mphealth.online Open in urlscan Pro
2606:4700:3036::6815:63d Public Scan

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
an-x-request-uuid: e00382d7-2a25-4a86-8bd7-ab473c7512fe
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
an-x-request-uuid: 399f32fa-3b6a-4dbd-b53a-6e4f3fd0ac72
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEHTd7lxrfl-Fme74DZUBk1k%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3AE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
an-x-request-uuid: 2c72d802-f363-4302-b7bb-cde7e789bed9
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE0A 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6543353172246&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE0A 0
20 B 40ms
39ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6543353172246&version=m202401290101&ct=119&x=1&cor=14105542882210722000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CE0A 92 KB
39 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CmyrIuDBNELdRIbGyin3HWuk428Ql48Q8BDgXOsYZenhMVcZnv2DRsxNkvnAdp_9UUYWZf8mZP1ca2Ap5EoY-ifSUGWQdrkaKO-k2rsPL4Z7yOOkpUzt7g7W4C3one-6H97iAX5XGsrmSBgSXGf9mZxIr0iu9vIu-tjATpNZsaGR16LQ-zHMbwGXedEixjJhu7UQnr&cry=1&dbm_d=AKAmf-BSoe7obw6mA58ezTIDgz7mTbWgxziTPyHgAVeVU0Tnc-rg5hUBoUNj6VoSMjqmJYilgdgYjbQCgcNmTuaH5tIzW-WalraBM6Ks0-u55HpU9EKkMEoUQMJFGVFM7kPV9YKEP7_qSvoQ3IcBnQ5kgXJRithChrHKcToZVwrocSBu8ZX6GRKxktkhgBGa4deKtZDZFSSi5LSZwE5eal-ViOL7-iYCknsGi1uiKL5Vln0ROM77qQpsd0rnsuUeZBMyAkQghWsGMCoBS6G3cwNSNG83uEuoCGHyKQK_RDlZqpncvcNAO4Tke1SJRjcUnO2AlAlltKgYhvlqj2jZDji79sKJBq-MxL9PbiDdoL_JIUWHoeiz541e6ubtTvbLhY18NgJ_bfELPzkTvfhLt04JR-UkcE3WYS1gAfY3JuJnFQYVxBZ0SnbKaf8g0xtXvd9NDcPf5dEERxps17U-Z2WzBr0XAJfJrN_qjw8yeoQbGQTunw72H2GK1XjYPv5ueW-Mw1x65-767AHH9g3qb7ohcwL4IQPM_XNT_zRRJk6yoLB11hbtmcbAHQwUXw_wG0jAQWY6xvEmWNf8Q-rVmN60OUipOl59nZuvoQp2N8l7QbVi58R238ASf98cthnP5eh6WUAjj6XCHiusn-CozYvIVZC9Scw2xD-_JCIq627G-TTO3nByKKSTpJppqysTzsqfEUVclT41V6fnQSEkWL68CFA6nxMk7ph4oq7-2yixJJWaL5WJPS8hj9W_lL1_voDTOLBbXcXhOQfSMAXK2oRt-Mgbebj5xQjfCdTGQKwOxrJB9j6qLNl-ZyVq52yE8TXn1Kibb5i3XnTnI9Gvo-9uZXo87G8fHSqI7hnE44pIV9-6Lfa1DZ0AHv6J5N4TdKNsuJ6K1IGebvReG_5h0DfAL4NgmtrPAm5E2Efn79oZLVMYJsLQVGk6UjN3hFd-QqNnF39tqnwkTC_-Er0AGHh-EBU3UOT1RzK3U_c1uBBYZQ9HlFsEuO97pOchwSLFbQQpYYKoO1hH8c_18pEyfdI7K6jr0QR5zPrKYF7OSSOW-p9kzo8HcB3dVDCQVhK3Wa5QYLi7jRWCElCHnRdnIdzfYNfWtswfOtXYqZIwVUYvEp8iVsc3aET_shejLiyvpWL-RXKc1v71LKvBWhbGF_ai6Pq5ZtDKPYrLkcRTcS1aJXXu0xtTajPxqDm8E8mmONP5ZcXxIkO6jARWGOR-5A9IhVLBw6qhMuZoHZ_EoeR8dsDeiLNhqc8iCnIm8xa5_Yb8bZr1yKixBzUzLUr3iagvjlhz1SivHwYeh6XeQ4X9vRwN2whrFHwPfGL4UaSCIEd6FpoliDJDsjtxd3wKgUZXR-unT_F9tafp1meT1SID03QBkONWsd2SPwQ-21l1KUvmCW8FvMROyvvwzPQCKniHnBDkkQVEPrC-6tQ-qOvAFZCeenfOIC7TSIm3x7yGedFDYHvklOFiNruOjGX7nZKQoXYNxtsMqHgoUjMkGn199KYkzK0XXEfxR1AFjohx8_F8BTLOrs0FJcy5YNpKeCk14JYlyu9cZnyQu2MwJgRLGiQVejfUmMUJiK4mp5b4Tn2uvWvJiRyFvb6R0cXYQ8Dk-3U4Zmhg65MuBFQbTSrETEtEwt2MMlJUqR0BDlw5d0c5FzJ8pV2B88pvJsxpu8COJsrh_-QkaeE6O7SAzy_3LNCEmmNryzLHvASFIKtbqdCMpUcyukav51hr347ZHL1IXOdLpwZsHb4GYeFhWZNpfteAuRz3L0bjphaeVENZq0lVAg3gXbaA0B8y5dhYENwLOUk3B35JMU7IaUdx8d9TIOcD8axlKMU8mAd8oakKNX3Zpj0x8O0ZZox_rOYa008h_Ov1goG5xKoeFnnXohgvcVIebfB5RhwW2zl2eKaBcx503KDx1nejQQKWE6UpV4eNKvpRI2wK60zxgAb7UoWAv-PNWdmRX4A-l3g-jw5fPumXnPF_PzTzU_8jF0w9R_7m-eNoo4nPs66BXfvlUB-el2BMqsCOLM7qs8JaDUUf_JnakH4pYi8Mam-Aja7RVZXB6lfQcZzif8qJd5Q65hu0nmx2KTJRaNOkPu23poAEC1nMNF90AwX8PRQgIqqWMVCG8oT5QUdti0wdP7ZweBpVesCV807bYsad9BmnztFfFA6kKUTcfnHz7vNItsMpcFqqWBzuJxnJNy2DxkxpNLHgqnNaVysCpuwqtEp91JT2rqFJa5H8-dw8rfpOzpHsue7UFdjZqFwiCXQVjs0CW9WMLj85RwIGABeYKglXT6TJBinCYWthuVGTSY5XgI-O7tDb-pNdMHTVP52fEdj6av023NNpfbaX1-xLX2vAQ_POA3p3PhQoRJE05rZmd2Tys-t2wHDcwuSeBi13ZWex5O_xaFflxRIjTlcuymEjlUei5d0f_TiLZDRVFoIl8gb2OiyZkFsqkJ3igP32VZRWhhynQlud-7HfxF3ELyZXaYYhKKlmdxpisfFHIHKb9XynWTd1o4JZ9CRrCb3TOSRbTn5uqjqfhR7bSGTv2q7y6LvovyyUoyDjs2AymnrLlB-51QAsiYLcQs13sZOh3wvvbkfpoAHbue-ai-wiL6QOpzDdhQFdXxXTLbDQ6KBg2zygBDowX5KM4aT2a_0s0ewIf5wIoD0VnnBsySjl94cEbhTpN-GO_mNfoGxE_CwFhrgQo2Rw1BLtfDuNVG1EOhn9dxGJghmR4s-xPFmIcwnLEm9Lr0q_R7MUnbH-Tu51m2sOG4BNReYvKK89ATjodoUbPLJYfb6_saiKtsx4nNg3BZLVHizcAd_k3z-Mm9KCVHrxnsZ4GrydiZh-bnIJK9WF5TlUQdYf7YZWd1gagiYj857wtvMtR2YAhRZHNOdlJb1_8LPIllNnss-huWCgis5sOto6FqaLil8hU5bJREc9RQ55papdq6VRVLqqqjBw8q-toxWO6Fx8Qvx9eeL4-6iz6s_UrOr_fPV_syLgb90gQPK10JECiNdC9yO9_XzVCX1Epk4Qo_ciuDIudeq13r5vHKJT7xJf7fwAXILWVLMzSguyt0H8L_N7v5AjEVVx6APpiwLrkVp_JP0TelaKwwnK4_luX-vlLIGIQ9yzIbf2_xKOfKTG0wwpL07B5TzvJUOX1i7XO1ERazdxILOAHdWm089F1obkyjRSozd3PIncN17IlDFzieW3Ht0NPFhr0V9anRD4Kr6wYqDW35w10iSYnGgMWBsOVaOgJ2ZNqlqmsqZspijHDktJPLD47pekmw_A10oYYtR--UJGXA21jxlkmYNdL7xcSbsvPppGePre_6l6n3L1hs_W6Jb0sYN5CC_6I1m18wE2xY2IBmi35FWsrzco6mVuAqPC6qqcWtdqDOf803xsvVzhUW8_ROa7N4ojUG51V_BsDGPOUn1gSygjExnAWTm4mm4gT1OjVnyYH-FV0Lq2ytQvrp4puEcmlSjkHlbLvoEEFakNCMjQNEQhfhpbHpFPJPUP5zQsI-G6kdZfj4AzNVlRzTQWylduEJ8JEXps_YmlSii4aPgVKssBTxLmbn_JrLNeXON8nGIcoC2-dBggJMmcm0iKmA_X3lapda1cXTkCb1p0pmoHPlW9xqHUdukdog0lyNjaywTUp_D7nkkUkF-A8HYAwtiFG8wyKb4m7awEvGarItTYza9_3lBKrjnywWqF4VCO6Ih-BuwGGOwlChNRc6vPz1HV1Ospyk2m3XSRhNNnUUnum063eFxMUDNvgPxkJZSLQq45I8XwfLbzYeM4KRSt5Wb2L8zgSoI3BFyS5btW1gcgOK9mw1ddzkRs6xYxzZg8keBYhRUsVvOiIh13JRWJETT_NvlitsuxYmOS38afXYW4mUonBLgQwsKGkBIzn5nmQ9lsPz806s2X1Q9JHAiI&cid=CAQSTgAvHhf_Ghulaubp3tzpaI6hZvnOgI6Jvyq6_HRkb9kUNoRWDYZzpPVCBH0h9GzvrYRK8qbJWG6WzT189sj6ttfvXM9vW5ShUxGQBafh2BgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=14105542882210722000&adk=1964084971&idt=54&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0908ddb204118c140d63258fd1d5432fc2619d4488f8b78b93ddb65bcef92d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39430
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame D20D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
335 B

24ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjCiOGCAjAB&v=APEucNX7kUKL3Twkkz4VWkwVrjGcf1gVPCGfCQzb-qmLuDc_pDu4L9U85yCVk95-vJ38OoOYLDjU4qirTIvG9XiE_1F7wDSRgjquhzNJlml_PndKB3DgCO23uk7FCyjBGkOd67tbFxhpmK1RFAWyZgY882tneyDzGEG3cFUJbEosf82C_9-JEMs
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cYhj9BWTNommQ8gg6MeNdIXcgfKOO5Bny9oQPQ7SqqCP9K4WRJaQFH4x5rJkWF28unABKvmiPwrmOkbDNRjvo%2BbfGqhgKCYAUW38T7cj6vNLURuwWhOhS2Ud9faCLKN1UXBj5OZoqBJW9A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94d099471cd-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D20D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc0e-LmqPKMAAHF2AJrC8QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
737 B

26ms
23ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjCiOGCAjAB&v=APEucNX7kUKL3Twkkz4VWkwVrjGcf1gVPCGfCQzb-qmLuDc_pDu4L9U85yCVk95-vJ38OoOYLDjU4qirTIvG9XiE_1F7wDSRgjquhzNJlml_PndKB3DgCO23uk7FCyjBGkOd67tbFxhpmK1RFAWyZgY882tneyDzGEG3cFUJbEosf82C_9-JEMs
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tyqEAA6LL2j6hJ76XqpCDmoVi6zw%2FqjbEafm%2F%2Fjr7NqWz8vEw%2B3jkDMo3oysb98QWqEtCQzbyJe5OjefVcRu%2ByF2DfPaByF3KDLsNFoxLx9BTEaIPyGcyq7xhSn81u%2F5ZWuuGOD8yUN8Ow%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94d799c9022-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame D20D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

43 B
1 KB

26ms
26ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjCiOGCAjAB&v=APEucNX7kUKL3Twkkz4VWkwVrjGcf1gVPCGfCQzb-qmLuDc_pDu4L9U85yCVk95-vJ38OoOYLDjU4qirTIvG9XiE_1F7wDSRgjquhzNJlml_PndKB3DgCO23uk7FCyjBGkOd67tbFxhpmK1RFAWyZgY882tneyDzGEG3cFUJbEosf82C_9-JEMs

Protocol

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
an-x-request-uuid: ea8600c1-88c0-4cb1-9b1d-a9d917a7da28
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D20D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3MDE1MzE1ODkxMTU5NDM5MQ%3D%3D

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3MDE1MzE1ODkxMTU5NDM5MQ%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
an-x-request-uuid: 716d9e65-7b34-4bec-8871-f88789a44ec4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3MDE1MzE1ODkxMTU5NDM5MQ%3D%3D
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4180 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6677504020406&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4180 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6677504020406&version=m202401290101&ct=119&x=1&cor=12942473823103857000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4180 92 KB
38 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C58wl1xhPhc7PoDUQdN5I8vigDCU98gFARVlf1b_tncxm5i2e0B3jFaS9knKpVQe52nmHLEFtZrdl2ab8R8Uu93SIkJwdJN0ZEemUOlx7H2u871O57mMOoz_wDRZtqJT8uYoJ7V0sMjyis2XScj4_vKKkngH8Z2Nq6cBjqoMoH3ZQNjCgTMnVoWvmSaazkzUR-nytY&cry=1&dbm_d=AKAmf-AkyWUT7pF7MgyHlu8InWZ1qudUUSwA027H86HtMq5qOBFFkHAnUV-Ub4_QRD9YmhX78h6ffHr619-pAzgXMbjDaZ6kxInqUs9QhMM0ZGTVRfseEQUbL66PgsPUf-wc65Ajy0X6akzhdyfdgGQsRUwoMhGQWITSCQSuOE9mDW0dWDs_niiCtHqULKoQoBJDUMWNr2T8RrQwyacAma6tT3UaqW8vg5AqXcOg4djgjUrNIM6PWhcqXwbPp2zcbmpyIBJ6ldfF4d6-fcumQMEW9t5SgPeSaFpXExzCMoCHbKTnCpHPkEpLphmGk0ZnRlFLPBI7kImKPWVQR4q1-vb5qSc_MVbMYJg62C8JOL3jsmwQ3HwssB9yBxVVnlKqnP4WKIJLDaniQeOq7NPRU7biJ-N4UvrT5eicYof5CaQfpMAMoCwxa6OZwS2Pl5Zm23yILn0kdgZAd2YmIl2VpQqvwKlx94WGLGAsCfOdvLDbZL7ZF4_CcuOoq_FbB_Y_jA2JZmLudcYXMH0p4oxpyT2bwrKTQCq-X3A0ENnM8Jzl06HVc7kIJ6-nBoyD_hRz17n5g6aXgESkGVgdDfGTSMeJKDsoPr3nozlWxcnN1hFKXIyWSCaHqsfkallt47RVrwViameLGp0EG3o4cpQd09KAPPqEEskF8KB8Wjam2mBSU6Huuntik3z73qTHo7glL-nCPGHqHDz8fyxam6j-YXUoP4sA-DWJbpxvR_8gOGjCoMqhuL9ZTcgxFPMzVfKnoWi_2N1JhFjChHWKIApX2L3ryIf1plhhhsGutjeI4dEAv1JvZu1aKKgl63iCNAVuG5b6eeekcikGTBI7oynmbkU6mgNrgiA4q7VOSvhVtHpl4LXikKC4kGef_OQct3il5XEj5daS0DzIofH0P5H5YeX2QiF-1oqIv-yqbZAGml7S_27yrm5SotlDjjP-6QFuUNd40cNr0D1KOZLhu4WRnegW0krKbGz4a5Cd3C8-z1HJRJtHavb1svCqVDLVqtEut9AHv_-cExfSVim6Br1bSRkg1E3ZDBG5SD0N28FPyjM_CggoIuFjHlG7CNq7o4jyceVZuNHchhb-Ph558_j5483BLgnkuVsfc0OiEe8vXbNlVHeD2I2Qel6DIO58ZpRR-fMZSQMCxSQDGCeorzx8kEqPsfBovcg9KLP7xrZkqR7Q71T5T--6-n5NrkXJ1reyVr1uMWUPknegHIlasDpc8vM_KIe8ZBB65dMDLABFla6bFETibhAWwdMiknjWQyYeo9AIRc9P9q9Hz5RgpZnp-1-rnGSX9L_jqsA2nAuZFshjkq3ubL1c8nRlzoDDO-m7kFFiEd6PfniBeMek9ptA5PGza5j7gxsJU4A2ZWtUblzMWo21Ekr1nF_aza2As9SnRumoY0h6A2G2XcZFUXLTKvYEcxsY_AiDKLA6dnelYbZfBstwQUu-yCvLpldUSNHK8LP3qatTiBZ70rXu4qmIBVn3aoP2KF7H--KJCRy91VyJz9nnM9oUYALE6-jVR7ln2dopZun7_yi4Fy7Erxt1i2Zpq5opkiURxstBOgUNYnGarpLNc1_VS42YUN7HsvV0t3tDbhu5gty5juWxU5Hgx63Q7i5q9GuRgFp6QumyPlsKrrQrnf97vTgHATfMfYqlUDILFV7-sJcRypVjJJJxlt-ZGnWTR6STvm9x6J7YnpaRqQampk46hLUFEJmp8JfYMXxpCOiqcyQpWaPcLZGCZxDzsKSJZQFXT7goJ1641NNXHlsOr_nOvXKU2ZpcHMZkiRVEacGWxsKZ3jnfRUN68CGEFEuG568y1bFBsMGpisJmXVXIu3Wb1DOSWYavY0SJS9pEG1BAN0LYTyYiJP2hH1hPotzRJrD-K1IJTAkBkpBp4v6x9MIjTyiMGyInAiMwrplf8nK4IpNetnJYKCrc7cmBgHSkkM5K1Cw5C91O8sVnJYXQpEKwheS_ZtCVO7ck-vzxRw0LNd2CugCMZvMUsVAZCek7U4TjNUPjzNanjMzwoOTribM3Ao3c6ugJQFEQm_IhONHRNwEx_f6X-fzzO5alN1f1iQYOMPC8zMpCO3WCZYTXnU-6bHov8KuLaFTdUEt5jPOcNwgyY-ZtKkm-P3Qt-dZ0cZUsaiil3QYcbzxht9YYMG1DI7okN1q-LkDEnr0cc6aGJiMeWHpWsQlJcohPQsG69kTRAd2zWqqhbnQRJtJIrPk5XYumsJV4eE7uZA6lD9YjWCSYMM7mx_HU1HNg7qO0PFxYwURBgYgTgvgxDH3S158AWUIygs7IuauORhJbcHGy3chr5SIDVd7eEaBSaON_M_wr9-0uigmn1aiBuwB3XhLr9g4NfA-y8A9Y5cu0tTLvcpTtAcRQhM3W5w1CmjHQ_9raZCw9B763OW7cbsRPk3aNn0QbMcW3kdXKd4EC7Zep-4W0g4LJhGPsGj_2fCJf-c8ULNyVBIa0WeyAaO_tY5pds7HaGVX80RJWuaDjBBeD201Eo2_549UhJN5t7MTVcUD7qPn8ok94TfRHC4Z_Q2vCskTlbaOp1kGKpWXwF-zKeP_ha-4cFhQdJn_R285lEuCp6hX7NliPCofxIULx6g54Of_4aklM5XDS9uwIoM_YXUZ8Cbqal-zSW2qsZ20nMyRZbNB-TGwKKFLIzpBOtIdYjgHaUJp6LNaO4zMtIQY76Ptqqe7-Y556z0MplxpwNyNpdRANOj3EHsdmGmGge37ZoQsZFU751pdFIIBLhsaCBdjCn_uIPTuxM0IXlcRaHRE83-V7dcv0RY0jCJB-mYuD_IQzmu9zTeT8o94T1tc1BV4fw2zEJseqJRS5D60QGi8ZrHCg2mUb9pR7eUyv2kYzZ6TcmeQleZbf8_8BKFQcdOKq3YxPSQRWOERTRWxhiWctqbJt_DHE9EXg3X8DVWX7OFZiazKZIpLw46_9b740uQbfazGhJA82BQ1D3K08yMaMt2raC3CXnYqrxjwbVej39csTv8P_9qcF7u08oBA9p16B5RmXHVsKbcfl52wcykmsTjqaqeNmSORR_yEtyarJigVQ3_1i4M-mkt9B-PAhTVRi3VrR18OGZvC2Dv6CVU12z6x-CSYTFvC2nCkyWVpXkYfH29s_0NgCmKDWwjbAPgAJ-v0rDr5XC5PL6mHBPvXibk-4edOZs-CZnFLKp8LwHFgMDoLaGniJFY5CyHsI0F1B2UiwZlAiG2ZiLECDVkVwzKlKYIMTKLUV8xpRa8ES4SSuPoB8tIyFuogxUsmrNq-gb93RlXMjUcQ3uG1ItZhHvULa_PGfXu8E8hDtQvNt0QkalxcPlN2V3I-M_r57W-zwtzCk5n1lT0XYr1Ydr3CXi94QEt6dDJv7m6MLFDVH6VTxE-8PteH41yikpqIUcXBLdjlXjn7Yu3-oEbcVrXVUOO_xjKXjuZigrERj6G1CUENvGL-VaNKOQPcZZGCR419EKA-EFKyUo1SP9lXga0l6OANZuBQl18c4j-ocL4wV4TQRxExrzCsY9EOuJp-m3K9jIEq0iVP6Gf-q7SY8llzBxjG8du1NfTA16mL_sXx7QctXDDmV6xh0Q5EcWaHoElDHSO8ihI_DfmHjFmqsqkqhA2_L8-HEii6sHu5dwa1pKM9ZQSjDHON1IkMeGhELx0ATD4nRnrwdL8P2DkAFXPK8uOw5Cj5FcHKUp0q7co5M7ok-Uwduj-hpHJ2xVz7SYZkzoGYoobi09TFkmnukippqS_cAJ0vcSEQurDmfqNPzTxApZzzktBvUGDDL0ID-Tis3OkCJEG7LqPM7PmvBUgBw0ZXk5eRL-bJASN9Idac3anPJgwP_UtzR67sG5pfyGUbgoZWXglg75TgvDysv9EzH-9W-qOwzfv1ywTEeiwolHUyW1OWneC4YtkH7jI-48yyYdZzppE0H7uSPeNyePbi4EA&cid=CAQSTwAvHhf_rS_0Y7fOnUcokXOB65TzBMywserCAfocMNtG-laFYG4KZIztaG_ZlM3SH6XinnReyswmnRScAkAPcRBuWX9E3drnpQ8mz3XKYxMYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=12942473823103857000&adk=2228999114&idt=51&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da3bdb141bef0fc83367a4385dfb9d8a357a7126acd98a0f5c83eeb73fbfb703

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39143
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame CE0A 111 KB
39 KB 42ms
6ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame CE0A 12 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CmyrIuDBNELdRIbGyin3HWuk428Ql48Q8BDgXOsYZenhMVcZnv2DRsxNkvnAdp_9UUYWZf8mZP1ca2Ap5EoY-ifSUGWQdrkaKO-k2rsPL4Z7yOOkpUzt7g7W4C3one-6H97iAX5XGsrmSBgSXGf9mZxIr0iu9vIu-tjATpNZsaGR16LQ-zHMbwGXedEixjJhu7UQnr&cry=1&dbm_d=AKAmf-BSoe7obw6mA58ezTIDgz7mTbWgxziTPyHgAVeVU0Tnc-rg5hUBoUNj6VoSMjqmJYilgdgYjbQCgcNmTuaH5tIzW-WalraBM6Ks0-u55HpU9EKkMEoUQMJFGVFM7kPV9YKEP7_qSvoQ3IcBnQ5kgXJRithChrHKcToZVwrocSBu8ZX6GRKxktkhgBGa4deKtZDZFSSi5LSZwE5eal-ViOL7-iYCknsGi1uiKL5Vln0ROM77qQpsd0rnsuUeZBMyAkQghWsGMCoBS6G3cwNSNG83uEuoCGHyKQK_RDlZqpncvcNAO4Tke1SJRjcUnO2AlAlltKgYhvlqj2jZDji79sKJBq-MxL9PbiDdoL_JIUWHoeiz541e6ubtTvbLhY18NgJ_bfELPzkTvfhLt04JR-UkcE3WYS1gAfY3JuJnFQYVxBZ0SnbKaf8g0xtXvd9NDcPf5dEERxps17U-Z2WzBr0XAJfJrN_qjw8yeoQbGQTunw72H2GK1XjYPv5ueW-Mw1x65-767AHH9g3qb7ohcwL4IQPM_XNT_zRRJk6yoLB11hbtmcbAHQwUXw_wG0jAQWY6xvEmWNf8Q-rVmN60OUipOl59nZuvoQp2N8l7QbVi58R238ASf98cthnP5eh6WUAjj6XCHiusn-CozYvIVZC9Scw2xD-_JCIq627G-TTO3nByKKSTpJppqysTzsqfEUVclT41V6fnQSEkWL68CFA6nxMk7ph4oq7-2yixJJWaL5WJPS8hj9W_lL1_voDTOLBbXcXhOQfSMAXK2oRt-Mgbebj5xQjfCdTGQKwOxrJB9j6qLNl-ZyVq52yE8TXn1Kibb5i3XnTnI9Gvo-9uZXo87G8fHSqI7hnE44pIV9-6Lfa1DZ0AHv6J5N4TdKNsuJ6K1IGebvReG_5h0DfAL4NgmtrPAm5E2Efn79oZLVMYJsLQVGk6UjN3hFd-QqNnF39tqnwkTC_-Er0AGHh-EBU3UOT1RzK3U_c1uBBYZQ9HlFsEuO97pOchwSLFbQQpYYKoO1hH8c_18pEyfdI7K6jr0QR5zPrKYF7OSSOW-p9kzo8HcB3dVDCQVhK3Wa5QYLi7jRWCElCHnRdnIdzfYNfWtswfOtXYqZIwVUYvEp8iVsc3aET_shejLiyvpWL-RXKc1v71LKvBWhbGF_ai6Pq5ZtDKPYrLkcRTcS1aJXXu0xtTajPxqDm8E8mmONP5ZcXxIkO6jARWGOR-5A9IhVLBw6qhMuZoHZ_EoeR8dsDeiLNhqc8iCnIm8xa5_Yb8bZr1yKixBzUzLUr3iagvjlhz1SivHwYeh6XeQ4X9vRwN2whrFHwPfGL4UaSCIEd6FpoliDJDsjtxd3wKgUZXR-unT_F9tafp1meT1SID03QBkONWsd2SPwQ-21l1KUvmCW8FvMROyvvwzPQCKniHnBDkkQVEPrC-6tQ-qOvAFZCeenfOIC7TSIm3x7yGedFDYHvklOFiNruOjGX7nZKQoXYNxtsMqHgoUjMkGn199KYkzK0XXEfxR1AFjohx8_F8BTLOrs0FJcy5YNpKeCk14JYlyu9cZnyQu2MwJgRLGiQVejfUmMUJiK4mp5b4Tn2uvWvJiRyFvb6R0cXYQ8Dk-3U4Zmhg65MuBFQbTSrETEtEwt2MMlJUqR0BDlw5d0c5FzJ8pV2B88pvJsxpu8COJsrh_-QkaeE6O7SAzy_3LNCEmmNryzLHvASFIKtbqdCMpUcyukav51hr347ZHL1IXOdLpwZsHb4GYeFhWZNpfteAuRz3L0bjphaeVENZq0lVAg3gXbaA0B8y5dhYENwLOUk3B35JMU7IaUdx8d9TIOcD8axlKMU8mAd8oakKNX3Zpj0x8O0ZZox_rOYa008h_Ov1goG5xKoeFnnXohgvcVIebfB5RhwW2zl2eKaBcx503KDx1nejQQKWE6UpV4eNKvpRI2wK60zxgAb7UoWAv-PNWdmRX4A-l3g-jw5fPumXnPF_PzTzU_8jF0w9R_7m-eNoo4nPs66BXfvlUB-el2BMqsCOLM7qs8JaDUUf_JnakH4pYi8Mam-Aja7RVZXB6lfQcZzif8qJd5Q65hu0nmx2KTJRaNOkPu23poAEC1nMNF90AwX8PRQgIqqWMVCG8oT5QUdti0wdP7ZweBpVesCV807bYsad9BmnztFfFA6kKUTcfnHz7vNItsMpcFqqWBzuJxnJNy2DxkxpNLHgqnNaVysCpuwqtEp91JT2rqFJa5H8-dw8rfpOzpHsue7UFdjZqFwiCXQVjs0CW9WMLj85RwIGABeYKglXT6TJBinCYWthuVGTSY5XgI-O7tDb-pNdMHTVP52fEdj6av023NNpfbaX1-xLX2vAQ_POA3p3PhQoRJE05rZmd2Tys-t2wHDcwuSeBi13ZWex5O_xaFflxRIjTlcuymEjlUei5d0f_TiLZDRVFoIl8gb2OiyZkFsqkJ3igP32VZRWhhynQlud-7HfxF3ELyZXaYYhKKlmdxpisfFHIHKb9XynWTd1o4JZ9CRrCb3TOSRbTn5uqjqfhR7bSGTv2q7y6LvovyyUoyDjs2AymnrLlB-51QAsiYLcQs13sZOh3wvvbkfpoAHbue-ai-wiL6QOpzDdhQFdXxXTLbDQ6KBg2zygBDowX5KM4aT2a_0s0ewIf5wIoD0VnnBsySjl94cEbhTpN-GO_mNfoGxE_CwFhrgQo2Rw1BLtfDuNVG1EOhn9dxGJghmR4s-xPFmIcwnLEm9Lr0q_R7MUnbH-Tu51m2sOG4BNReYvKK89ATjodoUbPLJYfb6_saiKtsx4nNg3BZLVHizcAd_k3z-Mm9KCVHrxnsZ4GrydiZh-bnIJK9WF5TlUQdYf7YZWd1gagiYj857wtvMtR2YAhRZHNOdlJb1_8LPIllNnss-huWCgis5sOto6FqaLil8hU5bJREc9RQ55papdq6VRVLqqqjBw8q-toxWO6Fx8Qvx9eeL4-6iz6s_UrOr_fPV_syLgb90gQPK10JECiNdC9yO9_XzVCX1Epk4Qo_ciuDIudeq13r5vHKJT7xJf7fwAXILWVLMzSguyt0H8L_N7v5AjEVVx6APpiwLrkVp_JP0TelaKwwnK4_luX-vlLIGIQ9yzIbf2_xKOfKTG0wwpL07B5TzvJUOX1i7XO1ERazdxILOAHdWm089F1obkyjRSozd3PIncN17IlDFzieW3Ht0NPFhr0V9anRD4Kr6wYqDW35w10iSYnGgMWBsOVaOgJ2ZNqlqmsqZspijHDktJPLD47pekmw_A10oYYtR--UJGXA21jxlkmYNdL7xcSbsvPppGePre_6l6n3L1hs_W6Jb0sYN5CC_6I1m18wE2xY2IBmi35FWsrzco6mVuAqPC6qqcWtdqDOf803xsvVzhUW8_ROa7N4ojUG51V_BsDGPOUn1gSygjExnAWTm4mm4gT1OjVnyYH-FV0Lq2ytQvrp4puEcmlSjkHlbLvoEEFakNCMjQNEQhfhpbHpFPJPUP5zQsI-G6kdZfj4AzNVlRzTQWylduEJ8JEXps_YmlSii4aPgVKssBTxLmbn_JrLNeXON8nGIcoC2-dBggJMmcm0iKmA_X3lapda1cXTkCb1p0pmoHPlW9xqHUdukdog0lyNjaywTUp_D7nkkUkF-A8HYAwtiFG8wyKb4m7awEvGarItTYza9_3lBKrjnywWqF4VCO6Ih-BuwGGOwlChNRc6vPz1HV1Ospyk2m3XSRhNNnUUnum063eFxMUDNvgPxkJZSLQq45I8XwfLbzYeM4KRSt5Wb2L8zgSoI3BFyS5btW1gcgOK9mw1ddzkRs6xYxzZg8keBYhRUsVvOiIh13JRWJETT_NvlitsuxYmOS38afXYW4mUonBLgQwsKGkBIzn5nmQ9lsPz806s2X1Q9JHAiI&cid=CAQSTgAvHhf_Ghulaubp3tzpaI6hZvnOgI6Jvyq6_HRkb9kUNoRWDYZzpPVCBH0h9GzvrYRK8qbJWG6WzT189sj6ttfvXM9vW5ShUxGQBafh2BgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=14105542882210722000&adk=1964084971&idt=54&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74182
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:37:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame CE0A 30 KB
11 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:30:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74594
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:30:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame CE0A 41 KB
14 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126364
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
DATA 200
OK truncated
/ Frame CE0A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92003c2ad338bc8c1f56dedade87287d8b0932f1bc7b42242b8314a13471a24b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4180 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame 4180 12 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C58wl1xhPhc7PoDUQdN5I8vigDCU98gFARVlf1b_tncxm5i2e0B3jFaS9knKpVQe52nmHLEFtZrdl2ab8R8Uu93SIkJwdJN0ZEemUOlx7H2u871O57mMOoz_wDRZtqJT8uYoJ7V0sMjyis2XScj4_vKKkngH8Z2Nq6cBjqoMoH3ZQNjCgTMnVoWvmSaazkzUR-nytY&cry=1&dbm_d=AKAmf-AkyWUT7pF7MgyHlu8InWZ1qudUUSwA027H86HtMq5qOBFFkHAnUV-Ub4_QRD9YmhX78h6ffHr619-pAzgXMbjDaZ6kxInqUs9QhMM0ZGTVRfseEQUbL66PgsPUf-wc65Ajy0X6akzhdyfdgGQsRUwoMhGQWITSCQSuOE9mDW0dWDs_niiCtHqULKoQoBJDUMWNr2T8RrQwyacAma6tT3UaqW8vg5AqXcOg4djgjUrNIM6PWhcqXwbPp2zcbmpyIBJ6ldfF4d6-fcumQMEW9t5SgPeSaFpXExzCMoCHbKTnCpHPkEpLphmGk0ZnRlFLPBI7kImKPWVQR4q1-vb5qSc_MVbMYJg62C8JOL3jsmwQ3HwssB9yBxVVnlKqnP4WKIJLDaniQeOq7NPRU7biJ-N4UvrT5eicYof5CaQfpMAMoCwxa6OZwS2Pl5Zm23yILn0kdgZAd2YmIl2VpQqvwKlx94WGLGAsCfOdvLDbZL7ZF4_CcuOoq_FbB_Y_jA2JZmLudcYXMH0p4oxpyT2bwrKTQCq-X3A0ENnM8Jzl06HVc7kIJ6-nBoyD_hRz17n5g6aXgESkGVgdDfGTSMeJKDsoPr3nozlWxcnN1hFKXIyWSCaHqsfkallt47RVrwViameLGp0EG3o4cpQd09KAPPqEEskF8KB8Wjam2mBSU6Huuntik3z73qTHo7glL-nCPGHqHDz8fyxam6j-YXUoP4sA-DWJbpxvR_8gOGjCoMqhuL9ZTcgxFPMzVfKnoWi_2N1JhFjChHWKIApX2L3ryIf1plhhhsGutjeI4dEAv1JvZu1aKKgl63iCNAVuG5b6eeekcikGTBI7oynmbkU6mgNrgiA4q7VOSvhVtHpl4LXikKC4kGef_OQct3il5XEj5daS0DzIofH0P5H5YeX2QiF-1oqIv-yqbZAGml7S_27yrm5SotlDjjP-6QFuUNd40cNr0D1KOZLhu4WRnegW0krKbGz4a5Cd3C8-z1HJRJtHavb1svCqVDLVqtEut9AHv_-cExfSVim6Br1bSRkg1E3ZDBG5SD0N28FPyjM_CggoIuFjHlG7CNq7o4jyceVZuNHchhb-Ph558_j5483BLgnkuVsfc0OiEe8vXbNlVHeD2I2Qel6DIO58ZpRR-fMZSQMCxSQDGCeorzx8kEqPsfBovcg9KLP7xrZkqR7Q71T5T--6-n5NrkXJ1reyVr1uMWUPknegHIlasDpc8vM_KIe8ZBB65dMDLABFla6bFETibhAWwdMiknjWQyYeo9AIRc9P9q9Hz5RgpZnp-1-rnGSX9L_jqsA2nAuZFshjkq3ubL1c8nRlzoDDO-m7kFFiEd6PfniBeMek9ptA5PGza5j7gxsJU4A2ZWtUblzMWo21Ekr1nF_aza2As9SnRumoY0h6A2G2XcZFUXLTKvYEcxsY_AiDKLA6dnelYbZfBstwQUu-yCvLpldUSNHK8LP3qatTiBZ70rXu4qmIBVn3aoP2KF7H--KJCRy91VyJz9nnM9oUYALE6-jVR7ln2dopZun7_yi4Fy7Erxt1i2Zpq5opkiURxstBOgUNYnGarpLNc1_VS42YUN7HsvV0t3tDbhu5gty5juWxU5Hgx63Q7i5q9GuRgFp6QumyPlsKrrQrnf97vTgHATfMfYqlUDILFV7-sJcRypVjJJJxlt-ZGnWTR6STvm9x6J7YnpaRqQampk46hLUFEJmp8JfYMXxpCOiqcyQpWaPcLZGCZxDzsKSJZQFXT7goJ1641NNXHlsOr_nOvXKU2ZpcHMZkiRVEacGWxsKZ3jnfRUN68CGEFEuG568y1bFBsMGpisJmXVXIu3Wb1DOSWYavY0SJS9pEG1BAN0LYTyYiJP2hH1hPotzRJrD-K1IJTAkBkpBp4v6x9MIjTyiMGyInAiMwrplf8nK4IpNetnJYKCrc7cmBgHSkkM5K1Cw5C91O8sVnJYXQpEKwheS_ZtCVO7ck-vzxRw0LNd2CugCMZvMUsVAZCek7U4TjNUPjzNanjMzwoOTribM3Ao3c6ugJQFEQm_IhONHRNwEx_f6X-fzzO5alN1f1iQYOMPC8zMpCO3WCZYTXnU-6bHov8KuLaFTdUEt5jPOcNwgyY-ZtKkm-P3Qt-dZ0cZUsaiil3QYcbzxht9YYMG1DI7okN1q-LkDEnr0cc6aGJiMeWHpWsQlJcohPQsG69kTRAd2zWqqhbnQRJtJIrPk5XYumsJV4eE7uZA6lD9YjWCSYMM7mx_HU1HNg7qO0PFxYwURBgYgTgvgxDH3S158AWUIygs7IuauORhJbcHGy3chr5SIDVd7eEaBSaON_M_wr9-0uigmn1aiBuwB3XhLr9g4NfA-y8A9Y5cu0tTLvcpTtAcRQhM3W5w1CmjHQ_9raZCw9B763OW7cbsRPk3aNn0QbMcW3kdXKd4EC7Zep-4W0g4LJhGPsGj_2fCJf-c8ULNyVBIa0WeyAaO_tY5pds7HaGVX80RJWuaDjBBeD201Eo2_549UhJN5t7MTVcUD7qPn8ok94TfRHC4Z_Q2vCskTlbaOp1kGKpWXwF-zKeP_ha-4cFhQdJn_R285lEuCp6hX7NliPCofxIULx6g54Of_4aklM5XDS9uwIoM_YXUZ8Cbqal-zSW2qsZ20nMyRZbNB-TGwKKFLIzpBOtIdYjgHaUJp6LNaO4zMtIQY76Ptqqe7-Y556z0MplxpwNyNpdRANOj3EHsdmGmGge37ZoQsZFU751pdFIIBLhsaCBdjCn_uIPTuxM0IXlcRaHRE83-V7dcv0RY0jCJB-mYuD_IQzmu9zTeT8o94T1tc1BV4fw2zEJseqJRS5D60QGi8ZrHCg2mUb9pR7eUyv2kYzZ6TcmeQleZbf8_8BKFQcdOKq3YxPSQRWOERTRWxhiWctqbJt_DHE9EXg3X8DVWX7OFZiazKZIpLw46_9b740uQbfazGhJA82BQ1D3K08yMaMt2raC3CXnYqrxjwbVej39csTv8P_9qcF7u08oBA9p16B5RmXHVsKbcfl52wcykmsTjqaqeNmSORR_yEtyarJigVQ3_1i4M-mkt9B-PAhTVRi3VrR18OGZvC2Dv6CVU12z6x-CSYTFvC2nCkyWVpXkYfH29s_0NgCmKDWwjbAPgAJ-v0rDr5XC5PL6mHBPvXibk-4edOZs-CZnFLKp8LwHFgMDoLaGniJFY5CyHsI0F1B2UiwZlAiG2ZiLECDVkVwzKlKYIMTKLUV8xpRa8ES4SSuPoB8tIyFuogxUsmrNq-gb93RlXMjUcQ3uG1ItZhHvULa_PGfXu8E8hDtQvNt0QkalxcPlN2V3I-M_r57W-zwtzCk5n1lT0XYr1Ydr3CXi94QEt6dDJv7m6MLFDVH6VTxE-8PteH41yikpqIUcXBLdjlXjn7Yu3-oEbcVrXVUOO_xjKXjuZigrERj6G1CUENvGL-VaNKOQPcZZGCR419EKA-EFKyUo1SP9lXga0l6OANZuBQl18c4j-ocL4wV4TQRxExrzCsY9EOuJp-m3K9jIEq0iVP6Gf-q7SY8llzBxjG8du1NfTA16mL_sXx7QctXDDmV6xh0Q5EcWaHoElDHSO8ihI_DfmHjFmqsqkqhA2_L8-HEii6sHu5dwa1pKM9ZQSjDHON1IkMeGhELx0ATD4nRnrwdL8P2DkAFXPK8uOw5Cj5FcHKUp0q7co5M7ok-Uwduj-hpHJ2xVz7SYZkzoGYoobi09TFkmnukippqS_cAJ0vcSEQurDmfqNPzTxApZzzktBvUGDDL0ID-Tis3OkCJEG7LqPM7PmvBUgBw0ZXk5eRL-bJASN9Idac3anPJgwP_UtzR67sG5pfyGUbgoZWXglg75TgvDysv9EzH-9W-qOwzfv1ywTEeiwolHUyW1OWneC4YtkH7jI-48yyYdZzppE0H7uSPeNyePbi4EA&cid=CAQSTwAvHhf_rS_0Y7fOnUcokXOB65TzBMywserCAfocMNtG-laFYG4KZIztaG_ZlM3SH6XinnReyswmnRScAkAPcRBuWX9E3drnpQ8mz3XKYxMYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=12942473823103857000&adk=2228999114&idt=51&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:37:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame 4180 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:30:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74595
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:30:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4180 41 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126365
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E583 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4180 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78dfcb6c0a864c3caa85e8527d53712aa442b258da7f5bb2f4f0ad331b9ab15c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/ Frame 55AE 20 KB
5 KB 24ms
9ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c47e4c7a39e0453dc0e108c66bfeb4f6cee6988fdf2368d3712858d8f97d7ce8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 126846
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5035
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 08:59:43 GMT
expires: Wed, 12 Feb 2025 08:59:43 GMT
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE0A 0
0 77ms
50ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssz81pQUMFETB0mm5j7reFN3zNm6Rpo-XoN-tzI-hjAPOAQf79DKbdippToEvwT7y-N_7jnq7DqhwjSlYgmwcTKRSkC76M8w9R5na4fr4Go95PT5OzxbA6dkUUHWEWTBE8tcVAMEZDIBZ8Eg-D79udFMZ6DyvPl61L2W3TaiM3wjqF00AH5uqwMl83LPWD0jVIZ5RiG4fsCoxcIKDwJqo1k93Q5BNI1mxs-hbiqJZOuNikWwZTQZYg4strP90rwYrB2vMGXQUl3Vm_dJQHXVbCninbszeNpQkJReb7hEazg-vEg3UDYoMBlZ_pbNkvRE67nLDUodBCWzVJhUtVYFRjX1XaCq4LaHT3CcVbXsmxs0gJ8auhwU6Mo9OPdu09fv9v2nvbw7E9j4tPceaWrWtepo9Y2iaB7xztB8Hgo-MucLGiswABSJQJVqLhmoKw4Z7G_5RXpclKAvbRMEiMem3A4VMCqo8h915bzRQjLJvAURsM-swhavl9Z7xO-LFpV8J3Rd7FVh4Qz5j9P0UQGd1EkEDovtHQB2POzEoQj9K7sSsTttSczMTmf8zqO-SLWAD2jqQToc901v72z1XBZQvt-RlOO_sruZIVtoPS_mSXc5yJArQWlf7pc1fOztjVm3RgYq8hAL8Id4HffM0oXli-3QOGhoOvyoZv0--Z290DZiq2zQmapaIkiTvTKhI0oU0UW-kNc2jxmxnBsTGTtC68exllJGkFSTY8ZBZFXLMHMQYWlXZtUzWlX6Z1zRsCLZ3tEQlfrR7JDU0Sr0lRIK07e4g9WsJ4IOVY8OZvawt4q-dF9UBVWjMml0cW0nYiB9xE0mHg-uE4u4ZrBHWx0ntxiM9R4lnM0g-dPC-U_hoqF5S4QG7VE7tjfshK84bk5kzcJJDuhqyS6zP-mTW3P47qyD21H3639z3vi4Dfk8rVln21UDg3ZsXIsOMCj8apF2vJgS7ZkIZuXaEGVAux72LtCgnVc7OB_zH4MqwdcvwwMIEN5EOzA_OXiCVsr9FhnLWAKJVTE2IpStil0-rn537XpKky3G-_Tm46cwQUiBv8EjX1Blxs7F8ABZVoE8ULQzbm9gUnbK_eVng_JnXdNJSZbraoT4CDSYMe8UbyVN8L32g5C03zzRvqOyuDu1qHF-Glhg32j8cX-I0kvZLA4gYjsFm4mwhH1MO0RiFwWsYE3_kModojCUhJWJRwEPeU8i4RQFxZcAcGlGBELrEf-w5USmlUtbqcseiMeRagre6eFhnyV6u80JjgHql_SHJZOjtlDd7P2ARRBQ_3MTPPYw0QdpGcDSEmOc6SkaOg1pISWtinj3yNrJBPBnwPCp2Gc1InrYBXofg0HS353sfhf9IGGahN_CdnuA5SEXl34JtTnhu7FE8no8xRDJJ6AVXBjSkTDLMrX1PHGO2ZU&sai=AMfl-YTNu8IKmAVRHAzhHWyhzKVWAyImIVOR7sSwy_X5abXxPSU2ascF8wj2IDp5C4xwt2_5Bw0ix5lc1u5Ux0oPl-LUmYNEi-DorWJLHBuZ72DeivzDrdJrCHCtucEA_aCCiCbapfLY3xdtOafpRayYgZqx6IdtI_1UfRuPcq-4be5dMF8F7M9hef0xIGMJ_E93coESoGpU8rVgbM8UycQi3aMMSUV5E3QcLfHtBlghDlj3BqSF7eT2pI7mSU3w1PdgmyFQPv4ySWdSZZSr_43CZvMIgBmlyPhhr9apjw&sig=Cg0ArKJSzEh_Z7qzV94ZEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=77&cbvp=1&cstd=75&cisv=r20240213.94453&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame FE93 38 KB
13 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/ Frame 6358 20 KB
5 KB 11ms
8ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c47e4c7a39e0453dc0e108c66bfeb4f6cee6988fdf2368d3712858d8f97d7ce8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 126846
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5035
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 08:59:43 GMT
expires: Wed, 12 Feb 2025 08:59:43 GMT
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4180 0
0 65ms
50ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstq1_ITF-qG6maoe6pSBM_AiZVdc3i1LyKI4p7IuIVRu46RR2axaQclMVwhpmIoJYnlXjDC8M2m72fMFiFknBRDTXRVTpLFiveVm8DNEawH_R53qGObLxTXNKwkz6rBr7I_vdnD8uZHa27FoNZRmgCnjYVZsB_hhMUKw_rs0fxx-HMRrP7IUQsyUfCsOxT963Pac7pmeWeWqr7QCe5rd2AmG5KWUwVDplUPPrtNItCj1giTgwXRgsACUhGCjnmLo-mKQxIvsQyYmSGJTCes0dnvG24Mq_10YpLAtTuQqsv09AoQ592E4uHGuasXoRGvPEuSX89IekjnWrh_WSy5eqQY36h8qSgwoaGpeQR0ExVrwLDnvBphtjB1i3ZqrAzQ0-vG_i-AX1dPEjCwziDmQ_aGr9S0KtpgGfr5mVKwrvbPvHjkyxBt5ysANBbbGFiK_RCcTRfmdtgzjdflezSZBDmngLporbGXnChUcjrjcMWM1o7dyzPwlpkVhMMubdohleVs8Um5D2UXIwyxG-5a7jRbnWd1J5R7oLaG1QkkuUJO5vVM_Ztyoo8YqsXX5qXoyTkV-am-0PjNPV_-Pt7DIZOQXplgKM5Lglu_0Em_-E_2ehvjRIMoUMQznaS5PJLqmPt4j-7wHzQu94ckFBTw3MEb2X9dOVSAy5HPh0Xte_gzdnZ-GdYa_2YaS5v1VtmxdXnmnQ90BWcHrVOZ6KCD7igPOsUsL2XisdQUpuaYAtfMDzAtk9AtnXZ9enWxED9uo4fk5bXyfiTwMkeiGkiq8q9w-MX4-X4dgj70Xc1VxGB1P50NomorHjezXT5LbLIveAFEzV9Ot0nWDaV_vzfUiWm9wmPRXMdjmK4W2xYHX8InD5ZPVmn8BgDhRbm0DM_UQKMirSLDTaZKnWb-F6OYqV4TxQnOSdpiQSItUK6fmyrCwtqp-0LEUWCC1LzQlYqcKJcAlQi-kgQhcNxVcgQlTmClxxplw8BC61DbArS3KBix0SrI_0DtaeQalbTMCvwIjglWE250fFdx08QqsuXekQZ2fFqJ_Ri-PUhTPhux7vLzoN-Adn-6ECdj5EBqFPpoLbFeP3X2195TrFwMmje9fCUPTOC9hTAak3O0nY0l8kvXRh4l_2Gp_ikUH5HNKCe-WOemDBsSODbn4J7YNOaOyGtrZujKdosiFsgJ3boKJw6s_WA3WWzMzglWQ5aeP0_RHi9pB6XkQZuxzvjJjcRklYlu2AgckhOQxqF8o15_DIuzCfwRnMBbIzNFLojsU4UU067C7i6v1Y4x9ky76j5sI5E53QHMqBFQSCP14LpykHtbDGnco22j8i4fx5yqdIiOIDC3JC6QyJmss610zEBldQhNbduDJyRw_mOMv9QK95laK9dapSGwmYfYcjfLKewJ6VrTPK1-4F8ihqHb_sTsnICzeyY&sai=AMfl-YSq7ePXxpJSCuBnDCwxcfNRA2XA1tKSPuDhcLKtLg3hwbDrU4YDLrEAtoN8ErtDj6h8xyjpkbGxbcn4ZX02AabAzXnKSvhEdtcploVHAi5N5q5iRLa_0PA4R5NmWq69stcNG35zNNtgsYZJnxAeKP3ZVCEHw39IU7wrz7jhtUJHsHwamXRdWnRFXMK2USWIigq9V3ChKdN5VJU2nyGOXvFnX-sIjN6CL_4bgUJPTjIm9wYi5GajGh61Jk-Z8-mSRyHfdlI_fe8oeX9vP5I9Vrjm94F4xII7ptAxkpj36w&sig=Cg0ArKJSzLaexlrjBR6VEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=43&cbvp=1&cstd=42&cisv=r20240213.91973&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame E583 51 KB
20 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 09:16:32 GMT

GET
H3 200 0792508cef764056005fa3103b74d209.js Show response
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/ Frame 6358 60 KB
17 KB 9ms
8ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f802ecd4d00a3bfeb3493efe7db20cc7d86f12f75bee95815d19c5ea835f70cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 10:37:30 GMT
date: Wed, 14 Feb 2024 10:37:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34579
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17556
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame FE93 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 200 0792508cef764056005fa3103b74d209.js Show response
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/ Frame 55AE 60 KB
17 KB 6ms
6ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f802ecd4d00a3bfeb3493efe7db20cc7d86f12f75bee95815d19c5ea835f70cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 10:37:30 GMT
date: Wed, 14 Feb 2024 10:37:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34579
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17556
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 75E4 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 de738ae4ccf34553321459da4b2a8f23.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 2 KB
829 B 17ms
14ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/de738ae4ccf34553321459da4b2a8f23.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f530f6332f62e984dd2bce7c2eb33b915a130e79e0a0075bf250bb7a7e823fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 11:40:39 GMT
date: Wed, 14 Feb 2024 11:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30790
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 799
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 578e3096730080a8af724f1a22450208.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 12 KB
4 KB 15ms
12ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/578e3096730080a8af724f1a22450208.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7211b35cb0e6403546377d7a25870102eb82d1b9f817bdc1d41844011e88a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:23:09 GMT
date: Wed, 14 Feb 2024 03:23:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3966
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 dd210f028444d1f1b7b3cce32733ffa5.png
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 23 KB
23 KB 27ms
25ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/dd210f028444d1f1b7b3cce32733ffa5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3cfdf732348443d3d633f6f68ed1164f09f53e473ef90281de773b15dc37862e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:53:57 GMT
date: Wed, 14 Feb 2024 03:53:57 GMT
x-content-type-options: nosniff
age: 58792
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23430
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 0152ade2dbb169b2249a103839bda1c7.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 10 KB
5 KB 29ms
26ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/0152ade2dbb169b2249a103839bda1c7.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

376571de7fb7d61ee398aa203005900aefef240b923a879c20f0c11c8af5dc51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:50:59 GMT
date: Tue, 13 Feb 2024 08:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127370
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4708
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 b85e4615a89df3c1c2d88694830ba590.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 11 KB
3 KB 25ms
22ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/b85e4615a89df3c1c2d88694830ba590.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4699aee4e4132e3104a1b90de072c0ca93615b51013bce15f71cad2d71e6a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:22 GMT
date: Tue, 13 Feb 2024 09:03:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126627
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3434
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 9b5a17057e6cf01258d524d1b6aa683e.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 25 KB
9 KB 31ms
28ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/9b5a17057e6cf01258d524d1b6aa683e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

131c2f4c21534aae9a64d3865cc6ceb180862f13b7092c8e491c4bb603e64052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:53:57 GMT
date: Wed, 14 Feb 2024 03:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58792
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8748
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 bc2e9cb31a50e5f771f3dde713f3c716.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 6358 3 KB
1 KB 23ms
21ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/bc2e9cb31a50e5f771f3dde713f3c716.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e39a97af1aca0a5de3c4d3a5ac236eead0a53110b8eb6203d38f1e1c858c8187

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 20:51:45 GMT
date: Tue, 13 Feb 2024 20:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84124
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1055
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 de738ae4ccf34553321459da4b2a8f23.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 2 KB
829 B 18ms
16ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/de738ae4ccf34553321459da4b2a8f23.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f530f6332f62e984dd2bce7c2eb33b915a130e79e0a0075bf250bb7a7e823fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 11:40:39 GMT
date: Wed, 14 Feb 2024 11:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30790
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 799
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 578e3096730080a8af724f1a22450208.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 12 KB
4 KB 17ms
15ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/578e3096730080a8af724f1a22450208.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7211b35cb0e6403546377d7a25870102eb82d1b9f817bdc1d41844011e88a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:23:09 GMT
date: Wed, 14 Feb 2024 03:23:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3966
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 dd210f028444d1f1b7b3cce32733ffa5.png
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 23 KB
23 KB 32ms
29ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/dd210f028444d1f1b7b3cce32733ffa5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3cfdf732348443d3d633f6f68ed1164f09f53e473ef90281de773b15dc37862e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:53:57 GMT
date: Wed, 14 Feb 2024 03:53:57 GMT
x-content-type-options: nosniff
age: 58792
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23430
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 0152ade2dbb169b2249a103839bda1c7.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 10 KB
5 KB 33ms
31ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/0152ade2dbb169b2249a103839bda1c7.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

376571de7fb7d61ee398aa203005900aefef240b923a879c20f0c11c8af5dc51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:50:59 GMT
date: Tue, 13 Feb 2024 08:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127370
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4708
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 b85e4615a89df3c1c2d88694830ba590.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 11 KB
3 KB 29ms
27ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/b85e4615a89df3c1c2d88694830ba590.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4699aee4e4132e3104a1b90de072c0ca93615b51013bce15f71cad2d71e6a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:22 GMT
date: Tue, 13 Feb 2024 09:03:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126627
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3434
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 9b5a17057e6cf01258d524d1b6aa683e.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 25 KB
9 KB 33ms
31ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/9b5a17057e6cf01258d524d1b6aa683e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

131c2f4c21534aae9a64d3865cc6ceb180862f13b7092c8e491c4bb603e64052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 03:53:57 GMT
date: Wed, 14 Feb 2024 03:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58792
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8748
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 bc2e9cb31a50e5f771f3dde713f3c716.svg
s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/ Frame 55AE 3 KB
1 KB 28ms
26ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/media/bc2e9cb31a50e5f771f3dde713f3c716.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/0792508cef764056005fa3103b74d209.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e39a97af1aca0a5de3c4d3a5ac236eead0a53110b8eb6203d38f1e1c858c8187

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17629205630468773064/76093_ALDI_TALK_Grundrauschen_S_300x250/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 20:51:45 GMT
date: Tue, 13 Feb 2024 20:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84124
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1055
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 15:43:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 03AD 624 B
245 B 44ms
43ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNXsb1BfdM7fw03RaW8K43dznMGNbggfHH9hbZnpznfBZ0IkuWWqV7Y6GosC-znvfniUlhLBV8P7k4ABVqMnpArpxRTIHCeQw6VeaNd7N8BowFGl9kQkEqpAtIrYQFF6IAqMyXI3B8X2tuCSlBsE9N9LhW_w7LL9om-Jq12e9tnoTNelXKw

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:49 GMT
expires: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 75E4 111 KB
39 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/ Frame 75E4 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:34:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:34:59 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/ Frame 75E4 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 17:55:31 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 75E4 41 KB
14 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126365
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame 75E4 3 KB
1 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame 75E4 20 KB
8 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 75E4 42 B
63 B 38ms
38ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DDG30OEVgbLNbw1y1nQb8t4juUZim2-1hNz9_UXcgjWqtPn8WMDyab-uZYXSWIh9RS6QZmRRSEfpv2FTP-EYzFDjOhPqezD1CDm_c1N1AB_WEs4HY

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 75E4 204 KB
61 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1097
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A478 6 KB
3 KB 17ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E583 0
20 B 44ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BemKf_B7NZZmfOeON7_UPhYyd0AwAAAAAOAHgBAI&bg=!S0ilSAfNAAY9UbWqHVE7ADQBe5WfOAHpI96B6fNZQmjGb9o7_asm2ml49NT3mGwa_kN2XnwlQnOtBQKWoEskpj9OqEW3AgAAAFJSAAAAAmgBB5kDDVQJ-57ay_82U_rfjIctWL9EbxnFdfBGs9R2RGmrtJgaq3WgQdWoWZFSaMAi6nZydYUjQ5m1zdlbFtzFJDQryox1edGAvgpImkvDvURACmDS2NeUTzZIhGVLam6G2JDVof0fcc46gJLheSZ_lgYlEWKlIWSLYyhm9u362_dAKnK8Vgw96kPp8obzbE_0yi_fQXfq716a-TqhiuXruIDvQpWSngEiV5fSHm-1wfCXj8w1T1-YdGOsFQUNNc9AQob0HOymbmZHzdR-P_uph21yN1SDNxaxJe8UAYEhvqUydqN6jDg1iA20mBqZjcIMwZNTXyJaSVMbo3AMUjwiFMTFmKQ2zT1Vdlvoe_Cnr8dtCeBJlBKl1VVJW910xn2xyn72cRFz97hkUwEcWzoK0F6bukIaoPS-qcfJatHudkm4IOFfbZ6AJ9rERUIqWWnVfIawE62BkxxFjCBHfxKQgEQIAjs9pJF96bQYMCDAxAhbpqFp5JQEWQcK5t7aU3d6W1Qhdd_loi97qJYrsiTaRBZPTybLpDwWOkaUB63mmxX0pV-ca7dbjaPQKVh4WHhMBDtgj1_8Qvzwrau9cYAd6nmJBM54nsNUbAOl0-oaYaI7ebgB3lfCYLPnj5XGlbvCCXV9iu7t1tdocpGXvXIoY-yu3DOxcm55IqfT3fcnzx1RApMtodfbDs6iAf1yHWNp2jmail6j6Jjnl5oxtTHvt3i_ziFs53Hcirs-lzhXGSkIfj4W1_15bEI-yimhTK4fDU5BQWW4tdueR5Lw3E7sJ3SNP1DuQKEbI8eU4sARkeHkLi_0n2FU29RTbSPuM820cMVRW_8RJ0Bp19-8l7-EBgwvXUVWOCm6ySe-9cfKsDu0Wfl1nbb6XLcjMsAI8D9j46j4nC8erCyokweDTgcaPohlHOCUhyOCpwM6_6_7NWR6egHUmrsDzxSqkxT6U3ANE6L6w52hZOyoVbgp6u-EqjawIwJb7UAXS69H1l8b71N05a7Fq1scS2rOEMtIW9ECFNP0IjkDNH7A9ivkMp5DuL4

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 03AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
731 B

30ms
30ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNXsb1BfdM7fw03RaW8K43dznMGNbggfHH9hbZnpznfBZ0IkuWWqV7Y6GosC-znvfniUlhLBV8P7k4ABVqMnpArpxRTIHCeQw6VeaNd7N8BowFGl9kQkEqpAtIrYQFF6IAqMyXI3B8X2tuCSlBsE9N9LhW_w7LL9om-Jq12e9tnoTNelXKw
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MJ9C6adw%2Fl7iz7nsGXqs5c3IVxNR3qt4uAykyrwQMeyxjxYyU9LM2plaAf40%2Fu5EGGxd2Z8a98vBVj8UDwyZcmt9M%2BpIuanbnxC0a3HfWB4sR6g1nZc4rBoPJJoVnVZMSIlC3iwQ9rQVPg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94eebb69022-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 03AD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc0e-FVbLXkAAAi7AJvmjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
730 B

21ms
20ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNXsb1BfdM7fw03RaW8K43dznMGNbggfHH9hbZnpznfBZ0IkuWWqV7Y6GosC-znvfniUlhLBV8P7k4ABVqMnpArpxRTIHCeQw6VeaNd7N8BowFGl9kQkEqpAtIrYQFF6IAqMyXI3B8X2tuCSlBsE9N9LhW_w7LL9om-Jq12e9tnoTNelXKw
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IIf1J8W6tRce7tlij96DdeMVx8bnnuJV9HJkZAfed1WaNk8BfdGyGhHE4QSctbdFc81e78MizMY%2FSJEX6voMaJIadqLAnsphCI5%2FL7ovzTfNpRsM9Dy4PYpcinVAlJcJ5c%2FYZaZHatZhDg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94f1bf09022-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 03AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

43 B
1 KB

29ms
29ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNXsb1BfdM7fw03RaW8K43dznMGNbggfHH9hbZnpznfBZ0IkuWWqV7Y6GosC-znvfniUlhLBV8P7k4ABVqMnpArpxRTIHCeQw6VeaNd7N8BowFGl9kQkEqpAtIrYQFF6IAqMyXI3B8X2tuCSlBsE9N9LhW_w7LL9om-Jq12e9tnoTNelXKw

Protocol

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
an-x-request-uuid: 9fbe9e3e-a0ad-4f51-9756-baaa0d72aa77
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 03AD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
an-x-request-uuid: 92fe4570-1d88-4952-9b91-4cc2039ab388
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 11FD 38 KB
13 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13571457216632613580/ Frame AE9F 29 KB
6 KB 7ms
7ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a45f2ec8bec6c801fbce6c76da9370e44914a051dd91fc40c9948d4239294caf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 81725
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5723
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 21:31:44 GMT
expires: Wed, 12 Feb 2025 21:31:44 GMT
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 75E4 0
0 75ms
49ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuI-Ao1CjapQ-Il2Vp69CIF4tWnH6TxYP9JZks3wAwprjWStSX2ptxkBT1KS2HqQZ9c2R_gJy_8ymc3ZFMYnlB3EOwh68PZtKwZ3ourxyNDsza71l7IZParmqZtpPJOGg1AsoUDC36m24iOGWU584AjkQmqi1VyHn4wMvitloA-lDyyCtDsjnFyqtOFwRKfyU74snD2_0rfxYqPPgj9LFnvBbmuo2IEUD19q9p0BE3lB4UFAr4yDYAXz3cwKAPdsGFAkC7Oqagqpel-V0jAA0quIeVeXyz5-o4k3nRBjW1g9Zwd27tOLFNzDkUI6f4ZQxgNCN3owsvNjXzaEvKbNYBZ7AYY1iV5NMD2en-2DeumjzHKPiMmyU5kxJcjxBRbDZStShJ6hhpJvAhZZSyJX9vVZtwcUL92Ufue2g2Ew0lA1zcGCGSgzF0k0t7Tcn3s2rrKEW90DIxQbxWJ3bvhgoNxZV8Sr1UIWBFc_14t4yz9IQqnsr7aR7HGid020IipXOHMJ2Ozjfb-jcug2DqPFS8nP-kSkxgdBlFWP0O3tKLH0CUgerDktU1BIdjsOGHinkVFUFQsiI_svxZdcGoKIohBpNZ_YNGtbDe0IEgBvuc5Nzh5T-ZSIFvN7wIgdf1KsuIpUxpfIWLvJMQDKkGWHu153_Vpxkhdgk8h5u3jicvcdD0KZMEMyLy8z6r6SzFl_mGpf3flCVhbUp-RGyd4gB0aDu-jWlGa7_JUj84wDQ47qcZDg9t7Zr29hVYEr9Tte1U2kudpHqZf8hXzpAotekC8dTY5sI-xOOC5yN464S3yZF0u5oQia_LJkhH4Ys3qS4PWr87w7ZPanG4LPfBVwrQsJ1s4ejJdXhViVmUagSalI40Du8u_WtNXVup7ftFB71jS0DWlOZymXoXFnrvTzLhuDfzpLxiBmOu0-IaSKKRaMAucoZ-nkpwolBUEpBFI2fnragaXIJ2-2T0jKckvSrIgRWjuTtUZyrBIzFR0fzrQPK6ro_UWha4-VXv2FZELZbOR7ATbU79L2YfndqnlgfJvE-FF873_RbSe6RQnFeZHELrxSfoaHImK0nQZ9rvfCmxRbLO1o6g1AEskZH__-Kyp4YWKR2Qlp_tXCAVmty_diu6qOWFbG2GWFzMCaxyPGWQc7vjGIX2YRqoxgZ6vWRw7yQz3xije1j6x6ViWQykpZX8tJ-ejDni9EhLBXN5l9_3smuUdgBnVkW938NW01kvtERZ_E78jmEhHNh-UvPl7NW59R04Tw0G7lPnutPcxPBfU1X2nxGRNLSuFHWdz-kzV1VDaNBFC4FbLQasA_cZz80xH0hs3X16DCxo_M2gYr_tR9AC-mpP_f3VofNrNqZkvHUUxwPa4MxzxkdxI3j4pza7AT99iKxqUTsfCDs01sBwB8qZX6Ne3aZNStq3mWtCq3s5a4lNXI0vme1wL&sai=AMfl-YRDt5cR3E0BxiGjhzourBKjg17NoMnVxrm2FM3Z4NzTIwGm5hGQGVsY5S69_z_RRO1RF0QUmtfEiCh5zTcfm7oAV6NG0Mmeb2CP4qfIrgUp2KKY0sJNYoplRBcwbHqMGIe_yuhcUUV_d39RHR19pyaqlXgS0YXLd_lA7AGMX7gkzBp06XOhoXo9zUKYSbm-jB-v2rdZwRUdCBVkQ-msHomtuR0vg5sKFPmNAZzDk1ONpP5tjabHgv6aHuUkQ_wJszBf7ZSoJH5KXo_XV53kv7KpV7-1l4zWwgKQgsc6QBPLcZX-ttZ4FQg6m1Kc4OiywuZDAPCR3LIMPldkiyxRtMHbbbZLNnEqlYQQY1JSXqmffR9jFniLdJU5auJn2qmKMZOaTB6-c8FTDJGMt2gaVTgHYOQle9-J_HpVxiD1Jvwm2iixuy-yKW7Ly4KMmkmnR0O-1THNnhrknpnTr2gZuRxPPqR5BQqQbPBftSK6vQE5ykEZTVxsUTRvRkq65ctcjI1Jmu_uZxI&sig=Cg0ArKJSzF-uNH67c-w5EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20saHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=62&cbvp=1&cstd=61&cisv=r20240212.77058&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4180 0
0 41ms
40ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstq1_ITF-qG6maoe6pSBM_AiZVdc3i1LyKI4p7IuIVRu46RR2axaQclMVwhpmIoJYnlXjDC8M2m72fMFiFknBRDTXRVTpLFiveVm8DNEawH_R53qGObLxTXNKwkz6rBr7I_vdnD8uZHa27FoNZRmgCnjYVZsB_hhMUKw_rs0fxx-HMRrP7IUQsyUfCsOxT963Pac7pmeWeWqr7QCe5rd2AmG5KWUwVDplUPPrtNItCj1giTgwXRgsACUhGCjnmLo-mKQxIvsQyYmSGJTCes0dnvG24Mq_10YpLAtTuQqsv09AoQ592E4uHGuasXoRGvPEuSX89IekjnWrh_WSy5eqQY36h8qSgwoaGpeQR0ExVrwLDnvBphtjB1i3ZqrAzQ0-vG_i-AX1dPEjCwziDmQ_aGr9S0KtpgGfr5mVKwrvbPvHjkyxBt5ysANBbbGFiK_RCcTRfmdtgzjdflezSZBDmngLporbGXnChUcjrjcMWM1o7dyzPwlpkVhMMