJ5EQ7nH4GxsibDkbbLMHEvjH2PnyyuYJoL4mnFtRMn2Q

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDA0MTI4NzQxMTAyMA%3D%3D&google_push=AYg5qPIOkeYMsljn924dSmnbr5RgQSmvsoLNyl6YZQtGlq7B_32G4rJ5EQ7nH4GxsibDkbbLMHEvjH2PnyyuYJoL4mnFtRMn2Q
pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 2BC4 43 B
64 B 38ms
23ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEE8pNBmcUrIuN9yUbd5owK4&google_cver=1&google_push=AYg5qPK9Md-YY6wACR8zFGiD5_wKsaPHXLbOdLqZHVz7ikQmuLSlgvyVJf5ZepizRHUWipRvqfYzOC5d1qxXSk3-puXZIWd96A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1641833525&psa=0&format=728x90&url=https%3A%2F%2Fzvonil.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641833522547&bpp=1&bdt=337&idt=2927&shv=r20220104&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5b683a3b632f1206%3AT%3D1641833524%3AS%3DALNI_MbKIrvxOZqMFuG16C_qdUXke6aBkQ&prev_fmts=728x90&correlator=4546408942356&frm=20&pv=1&ga_vid=1713494463.1641833523&ga_sid=1641833523&ga_hid=672920293&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1109&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750773%2C44752536%2C31063859&oid=2&pvsid=2055215971416315&pem=353&tmod=662&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sBlaXXPKAg&p=https%3A//zvonil.octo.net&dtd=2929
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: u5tej5krt35u8c71drh3co14tg227np7

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

65ms
65ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK1TDpkqJQWVQW4GaZ7WBVLM6xyKtWKYSsPIn9Ret0E4nz_TCUqVYiV9mdwSolFb7l6Tcsu3_st6h13vrVcXf1PtRYpK4I

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WuVg4wuwTLiQ4lDGRr7DHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK1TDpkqJQWVQW4GaZ7WBVLM6xyKtWKYSsPIn9Ret0E4nz_TCUqVYiV9mdwSolFb7l6Tcsu3_st6h13vrVcXf1PtRYpK4I
date: Mon, 10 Jan 2022 16:52:05 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEB4qQZ_jboTteEcAmdtmIWs&google_cver=1&google_push=AYg5qPKg0hc0lTLUMz-w1wl4FQj1gya0KJx9t2cNX28lFlSdAZK7K4_aPF3-0APnA-0epdZH-VN...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUUktMUUtODhUVg==&google_push=AYg5qPKg0hc0lTLUMz-w1wl4FQj1gya0KJx9t2cNX28lFlSdAZK7K4_aPF3-0APnA-0epdZH-VNUu8ftPSFqAz6cI2l4NOfELVk

170 B
188 B

71ms
71ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUUktMUUtODhUVg==&google_push=AYg5qPKg0hc0lTLUMz-w1wl4FQj1gya0KJx9t2cNX28lFlSdAZK7K4_aPF3-0APnA-0epdZH-VNUu8ftPSFqAz6cI2l4NOfELVk

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUUktMUUtODhUVg==&google_push=AYg5qPKg0hc0lTLUMz-w1wl4FQj1gya0KJx9t2cNX28lFlSdAZK7K4_aPF3-0APnA-0epdZH-VNUu8ftPSFqAz6cI2l4NOfELVk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAJ1cqQqLQ7Gq6Z2GNUDwXk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdxkNeIkyQHzpc45dXe5VQAABIkAAAAB&google_cver=1&google_push=AYg5qPLx9GmfISRNXGmNhTol_6alOsTV3yzG9O-iaf0csVmk0H2dkRdjAPNnI9F9QfFrrPWUNaOx...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2BC4
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESECa-B3zY2_GPSiq5tR_UEUA&google_cver=1&google_push=AYg5qPI6NFY7sVOvCuUozfP5bzegTWIn1hVYdbwa9ROU62qok-TAauZ9-2Adj-MRcHfEe6UKfhgEtMbruU7orRQrLetEizs...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPI6NFY7sVOvCuUozfP5bzegTWIn1hVYdbwa9ROU62qok-TAauZ9-2Adj-MRcHfEe6UKfhgEtMbruU7orRQrLetEizsfFb8&google_hm=ZoiiZXFATGyxX_j-H...

170 B
188 B

70ms
70ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPI6NFY7sVOvCuUozfP5bzegTWIn1hVYdbwa9ROU62qok-TAauZ9-2Adj-MRcHfEe6UKfhgEtMbruU7orRQrLetEizsfFb8&google_hm=ZoiiZXFATGyxX_j-H8s26Q

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPI6NFY7sVOvCuUozfP5bzegTWIn1hVYdbwa9ROU62qok-TAauZ9-2Adj-MRcHfEe6UKfhgEtMbruU7orRQrLetEizsfFb8&google_hm=ZoiiZXFATGyxX_j-H8s26Q
pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2BC4 0
12 B 53ms
53ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KvazYUbWo-xxXC08blvcd3c_llcA5XGG08ih7fGtLWYf-0QYAVfqzq9W4DKpnT0pW-OpCd

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 CodeProLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame AFE6 52 KB
52 KB 40ms
40ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProLCW05-Regular.woff

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65ec5e0481c4ceacde8c5e8fab9d5305fc68496b8c75d7d58fb0e91feaf7f598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:37:15 GMT
x-content-type-options: nosniff
age: 891
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52901
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:12:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 16:52:15 GMT

GET
H3 200 CodeProBoldLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame AFE6 48 KB
48 KB 45ms
45ms Font
font/woff 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProBoldLCW05-Regular.woff

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92426eb5437b357b9046670556ba89baa8384edcc8734f56b813745bdb9e1cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:37:49 GMT
x-content-type-options: nosniff
age: 857
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49198
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:11:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 16:52:49 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AFE6 6 KB
4 KB 97ms
50ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3857ee98e103734c8f22fdaf5fbc1e1fb981ab962d5e7c68299ef6e8d2ff842e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4335
x-xss-protection: 0

GET
H3 200 60005582_20211005070111681_Fairphone-4_Asset.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AFE6 49 KB
49 KB 52ms
52ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20211005070111681_Fairphone-4_Asset.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c8e35682f9de616e971e7b8282543679b8d310fe9822467e439e841f68c777

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=qMQeOb6j8k&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 09:53:59 GMT
x-content-type-options: nosniff
age: 25087
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50567
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 14:01:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 09:53:59 GMT

GET
H/1.1 200
OK postview.gif
portal.blau.de/nws/img/ Frame AFE6 43 B
616 B 32ms
9ms Image
image/gif 82.113.101.236
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.blau.de/nws/img/postview.gif?partnerId=BLU_DSP_TRA_HAV_34114_PV&mediacode=26952485_4307561_323347793_154734726_PO3502A&ref=26952485_4307561_323347793_154734726_PO3502A
Requested by: Host: zvonil.octo.net
URL: https://zvonil.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.236 Obertshausen, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.blau.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 16:52:06 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA48 0
20 B 76ms
75ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BD3GBNWTcYdmkJvOR7_UPmvGr-AgAAAAAOAHgBAI&bg=!UFOlUxfNAAbDtiZlw7Y7ACkAdvg8WlYKUezgkMvWGN46TWNPrvtkroyir_rYuDyqDPKDfCE5erDn4wIAAADNUgAAADdoAQcKACVnGD0vHGAGBa2XiEvE51lbNoNkUk9nzTq9fVnnQhLDP1Sv7AQYmQLfXkKURFZE2GcX9AsYexhyEHkIkwnrYOXJrWtqOpEYxJlKqFasbhXwBviewOcL_zp15tfKtFL-k1tUJQNzHHMc8vORYUg9esqtxCTiD4S77-5k5BOC4DFfsNusvcHfSBl-DFmP-bwoCWfCf-x2SzwMsSR5BEaWjGuiJCO8qOO0lGfQkbiiT_49sv8JPG-nb0fVIF3ODDbJ3WQkUO6uE6WZrG4rebXGftsV-4wN-QjBuxQPD4qfZbW5rbraN_4WnHdSO1UjB7UfUUBcDGEm09I3oVISGNF_E8E1tRMhUaQxMosCCcCSEqNvcuwBtdUH3M_3O9j5v8yKvQRI1bmxYPlQtLKjwyurk6aSXhdKpPCBGVl85pxgbrATc9fih2B_3HqX7aoBHlAC6fB4oNEzzPwU4_CiccB0vm_m0NjazGg0IflsL4F-b8zzg3vzMjQz-w1rjkqGSUFCanz5XBbMLFh_IP87m-nOdTQqJkD5uJK4QoS9xwTA9CIWC8qUm7ZKjTcSwH7_WxcfZE4iYBPbUKC_9yyyZ2fi8mzrqL-iw4XFxR8BWl_Ppeizzpaz-H4GcCe_oFg2IVIzLH466s4fC1__EkkRINJQcoUP0weuK8EchnSOliVrRUNmB5noHas9B0Pb-bgvx1qxdY1YdLsbWEsnZkc_x8o-4fqFbQHm6N4-aVlTWJHnLYSItl-nYF8ESqnWMQVdHZrNZV69lDCV70ThnZUCBM25qGaPtkv5apuG_Y14htS1ugOqDVrgjcmrDvrjOqNcxlxiKMNsDw9mkUbL6wWq-gGeA0yEDba7f-ijj667p3_yD4igsKEBMYjY9bZ-iWzji4AgTX4ybjdjiuUJwTgTKAk5R_mTgSOV_iUpQUCcmnN4OKI_xITtpbkJ78hkLvs4K--oQsG_gGUbEkGynpJsF8xuQMOxfRV_CR4U7h5KPfJmFnW3dKDE6mUw00pXOKbdeqzt5VIzUajtqYQ5

Requested by

Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 rs Show response
ad4m.at/ Frame 2316 1 KB
2 KB 54ms
53ms XHR
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34c1f3b029277779cf8824fb4a132628ea7df97f92995d2b841b7e32efd940c7

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

cf-ray: 6cb769f438405b68-FRA
date: Mon, 10 Jan 2022 16:52:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f6RKjfHPARdB7RAgO0voJVdtfaA1YXQrUGo0h63YlQwp8epxM%2F6dJCqBvVEN2QORbztFBI3etbK95Qlo4ja%2F7x%2B0kbWkByIdfcqQUbQf82GIfu6%2FN84Bz%2BUsi6H5keckalpqHdQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
access-control-allow-credentials: true
content-encoding: br
x-backend-server: aa-reachservice-group-europe-west1-n794

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 79ms
63ms Preflight
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-type: text/plain
content-length: 24
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers: content-type
allow: HEAD,POST,GET,OPTIONS
x-backend-server: aa-reachservice-group-europe-west1-n794
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CruIzzdgVVo7Wszl1XcXggly6tyFREFz7o4pBzECLItXGZzMYh25P2kDMKAUvxhEg66kHrw1iWZBtuxl96sGobJiiA%2BZ4rBLD7nO4an5hsfOJAnE7ly1d3zErFo7bhInN1mCdMs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6cb769f3df4f5b68-FRA

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9253 0
20 B 75ms
75ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2IEqNWTcYYaKJpGn7gPd44fIAgAAAAA4AeAEAg&bg=!c3ClcDTNAAbDtiZlw7Y7ACkAdvg8WqTVur9XG4pIdI5TdIvl9JJ5UfuycgJhFwkP2BVYU1bdZvNdWwIAAAC9UgAAADFoAQeZAyB5OivLr2sD13vyB_kUaVU-f876vr_EpLUlM1M6yNldwkUyNrtH9KpEuSJ5l1x3yQK7dOfOQ_AOn5sbzQj5bJ-QTZDILRdRzm37YbtyQaW-o1L8YHibyaNigiFyD49eaCfja0SFmEFBXmXldupViLWh4__45iWoNXCNB6j5bGIrpRJdwiJtod-ihPWegsnQ0K13jMfHtHNUn1_cGUWc4wRhIiNhVC6JjCtYMOkvUpekKMavv0V-Tv26Csy1nBYsrXgvd-ht3stJm7k1LmdMfsDE_HBa1tpOcYkviBCTDVwxR3eQNp5TYvtnicSk6X6G19DtIEAOY0eOvI2FMowIbhVNLaCp1Zql8yYAXcYkJhFdHjAw2o-O6Y5qgmeTvB1-gZPwPDj-jIMMQxgWObaYV7-aisqYMEV3h4Q47_ZOaZYYsoVIXKuqPYTJIe4BrsJ-kSbjg45hTSrvL1FE4v08w4jU-0olAyg8U-MFxfa7gqM9jZRLxbTbBkOKZfB1pTQUdsfSuMK27PBCyvfwmDHhxbi1RWy4NpqJ8lLC6a7kFAZmG7NaSZ3ja3gTyGrS5EWATeNzFkaRMFJrfRMlE3cj948F6aeKgbH-nuQHIwK2jZMhTR7OC0WLWBH_gx662Gpsj8vWSh4TPvqOAImcGtkCkLOPGX4jY-w8Zd-YfmKHILEOLxk-SJnG49Z9S8_4b3jVMGCHTgux5VWKlZ2NC2hnh-C9fOIY1RYCwAlDc1d3LZKCkEcQ25duQ4l7vcwdGACD-1FL6fz4ahd5QvzeOqh7eGp1hhFNZsvD50yLr_nLrW9CNNbRrZbkeRxkzQuuwC9D0CwUb7awcoPMFUnP5s8w3Hhp02vvablqlNmlicIRLeuJtdNBbLpNN1VFV2MnmDk-bF2ouuPwsVdTklEU0rsHPRLiTNWRqxmzODYAE8PG6n82XcrJl55sp-g1XU6u-TMIWtNE9vMmtZNRzTnXGGRXPzqNsMT5KRig7vyR-YTNZAdaqwBZaTNdbl0vsGPKV7PVNvyzUPhXEii3EAk-oXKLHqT9zq3R7f0SInFOOIzD6pG5RQ

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame E64A 35 B
210 B 11ms
10ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENMarM9BhpD-0pAEuBtwKUo&google_cver=1&google_push=AYg5qPJR6j1aiqlFk3xQZwnXkwB-nWaDAyvEpQqApf0tZBq28_8GJ_gw42lNnQaiqRFPO0uuFy-FXm8wtyqm9F5jHtAmcRiHmvgS

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64A
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKBcfHKixV-AjAd-iOsT7nCYEOFsO0M90v2vyK...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR4a05nQUFCREdyeHlRMw&google_push=AYg5qPKBcfHKixV-AjAd-iOsT7nCYEOFsO0M90v2vyKrexgUgWpBjuAJt3UbGSQll_9peGr3UDGlr0ePucsaE-kXVZn4coSr-PE

170 B
188 B

65ms
64ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR4a05nQUFCREdyeHlRMw&google_push=AYg5qPKBcfHKixV-AjAd-iOsT7nCYEOFsO0M90v2vyKrexgUgWpBjuAJt3UbGSQll_9peGr3UDGlr0ePucsaE-kXVZn4coSr-PE

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWR4a05nQUFCREdyeHlRMw&google_push=AYg5qPKBcfHKixV-AjAd-iOsT7nCYEOFsO0M90v2vyKrexgUgWpBjuAJt3UbGSQll_9peGr3UDGlr0ePucsaE-kXVZn4coSr-PE
Date: Mon, 10 Jan 2022 16:52:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64A
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEBz78_AkQjSh_64WJPOYuCU&google_cver=1&google_push=AYg5qPJq-Gz-zZX8u3JF2ne5YwgBHBTKhI9IjKpOx615E7rcosJFjDeO2lQMpwEtwi9tm-3xm3EOqUpKfGLyf5m98fSwqw8URiXr
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJq-Gz-zZX8u3JF2ne5YwgBHBTKhI9IjKpOx615E7rcosJFjDeO2lQMpwEtwi9tm-3xm3EOqUpKfGLyf5m98fSwqw8URiXr&google_hm=Q0FFU0VCejc4X0FrUWpTa...

170 B
188 B

66ms
66ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJq-Gz-zZX8u3JF2ne5YwgBHBTKhI9IjKpOx615E7rcosJFjDeO2lQMpwEtwi9tm-3xm3EOqUpKfGLyf5m98fSwqw8URiXr&google_hm=Q0FFU0VCejc4X0FrUWpTaF82NFdKUE9ZdUNV

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:05 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJq-Gz-zZX8u3JF2ne5YwgBHBTKhI9IjKpOx615E7rcosJFjDeO2lQMpwEtwi9tm-3xm3EOqUpKfGLyf5m98fSwqw8URiXr&google_hm=Q0FFU0VCejc4X0FrUWpTaF82NFdKUE9ZdUNV
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64A
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJapwWD...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJapwWD...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDAzMDg2MTM5MDQ0Mg%3D%3D&google_push=AYg5qPJapwWDa8GDdhBWz2WEVMeHQB_5UG0Qjzq1vfzkgHziSK-Gl7mcBck0BWn6xQ6ZeX...

170 B
188 B

71ms
70ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDAzMDg2MTM5MDQ0Mg%3D%3D&google_push=AYg5qPJapwWDa8GDdhBWz2WEVMeHQB_5UG0Qjzq1vfzkgHziSK-Gl7mcBck0BWn6xQ6ZeX-1SCrBPkvsCW7zBL5d8ZR594PVgDs

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTAxNjUyMDYwMDAzMDg2MTM5MDQ0Mg%3D%3D&google_push=AYg5qPJapwWDa8GDdhBWz2WEVMeHQB_5UG0Qjzq1vfzkgHziSK-Gl7mcBck0BWn6xQ6ZeX-1SCrBPkvsCW7zBL5d8ZR594PVgDs
pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEB4qQZ_jboTteEcAmdtmIWs&google_cver=1&google_push=AYg5qPKaINXWpwCxnU9ZZRpSPngS1N-Jb9Xf74F-sA5gPfHbB9cMxtiXoJhHda_FbOFHIkgSGpY...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUkMtSS01VE5H&google_push=AYg5qPKaINXWpwCxnU9ZZRpSPngS1N-Jb9Xf74F-sA5gPfHbB9cMxtiXoJhHda_FbOFHIkgSGpY2eIeE5NNh_90_-5WiSdQKVbYQ

170 B
188 B

69ms
69ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUkMtSS01VE5H&google_push=AYg5qPKaINXWpwCxnU9ZZRpSPngS1N-Jb9Xf74F-sA5gPfHbB9cMxtiXoJhHda_FbOFHIkgSGpY2eIeE5NNh_90_-5WiSdQKVbYQ

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1k4WEFHUkMtSS01VE5H&google_push=AYg5qPKaINXWpwCxnU9ZZRpSPngS1N-Jb9Xf74F-sA5gPfHbB9cMxtiXoJhHda_FbOFHIkgSGpY2eIeE5NNh_90_-5WiSdQKVbYQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E64A
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESECa-B3zY2_GPSiq5tR_UEUA&google_cver=1&google_push=AYg5qPIoVOKk4mvWUj1su_cgyuJ0xFa_OxEol5tR-tVvmXnsiLXDmtkxWfp0d2JO4g_PuSU-PgrKfDp-iA07xI03e3BVb2Q...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIoVOKk4mvWUj1su_cgyuJ0xFa_OxEol5tR-tVvmXnsiLXDmtkxWfp0d2JO4g_PuSU-PgrKfDp-iA07xI03e3BVb2QY0FOx&google_hm=ZoiiZXFATGyxX_j-...

170 B
188 B

71ms
71ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIoVOKk4mvWUj1su_cgyuJ0xFa_OxEol5tR-tVvmXnsiLXDmtkxWfp0d2JO4g_PuSU-PgrKfDp-iA07xI03e3BVb2QY0FOx&google_hm=ZoiiZXFATGyxX_j-H8s26Q

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIoVOKk4mvWUj1su_cgyuJ0xFa_OxEol5tR-tVvmXnsiLXDmtkxWfp0d2JO4g_PuSU-PgrKfDp-iA07xI03e3BVb2QY0FOx&google_hm=ZoiiZXFATGyxX_j-H8s26Q
pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E64A 0
12 B 54ms
53ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Iu8od-aH6xE83DOuVLC5PuhqZxWJ-dWMrPTIXUh1n6KtXyzAGHBVmcvyceACLzgg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 69F4 2 KB
1 KB 65ms
32ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIynoKmuNHAAEp2npywCSJQt-TMglwGQ&u=%7CDUzBKHzfmDz%2F5J%2FmhxnyPSPlVKvPdHV7PhX4g7P9cVg%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbzim9cAw_Y5iWQiPQEmhFHCW7ka1o6UFoQkNJDYKUOA-Gg2hN6hUqU52Dp4BfGB7UlcBwMTgT0GCja8huy3YP1UJ8y2Ewy2-e1Vu6CIHPhr2tcqtX_ntsrlx49xXHkns7OyElQiLjiXT-CmHpAZTW05bHT79yFaW_p2PZLnJ1lXwZHtCNQ26HElS1JsGF1DJAfKZVxknrsfassj2AzkVUQ7bmGpGlNFdxSvEUjIGViRshHfa1TqJApK_dGfmfQ1dtOLyf0-uTe3UnjWRvEa-mfubRJd1HdfBGQJa5eZ23fZxmCbMOQoM_KXsRDq-ozXZpRdro8Amjc8KFoU3vQofpI6cD_qv8VxKrf81Y8iu_EpX1-9CiI2sdM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmb2tNWTcYfqUI8fG6wTa04TwDMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAsZopju3AbM-qAMBqgS9AU_QeY2NOG2yhuisaYL19HpyS6yL60pwR6vVllZ2DjVzUtUranxnRPkNEQyEZWpwGNjlwUYx0LhkMzhZDUp97HpfBPNmJIniKdPARJsrAUqWAF4wA3evAn9rMhMXKY1ffOhiKK-DuUN-ironGCHsw5g-cpfca_dL9SsndVqwGH1nVRawQ9F9MKeFpQBmjRlHgZu4DikFpaCSZ2hJykb31lwkRTqVmaUOKNJpPPNcnX5_na1efvXrYqlit70U5IAG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1OBMFxl2d9gVZu14LU39rAQSSoNw%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 69F4 2 KB
1 KB 51ms
18ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 69F4 308 B
636 B 54ms
22ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 69F4 507 B
835 B 50ms
19ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 69F4 0
462 B 170ms
151ms Image
text/plain 2600:9000:223c:2e00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1641833525
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIynoKmuNHAAEp2npywCSJQt-TMglwGQ&u=%7CDUzBKHzfmDz%2F5J%2FmhxnyPSPlVKvPdHV7PhX4g7P9cVg%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbzim9cAw_Y5iWQiPQEmhFHCW7ka1o6UFoQkNJDYKUOA-Gg2hN6hUqU52Dp4BfGB7UlcBwMTgT0GCja8huy3YP1UJ8y2Ewy2-e1Vu6CIHPhr2tcqtX_ntsrlx49xXHkns7OyElQiLjiXT-CmHpAZTW05bHT79yFaW_p2PZLnJ1lXwZHtCNQ26HElS1JsGF1DJAfKZVxknrsfassj2AzkVUQ7bmGpGlNFdxSvEUjIGViRshHfa1TqJApK_dGfmfQ1dtOLyf0-uTe3UnjWRvEa-mfubRJd1HdfBGQJa5eZ23fZxmCbMOQoM_KXsRDq-ozXZpRdro8Amjc8KFoU3vQofpI6cD_qv8VxKrf81Y8iu_EpX1-9CiI2sdM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmb2tNWTcYfqUI8fG6wTa04TwDMme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpAsZopju3AbM-qAMBqgS9AU_QeY2NOG2yhuisaYL19HpyS6yL60pwR6vVllZ2DjVzUtUranxnRPkNEQyEZWpwGNjlwUYx0LhkMzhZDUp97HpfBPNmJIniKdPARJsrAUqWAF4wA3evAn9rMhMXKY1ffOhiKK-DuUN-ironGCHsw5g-cpfca_dL9SsndVqwGH1nVRawQ9F9MKeFpQBmjRlHgZu4DikFpaCSZ2hJykb31lwkRTqVmaUOKNJpPPNcnX5_na1efvXrYqlit70U5IAG1KCKy6SbqKNsoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1OBMFxl2d9gVZu14LU39rAQSSoNw%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:2e00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
via: 1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P2
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: YV45WEbP4ZfHbn5tHvi3zJRwdTXH6hyuPVtT4-kLfggD97q4KDvRlQ==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 69F4 43 B
347 B 63ms
17ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=4BYfzvdilEUGzUYjtvasR3GqREdokOLsb7oO8iEml56khoa8wCZR7QWpFZ8ps4RZbRGA2veO95PJ9nJ9vXs1RN5P65jwr1mwDsA565pWEjLXR-KznFmaiTNvalkO0P1AYanbONRhcti86kmrXgVY_tWWVxo1X7cnZuR813q3hnl5XY_3r4JXsVVAtkOeK9WywLI0e1_RBOhW0PtlU_9ZjWtVaLIlJ05AmV1B98xD-mECRvuS2MRD7udopYwkKCXDxmR4uIW79k9v7lZdMPg-NzwzO9F7Bfc19rvx-5bp7I0rGewA3ugBuhJq9kf8SXyaqKowH50fvzQwo2TuQvqQNrzN9QyEQL7dzgwi4DUfNWvMG0KoIUPfAFWS48zP5ZnH-V-hVWoC7fIWBTYO-X-6zlWvkMkDHKbJCm-ONvgXwmSgznXQXAd8CdLqPy0qrRnf2o6oIQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3185686
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 69F4 12 KB
6 KB 44ms
22ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 7 KB
7 KB 65ms
26ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=176&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=256&s=OoHbAbMjs34limBOASsMBFuJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:55:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 21404
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29172533
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 7142
expires: Wed, 14 Dec 2022 02:24:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 1 KB
1 KB 65ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FV%2FlogoVogt-Medical-Vertrieb-GmbH-84462DE.gif%3Feb%3D1&v=3&w=400&s=Sxk_m_1Q9C7pk7-3Vv1lolK9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

025d47e5f33d8f6867a73d3f1915f57c263947e145365e8cd25a9a762cd6f5d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:32:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 22800
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2076936
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1174
expires: Thu, 03 Feb 2022 11:27:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 1 KB
2 KB 65ms
26ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F9%2FlogoHOYER-GmbH-Internationale-Fachspedition-37379DE-2006101647.gif%3Feb%3D1&v=3&w=400&s=SGr6G-HXmOl7iwtyg_1PLmJR&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7f8b6e031b559271d1e647eca13727e1ffef7903218b74a220ebfa2149626432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:49 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 16
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=37
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1502
expires: Mon, 10 Jan 2022 11:25:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 2 KB
2 KB 65ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FL%2FlogoLandesamt-fur-Zentrale-Polizeiliche-Dienste-NRW-66057DE.gif%3Feb%3D1&v=3&w=400&s=4cQdjkAT3WhxUgmsczHWi-AX&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bc31dd1668b538cb276b888ece7b1bc77aa3ef5fda2652aa92501e0502f3587f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:50:45 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 79
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=224
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 2072
expires: Mon, 10 Jan 2022 11:08:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 5 KB
6 KB 66ms
27ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoFog-Smoke-Haze-Factory-GmbH-279462DE-2110090843.gif%3Feb%3D1&v=3&w=400&s=5Al_0HzDjAxZNeVWCsNV1goX&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

58c7b37860f58c622b57e35ad8e0d31aefe4f8a53db8888f7201dfb1f4404d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:50:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 86
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=2392
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 5474
expires: Mon, 10 Jan 2022 10:47:34 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 69F4 4 KB
5 KB 67ms
29ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F5%2FlogoEurofins-Institut-Jaeger-GmbH-231716DE.gif%3Feb%3D1&v=3&w=400&s=MnI5Co2BSUdnCjp43TDRa7rg&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

8fda1029dbfc74e32700a1b6ce2054cedbd788d34f78c7e101003779276838fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:25:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 23172
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=799788
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 4430
expires: Wed, 19 Jan 2022 16:35:42 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 69F4 0
127 B 50ms
18ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=xkCcIyahwQj0MFNynNrIe2RvCghJDWbaNScmtRkVAyAquE3viX-O6T7zTMPa1E4nq8W9riL-ClU1mfTOtGDjz4GmBDGDqw05iQtWIiWh06gtvlGfEGs5a_RB5Fpl7ob-PBd_S6Mhk7rF_4dZnG1o9_fQJLwMvUV2yg7qGi64KuhEH42Xo2G3CYskFTkxgHtVvu2vsxlBt9ZxLbiC7t6rTAZRGXYMkrE2OYr9poUGoctJtw56wRFomgbG3BRtGLpEkMUooQ&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 69F4 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 69F4 2 KB
1 KB 21ms
20ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AFE6 17 KB
6 KB 107ms
106ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:06 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 39BC 43 B
607 B 32ms
9ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=26952494_4307561_323352071_98484016_-0&ref=26952494_4307561_323352071_98484016_-0
Requested by: Host: ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com
URL: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Obertshausen, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 16:52:06 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DE81 0
23 B 75ms
75ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssp2L1IHGxUcJRJv9qXapTXg6bLm3tqBC8mTj7OLznDCjXxi_3Knf4Sc27c8AnFgN0mNqDm9BnB-qdt10d5xo9qk0pWVniI18KBw-Rxj33v69UkEcJuafDru3TCqdBiC21T4XyavCiJ4dEgAm6r9XHqn4aWBs4S4c7lu1FNCncboJXQ-U_uByjFPisllLZLFj0n06JszGWPcrqim5rk5JvBtvgjIqxdIkGXN1tvMAP7Y9UtymJTcMV-VlquzT6R4BgRkLPRrA5TYUw4dBpzI87VI0cwWLPfRY-7XyHgdqDDncGfnNRtlsa37vJcFP2Wj9MyGarwFSqTujl2vOfJ61g1gbe5b9rLeGsZg_xk6Sx9UF-q0Lh98qbyOJVt0gBpMM-JPw88RbYF9-t-w1mRGppB8jYwrwDkvqS_XPnvq7I1uoDeLXRX_qapUWOVnMk3qClDwSbW4A3iDDmOt1VJdJf3znJtIXPoaBQjwMDx2pOHKRl-v-j4HI_Xfjk3plYEXdbD-7JyexcCdRvgkJqRdznsiQBjcSYBmoSTAR-zLekMTBkHBD_JbxdPy1jU5GLNw6tlQlHo0A7BcWoROU8al4apRcjeoeNd5EhLSE11skq_oWOAWuvfaajZLdwNJdQVUhKDuAIsh6UP9sA4PIT_ryOLQxrZEtB61FtCoXEbCuthyt0RFLu2cbG6wfSuHH3D1WbEW42J8tZdyEhbZCBTD5BMSTWDa9wbz-wT4T2cUbOnLXy8IHTWtCSdlNIBz7VWnj8b1ynbVndkAMnWhMOqQL7fIfnnTCaF2Tz01zcKv2rV5F_leM3rdP8unQHCR5pX8hSK_MCRfePTrit1-tk23UK_5ds-LPVcomEFHQT_jMiri_Rf12s_dx0vclmhlrR7jm_iMUhkkLfLjCsAjV1W0WMdZxOV2fOeA_sGjkFIut5H9-hwctleM2omr9n3Ol-G9Uo_6OpINJbOUXdnibhGn7UmJiZz-lyAHoG7Cw_Yeta3yJ5UeYWOfNzxvrV1xbPFBN7zeceARXpUCQEX13tx3ghjshFDmOlm8kCj-_hHepj3KndMa3M1Ou6An8u95RI8H7FOvluCzRFhQLb_x3vtNvuO8vzIbiyVEydgrqJmp2oaJVVbXTTZGs_PyoBEN_9qHmTYZVyL6IuA7IkimNiFrd_HVC7dL6QtTWeN_WXTO6dIjTrZpsHdPrLhMB_1HX0&sai=AMfl-YQXZzDLDBMgP3ige2HH9OAvzvdP3fiAmhn--hNClqcTlQX5pKEGOF8jhZGs4y2BuX6LgkZz0EL1trIB3COXvAWE_2cSTqx3-m6X8JT0tO0qcx1MQIifqGpomOyuE87BKv7lQncKc_6fyW0D0QV7QmPOwfYbJA&sig=Cg0ArKJSzIc16e-SJSo9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=752&vt=11&dtpt=518&dett=3&cstd=229&cisv=r20220104.70369&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame A86B 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIfOgIu-T_AARQNMSQfXAi9_7YTEmKVQ&u=%7CDUzBKHzfmDxHKVVWyplevKB1UtRtQyukpvTGsrDx%2B9k%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbP3qvTSeNBAxVWJSebxayJ0HX3AQOIxCJ64MSc--FOnC5L97O63YXKZtocpPpVbwblO_4P7du5f7Czn0BEVkENB16YvAnIo0C2tMdfPPsenrNtPfLptHPP2d8JUpBCUZbiiExYd5PmD-KwLmd-poQXzs9gsdsDMGNg9nwQ3bY_VPrPdvbzLdHxIdKVkbXNKxJI_LlZB8oFmNe9jNsOlfPvHmuZtFKs-_0OG5GVwwn0Pd-8q1w2UGGXV-1uyJ86QyO9TUSzGc3rGK0MHn6XdsEGn5JznXC5DvOxSG5mgYeI_3Qrq_PAH-43Xh0TcvN9AtR5cJNeg_OgOHRvDOaEbuHyi7eoZkE9gAMoIiMyM6j6mePUMz_yRAXB&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCP6j9NWTcYej5If_J7_UPtKCRuAXJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAdW20uoDyAEJqQLGaKY7twGzPqgDAaoEvQFP0CWfZXdnJYGYWunsOgUarjeuQaUzKlIBaNi-Tjrs6h7Z4TkbLoszG-8Y00l72Uf3oK8frc9ZszjoNY0XNPKJAz3Vs_DJuAuSGNy-UXxdYPwdVwqCIvORaTpjSzH5L9eqJAsZeOHQk5JrrT9yDPV6F0S5VlTrAA_sCNWfAwnyWURaMQ98blx-iGFEu3VKkz90hbCWSTrL7mX_cv4J7IJ1I_iyOxAy0eMyOYY7mE6HaTxaC1Z1CjYQzj60epGABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_13j7IJUo8QW0_81oxXG46xI4eY5Q%26client%3Dca-pub-2979533909392588%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame A86B 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame A86B 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame A86B 507 B
835 B 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame A86B 0
462 B 158ms
157ms Image
text/plain 2600:9000:223c:2e00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1641833525
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YdxkNQAIfOgIu-T_AARQNMSQfXAi9_7YTEmKVQ&u=%7CDUzBKHzfmDxHKVVWyplevKB1UtRtQyukpvTGsrDx%2B9k%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdERZwsUOl74YTlNh2oC0QHbP3qvTSeNBAxVWJSebxayJ0HX3AQOIxCJ64MSc--FOnC5L97O63YXKZtocpPpVbwblO_4P7du5f7Czn0BEVkENB16YvAnIo0C2tMdfPPsenrNtPfLptHPP2d8JUpBCUZbiiExYd5PmD-KwLmd-poQXzs9gsdsDMGNg9nwQ3bY_VPrPdvbzLdHxIdKVkbXNKxJI_LlZB8oFmNe9jNsOlfPvHmuZtFKs-_0OG5GVwwn0Pd-8q1w2UGGXV-1uyJ86QyO9TUSzGc3rGK0MHn6XdsEGn5JznXC5DvOxSG5mgYeI_3Qrq_PAH-43Xh0TcvN9AtR5cJNeg_OgOHRvDOaEbuHyi7eoZkE9gAMoIiMyM6j6mePUMz_yRAXB&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCP6j9NWTcYej5If_J7_UPtKCRuAXJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAdW20uoDyAEJqQLGaKY7twGzPqgDAaoEvQFP0CWfZXdnJYGYWunsOgUarjeuQaUzKlIBaNi-Tjrs6h7Z4TkbLoszG-8Y00l72Uf3oK8frc9ZszjoNY0XNPKJAz3Vs_DJuAuSGNy-UXxdYPwdVwqCIvORaTpjSzH5L9eqJAsZeOHQk5JrrT9yDPV6F0S5VlTrAA_sCNWfAwnyWURaMQ98blx-iGFEu3VKkz90hbCWSTrL7mX_cv4J7IJ1I_iyOxAy0eMyOYY7mE6HaTxaC1Z1CjYQzj60epGABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_13j7IJUo8QW0_81oxXG46xI4eY5Q%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:2e00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
via: 1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P2
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: wdCbMRLFXnYuURzuLSMWQWEzV2Yb0Lon7yJPMzLcV7wZlu781_XONg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame A86B 43 B
347 B 20ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=Xq6vJPdilEUGzUYjtvasR3GqREe_--hHWE-XzQ3HY6TF80NuoZqU3j18K8eUMqImXHt6qeLw-tK_h4m7x7rauqQnqA_Q7FZjjZSXI6W-aai1vCyhO8th3NTuVYhsivXaJdFl1iC3MniCXgAYV6O0sTnc2vxKmmldD9DB3lV8ezCcj0xx_VZxE6Mfq6JTFVPGsN9X8KKwfDgqV-arjMGiw62mfcgWHQ0tqNB8TB2znl71jIiZIl2-5tQJal10lUCUCN1ELBRRAB1kLCJeCEO2kwaAKIwSkoxyd7NAw0-ao6uHjmX6gOT7AdUHuDrfdOLicirMdZJLGv7O6lk-gc1-IvbAKJBAKItl7GiaKt6jZ3fY2eq7DhZwJoAT5-vAeEnEL4kUAzQkUlykgWU37D2mFzc_z4qPRPhxDlQjwSeObklo5ED42X3Fv0WgAFalYWCw3HB27A

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:05 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4417444
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame FD9E 6 KB
4 KB 50ms
49ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8782d02b927a9962ed084af5e3dec559eea34be8a1cac611fe54e2aede90c56e

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1grdgg7qhhv2b61cfdpbs49nz8p4nf7q7cmqefqahhw2prph1k78bggwgs5y6fm1h7bpq4r080mnhaecdc3zsycavnxbq0732zkhvphq0e7j3jzz10de85r3d7m2v6tswfq92d4zt55nw8jnc9gx57v0hcyzre1evajqpjsx1qdfc9nsy5kjsagnatj3p57kymaa7tmmyt20qys00caeae47ae41ansptcmvfr2kr0g1pgw8wc4amvzr4gx3tz36mzbtgk8ddqjpms0fzzarbypfmmeam3py76a0v4yj7rv7v196dqthqp6zxyyd7gpj22j8nkfyqhjeam308jhfndhwhc55768rq0erjsrmze8xh9a6qa6g8axzym4pdht1jwr36ty7jfxsav2k71dt7xmxzst5cx0a8kte0x0jc0asjkregm1xc&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%26client%3Dca-pub-2979533909392588%26adurl%3D

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb769f49cdb2bce-FRA
content-encoding: br

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame A86B 12 KB
6 KB 19ms
18ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H3 200 60005582_20210922050611381_STANDARD_300x250_LOOK-01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 39BC 19 KB
19 KB 40ms
39ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210922050611381_STANDARD_300x250_LOOK-01.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c31691c3d9e09f267ba40c92c648d48c5936caa47454f242003a0b8e4786ca74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 23:07:08 GMT
x-content-type-options: nosniff
age: 63898
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19560
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 12:06:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 23:07:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 7 KB
7 KB 15ms
15ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:55:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 21404
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=29172533
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 7142
expires: Wed, 14 Dec 2022 02:24:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 1 KB
1 KB 14ms
14ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FV%2FlogoVogt-Medical-Vertrieb-GmbH-84462DE.gif%3Feb%3D1&v=3&w=800&s=SoYk7_-aATzvP9ZsmzxyJVEK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

025d47e5f33d8f6867a73d3f1915f57c263947e145365e8cd25a9a762cd6f5d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 10:39:08 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 22377
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2076514
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1174
expires: Thu, 03 Feb 2022 11:27:43 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 1 KB
2 KB 15ms
14ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F9%2FlogoHOYER-GmbH-Internationale-Fachspedition-37379DE-2006101647.gif%3Feb%3D1&v=3&w=800&s=2tn0EiI7azzPXEudDSVjjL-b&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7f8b6e031b559271d1e647eca13727e1ffef7903218b74a220ebfa2149626432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:38 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 27
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=1316
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1502
expires: Mon, 10 Jan 2022 12:32:33 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 2 KB
2 KB 15ms
14ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FL%2FlogoLandesamt-fur-Zentrale-Polizeiliche-Dienste-NRW-66057DE.gif%3Feb%3D1&v=3&w=800&s=vYLMtKnM7MUvR-eeF_q6lJec&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bc31dd1668b538cb276b888ece7b1bc77aa3ef5fda2652aa92501e0502f3587f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 62
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=1581
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 2072
expires: Mon, 10 Jan 2022 11:08:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 5 KB
6 KB 16ms
16ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoFog-Smoke-Haze-Factory-GmbH-279462DE-2110090843.gif%3Feb%3D1&v=3&w=800&s=fqUWX5nf-MKjMj9ka85mexWK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

58c7b37860f58c622b57e35ad8e0d31aefe4f8a53db8888f7201dfb1f4404d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:50:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 117
vary: Origin
x-cache: hit cached
content-type: image/png
cache-control: public, max-age=1583
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 5474
expires: Mon, 10 Jan 2022 11:50:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 1 KB
1 KB 16ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FS%2FlogoSGS_INSTITUT_FRESENIUS_GmbH__65698DE.gif%3Feb%3D1&v=3&w=800&s=AUMTiLUdsWSTOS_HJCMNHcWO&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

ec2-34-242-207-34.eu-west-1.compute.amazonaws.com

Software

Finatra /

Resource Hash

4272045db1ea89f1e8c1a5940ef8cef23938e21cc63bdd300e9693de908a4c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:51:25 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
age: 40
vary: Origin
x-cache: hit cached
content-type: image/webp
cache-control: public, max-age=2455
cdn-loop: Criteo
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
accept-ranges: bytes
timing-allow-origin: *
content-length: 1208
expires: Mon, 10 Jan 2022 11:20:13 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame A86B 0
127 B 18ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=lLT2riahwQj0MFNy8IXJZJIV98EwARa66RcFZSx1hCUkCp3lhRR8gjUBkyxfzQTs_UH9MGBnm6qonKTwb6dicZm_SpjHXDb4-AKJqGSuzCV2lVpHOTUn0NalVaJxQKOipVHA1hsgKdFkISas1A03kgDds0QIY-Vct6cdZK0U3tC3DwT58RJPe7xDFx-oKMwXpROpSCtdrOa6Ylq90Kn7x1yi706LQ_on-CcRyAlV8kPcXOXOjVnWe3IL6YeyIKvv5dmGXg&sds=2&rev=80076&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 16:52:06 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame A86B 2 KB
1 KB 19ms
19ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame A86B 2 KB
1 KB 18ms
18ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Jan 2023 16:52:06 GMT

GET
H3 200 60005582_20210922050615805_STANDARD_300x250_LOOK-02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 39BC 20 KB
20 KB 39ms
39ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210922050615805_STANDARD_300x250_LOOK-02.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b460434ad43b54067a5c79c7d87ec56f9f93986710254fff7cba757f7ae8aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 11:21:22 GMT
x-content-type-options: nosniff
age: 19844
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20266
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 12:06:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 11:21:22 GMT

GET
H3 200 60005582_20210922050620132_STANDARD_300x250_LOOK-03.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 39BC 21 KB
21 KB 41ms
41ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210922050620132_STANDARD_300x250_LOOK-03.png

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d83d5c37a9ec923a5c65d86dec6b7bd3c25ce30d65e62bd00b46295dd42e882

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4058801387234918400/index.html?e=69&leftOffset=0&topOffset=0&c=ogtAhP5qMz&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 06:28:41 GMT
x-content-type-options: nosniff
age: 37405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21065
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 12:06:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jan 2022 06:28:41 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame FD9E 81 KB
11 KB 76ms
75ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:06 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 615376
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Mon, 03 Jan 2022 13:55:50 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6cb769f52e392bce-FRA
cf-bgj: minify

GET
H2 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame FD9E 53 KB
54 KB 46ms
35ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299659
cf-polished: origFmt=png, origSize=115129
x-guploader-uploadid: ADPycduXWUDBl_6SnjSleyTiESN_lebfJGr75nBTSfH64-KcT_0ultUadzhs-QJgv809nEmGowSQUbOWfGpt71wSzEA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 54564
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15RuhaHdpVxPH0zZHlWPdZMZX6aMKb3jc3Wka9c3mNV2uu89JL%2BvNUTI%2Ftxnvm1Psu%2B9L5F2iyctSW3%2Fw9it2piCnXzFRspszsrrLfqldXWeW0bjT0RVoYaTz2GmZ3IGz%2FLS%2B6VkZvgSulNx"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883484779402
content-type: image/webp
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 115129
accept-ranges: bytes
cf-ray: 6cb769f5399a5c92-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 BF671F9353E49E9BB6D9FDFDE3DB7F76C1C78079C9FBA6953329642EA1EB98D31F0C6558B5B6382075530160EC4EDC9E4E2E5EF63EAAFE88E99516547093A3F4
assets.ad4m.at/product_image/ Frame FD9E 59 KB
59 KB 33ms
29ms Image
image/jpeg 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/BF671F9353E49E9BB6D9FDFDE3DB7F76C1C78079C9FBA6953329642EA1EB98D31F0C6558B5B6382075530160EC4EDC9E4E2E5EF63EAAFE88E99516547093A3F4
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 747dca55f3574e0e2e2018f1e7ade84da708f8311d4ef6be6002b20b62e7a5ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=0cfKgg==, md5=CA0MSDnZ60/QjP/qRLEGmg==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1181034
cf-polished: origSize=62182, status=webp_bigger
x-guploader-uploadid: ADPycdtmSs55rFklL7dJEwFGWoaKN31eohfqQlcUMydaCjkv9o8sSKNZKf7fP2sy7rRVSGg1rWzesFbE9SBhmSBKPhg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 59917
last-modified: Wed, 09 Sep 2020 07:43:04 GMT
server: cloudflare
etag: "080d0c4839d9eb4fd08cffea44b1069a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15WjpznfnrDS9NTkU6pKpTX4fCVmKdnlLXEMhKlHZkllEsEJbn9KB8uKckMiqsOJ34Zst3j4b0i6TczQVUYVvFAPK2IJvRwShaz4R7ATbCUQz1O%2Fu5mZr9TSvqvljAmQ7ZUkUIWf8kW7w8Jv"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1599637384558000
content-type: image/jpeg
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 62182
accept-ranges: bytes
cf-ray: 6cb769f539905c92-FRA
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame FD9E
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011017520661863198111X117679V1226132702MSoneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64m...

49 B
1 KB

55ms
18ms

Image
image/gif

46.4.62.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011017520661863198111X117679V1226132702MSoneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022011017520661863198111X117679V1226132702MSoneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 46.4.62.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads4.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 16:52:06 GMT
X-NODEIP: 46.4.62.19
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022011017520661863198111X117679V1226132702MSoneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022011017520661863198111X117679V1226132702MSoneidbwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJoneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame FD9E 9 KB
10 KB 32ms
28ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299659
cf-polished: origFmt=png, origSize=24833
x-guploader-uploadid: ADPycduJXj9_q7Wth5CEKk5MfUcImSyMruZ_O8nxL-rfNg6ICq1dGiU4VYTzBlNjCN4VOyIR1tq8zUbxfUYQdjTwFS8
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9258
last-modified: Tue, 09 Feb 2021 15:11:57 GMT
server: cloudflare
etag: "174bb0dc35647e204b09aa120965604a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qaABTWCCOHputsZnbjG6tA4JBZ3rLdI8ZX39O6Uj3cj4yt14xqy6r%2BIGce37M5atKtp0rhM9vJe3doojCjxf1zqlu4KM8APBoWzbWlgNAOVbJdtAk1oB2pzo6ujkWwRlIv%2BMvzLYzh9HA49k"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883517528266
content-type: image/webp
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 24833
accept-ranges: bytes
cf-ray: 6cb769f5398e5c92-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
assets.ad4m.at/product_image/ Frame FD9E 19 KB
19 KB 41ms
37ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 769996a987ead923de78ded8af9ebbc0125bfdca436dfadfdc9755fd54270371

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=1aKs/g==, md5=nBaxji7Rcg1LrHhoV5P3TA==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 310779
cf-polished: qual=85, origFmt=jpeg, origSize=84530
x-guploader-uploadid: ADPycdtLLEteR16EB83vZuNMR-59fQsZfe8320SqdGgtwneKXCy41hhsR2DQYOmEoFmZ6Pyw44BOHziq2St7fWMLzas
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19022
last-modified: Wed, 10 Nov 2021 15:00:52 GMT
server: cloudflare
etag: "9c16b18e2ed1720d4bac78685793f74c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wp1tVWjPyw7kZXxXPS%2FBaKdNckhQLJaBH1ip7JZ%2BwEKZbcJQTnUbmVZl%2FV14TlQ7kSTewq3wH%2BfeIi57lFpaW4zi4PtmGliEyywk9LBSupOoGky4B0Tvg%2B45BSz0cVOjiC2wZGmnYxhgP%2FTk"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1636556452656256
content-type: image/webp
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 84530
accept-ranges: bytes
cf-ray: 6cb769f5399e5c92-FRA
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.blau.de/a/ Frame FD9E
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022011017520661863198117X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuideUWw64mXD...

49 B
1 KB

50ms
14ms

Image
image/gif

88.99.63.132
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022011017520661863198117X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 88.99.63.132 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads3.sunbonet.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 16:52:06 GMT
X-NODEIP: 88.99.63.132
Server: nginx/1.18.0 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022011017520661863198117X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
assets.ad4m.at/logo/ Frame FD9E 12 KB
12 KB 40ms
37ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ec02e18941bc1fe215e0bf1b47eaef6dd674b8adfb18d17e980203a94b9ff4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=L9xAnQ==, md5=7eHZFVWQuqeYNRiE/JSb0A==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299650
cf-polished: qual=85, origFmt=jpeg, origSize=42488
x-guploader-uploadid: ADPycduzrCcwRaSWmuGZ0pEvyMQLy_5p1yCTOZmKVA9OEmW12WY7QwVz2Kzpz4h6nrGBeZfSuf6QTYXS0i6f1gD9hAE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 12110
last-modified: Thu, 25 Jun 2020 11:29:58 GMT
server: cloudflare
etag: "ede1d9155590baa798351884fc949bd0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HDf229cL93jEimPkYSiijpVjNsu5C%2B0FtfEzSh%2FDkL7f%2FGFp0TsZkoVrXqVFDP51a%2Bwc0a1JitPjIOA9U%2BuFaqnhF4hNUArO9r3NXO8OzfCSFc5cpIq9bv8PAR5B%2FEbFlr%2BvjMxjHVxd7Gbv"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1593084598972955
content-type: image/webp
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 42488
accept-ranges: bytes
cf-ray: 6cb769f539a35c92-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
assets.ad4m.at/product_image/ Frame FD9E 72 KB
73 KB 47ms
44ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ce033c8ee824b2a4e435541df84a0d95075fafa382deb7a91c02f9e15bbe1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=FQtvKA==, md5=fhrs2Vg2w7QpQT0tLI6VHw==
date: Mon, 10 Jan 2022 16:52:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299657
cf-polished: origFmt=png, origSize=128410
x-guploader-uploadid: ADPycdsfUemfSHvWhmjzRiRCF8zw2gp0BhugD8u-o6EmqZNnVuVgd6ekKeqhn6BIJP4DZqJddmhMXyPFnw9g32jS6AVakSA69g
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 73694
last-modified: Fri, 10 Dec 2021 12:01:51 GMT
server: cloudflare
etag: "7e1aecd95836c3b429413d2d2c8e951f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2Ff6qFD5di6P1dd9kY9ftEK7Yd6A5%2B5Nv0yX5ncF7nQoI%2FohDPhG%2Fm8MVVzB3w7N4mZ81SDqG0AwWk4mA1JENf5VtWgqMaWRBYDVjzArTveiUJbpR%2BHrgDLM%2FyNCqvH2lR8rJxq3yFWribls"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1639137711863674
content-type: image/webp
expires: Tue, 11 Jan 2022 16:52:06 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 128410
accept-ranges: bytes
cf-ray: 6cb769f539915c92-FRA
cf-bgj: imgq:85,h2pri

GET
H3 200 94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js Show response
pagead2.googlesyndication.com/bg/ Frame 6616 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7821e6a538cc11ee4c5fea34be8c61b4b888c96338f6f0d22be66b5519c7615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 14:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7086
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Jan 2023 14:54:00 GMT

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame FD9E 1 KB
2 KB 221ms
109ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 1ff11a446f9ffc3bbb5c6db5b6767cbe96365f659e6a4b51b1e70bcc99a74bbc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:06 GMT
Last-Modified: Mon, 10 Jan 2022 16:52:06 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1447
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 8DF3 42 B
64 B 81ms
80ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssyPoKF88L0RqfneP6JfxLHOcTWXtc3tHAndGoZjgZKOIsr8BT46O0Cyj_m1KM9y2C5qm1PgjBbghLF0bh0qKSrpVLah1m4uM9hwqd0BeMx9nKs1skl6Y_kG6abkVx0YXJHZQ9AUyLH6pv_&sai=AMfl-YTyeRql4z9CS3v7q_o4lr9y3mHPBrMngOY_DQVCnTB0gKt1Vj1Ip_CveRyqhFG66WWxalO8hInS_Mhn0xRjx8FxgWXVuVWj2lYa8IQtLcSUvlBKUEqZ_L1bg-KhE9k&sig=Cg0ArKJSzPzvkfKcQIerEAE&id=ampim&o=277,193&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1004&mtos=0,0,1004,1004,1004&tos=0,0,1004,0,0&tfs=59&tls=1063&g=100&h=100&tt=1063&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=4116272111

Requested by

Host: zvonil.octo.net
URL: https://zvonil.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DE81 42 B
64 B 77ms
77ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvRWwLomoPe4DuRgs34WLs3DpK-tKzy3FmwVwYPwRZtTRymq4-zrTr_5oQqUagdY-nsWhtA3qJcn0Q3h5wh-p8ez0yk7DbLuO9ipTuSyLG9XCMt4hUWLA&sai=AMfl-YQmZ7xfqDtrzRIUeigSAON3AKTHb5WXWppzwQNjD8kPpcfzHO9nQ09ZFrl7CDB4HKeyltqvuEcRFABbwoINQG3bqObKhFOAwZsc-vcASyWWRRqpsWw3DEA7qTXv&sig=Cg0ArKJSzJHT-OpQelHNEAE&cid=CAASEuRooL-rfUFpXdz9ZBVLYIqqKQ&id=lidar2&mcvt=1001&p=541,1039,791,1339&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1556906017&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641833525423&rpt=424&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ebfd79bcbb643f8327b9514584fa5d35.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame FD9E 51 KB
51 KB 44ms
8ms Script
application/javascript 18.66.97.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuideUWw64mXDe-YsCCIqx_CdrLtKXe8rJQTasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 61622
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sun, 09 Jan 2022 23:45:04 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: R5nt7d0xayWBnRBOH_mPqckb4m1s9SWgJYgPVRMy88mc5L2m88YLqA==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame FD9E 25 KB
26 KB 78ms
29ms Image
image/png 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneid8ZxUDf8fQmJsgHJHEtxtVAQuGSwT8zhkoneid__asuidKVlnm1IJesHxq5V9benZFc80h9fBKEFBasuid__adf_Netmix_Reach13_Single&wglinkid=3247721
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19457%2C19491%2C43784&b=bwqTQfYZsxgKhYHbHztKtww8UxTJTJPSJ%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=3bgFpf14UB65t7HrHAtXC997f8TWTRead%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=300&d=250&e=eUWw64mXDe-YsCCIqx_CdrLtKXe8rJQT&g=9495485b05c06cbe2362074199a0c218%2F96027898610116876&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1641833526465&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jbk0d8e1asby0x7b3jdsgg576sbkzmfd6banh5w5wf684hg5bgxegham5wxqf5matdp9qc106dhmaesae7svh66y0he55nej55d43qvmfes8k0ccy6aw1kfsv33fkxcgz5er88087rp3dj8p4aa5p51grkq6ryeq4wev8gtjsfc59qpkape9xd0076m66rtt7mt5fpgwmdajtchydnf10mpn6hnstfm13ehasf1627wsmj6rmwzrv2zfwqxhj2a8ezjgbzzxwj0vyzfc9dg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCwvx_NWTcYZfxIYLa6wSn_JvoBJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODigAcKu6N0DyAEJqQLGaKY7twGzPqgDAaoExAFP0AZNFh9sQp5-9G_IyFueRzhH1wEdj1rRQARlSPmsEE600LT4HVHuz4SZY74z6tEoZ8AvanUxxtoRL7qQWUdBA7MMELLzZP2s5Zl20RDKXqJ_7mTbqeqdFWJzvgpxKCGjRUezbMpfuN47r0V3ueqVZ6a2ZDTUZVJsu89-3fIoBO2HXpf1yK7SNl91eizT6_qVQj4xn349CCl-9yHbZhDEBFAmoPVLH9s4GcMo3omef1TMPCHKdxWT3eJcdGYBLkskv_BWgAa8tpnznf6PyzGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_3UguRlevttAC4UQ1tF86l5tidtqg%252526client%25253Dca-pub-2979533909392588%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 4bcba6ca13d0bf1606176d2408363d0370505b999089d312da533a86406ba2e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 16:52:06 GMT
Last-Modified: Mon, 10 Jan 2022 16:52:06 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 60ms
60ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220104&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a55e582f1696ca733edba0a74f3a74c0aca206010c7a89ffee5eae1b274ca98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 16:52:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8772
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 411ms
411ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Jan 2022 16:52:07 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FFB4 42 B
64 B 72ms
72ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssOdPbYfZzMGTsL6lbdBnxkUsaiUy9h17cqcN8NQkTXWtytGT7AdI40vdyq_2s2u0FY5ZGOCei_Z3QCrpEUWJrI&sig=Cg0ArKJSzN4xd_waQeeHEAE&cid=CAASF-RoPzSb11Q8KoymTFkRnEIb03fGUGBE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2715274491&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641833525471&rpt=812&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C9CA 42 B
64 B 73ms
73ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu3b1MBwPQ22HGmNlcYupaIHQrZuuwnaB9nAYmD6WWv89OgU-zOCzvU2Qb25HfsyAbQFnjNyCFnxYoPdETgCicE&sig=Cg0ArKJSzKkithpwKIuFEAE&cid=CAASF-RoGB9mLpXxDSvG2VE_v4tHD28yJe0W&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220105&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2342716466&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641833525476&rpt=820&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 69F4 0
127 B 17ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 16:52:07 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 200 all
csm.eu.criteo.net/ Frame A86B 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Jan 2022 16:52:07 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1A48 13 KB
5 KB 40ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Mon, 10 Jan 2022 16:32:00 GMT
expires: Tue, 10 Jan 2023 16:32:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1207
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 847D 783 B
535 B 49ms
48ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4dfa4fc7f139bf92756e4cb9224e3a92754f5c31f4c4becda69a31a8e7aedaae

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4eLp2ut4Y6WYXT2LMnWmiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 10 Jan 2022 16:52:07 GMT
date: Mon, 10 Jan 2022 16:52:07 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-4eLp2ut4Y6WYXT2LMnWmiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame FD9E 16 B
232 B 82ms
82ms Fetch
application/json 34.242.207.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.207.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 10 Jan 2022 16:52:07 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 110ms
31ms Preflight 34.242.207.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.242.207.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-242-207-34.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 10 Jan 2022 16:52:07 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 847D 0
0 80ms
80ms Image
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220104&jk=2055215971416315&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js Show response
pagead2.googlesyndication.com/bg/ Frame 1A48 35 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/94IealOMwR7kxf6jS-jGG0uIjJYzj28NIr5mtVGcdhU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7821e6a538cc11ee4c5fea34be8c61b4b888c96338f6f0d22be66b5519c7615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 14:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7087
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Jan 2023 14:54:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1A48 0
9 B 40ms
39ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?fwudWw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 16:52:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220104&jk=2055215971416315&bg=!uLulu__NAAbDtiZlw7Y7ACkAdvg8WvOiezuulQU1c9TfyK8XBb2fh990ab249kKhaCAUwUwggH2U1QIAAABOUgAAAA9oAQeZAo9otUt2BPVVRCtboBDD7wJ8a30rpX93TB2wBGOUS-ywqxJF8enwGnQnjTGz5vq1mmJdFJv3VShe6H2nq72VB7KNKR-wzjWI5uwCOKg2GCfVxNPBG8NPUB2k_QrJWWcmHPZ9Jp4xTmv9jbCO9rkSQQJAxLdoZu5-Mlyezckjed3efl-BlcakB1l_gr6UsSfsJRF0Hm0hXE2RmUY0Wf2X3vV_6-5L1GHkfxRSmFtPa69p6CpxN42hxsifTFSIstgRdjs5lJiGX31oMviMGui5bkgDvLl0uHFJn0DxdZnT_tTl9VruaLZ5wCG5uFLiWHdXxi-fbwM0q2B8XPyyYASRCXb4GlDZ-uM9PTJW8CspzavG0_N3MLb5d9H5B8wMOnLRPOoEuSoMF-ydJ6Rv9nKaStfypWIs8VEjAHY_yt3wneUGb4LltBiBPZPHR4Kox82AJviGkIia9aX9vl6LVeT3HRhjfSNUglJVr_ExNuDpX980JP3vFHVeKsUrMDQIBYwNyrz3EZtlO41VcV17TVRhmbRrQuJhxRVLpNzizqSiF-03wGw2Q2JOwvF4nDfxKrbaF2xaUd4Uw4nIKh-RSUEPGvB6DYsrL3iKU_N2PJha52HQfupaHMn3pIvsKKuZ9OUFIAr9Ra1txYjfW_5W93b79JieosmSDxffzFj3DbfTY8HgmyUDbP1uAqXkA_TozYmbV1IM1VtulIl0vn_OKX8ekHjkyvo1NKKy90G1wProrLWHXNAnZO2TYPxWDuGI6_ZFYrhYiIPlMEAZod4xAKQJ9IV6YBzOL3Huk25O3RiXsgkYO-BgepH9JF79D6M8yXr6mA5cvwGsgsbZ9isZ7FQhb7BuCRqY63pobfWD0_xbvRya

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvonil.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 16:52:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame A86B 1 KB
1 KB 18ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS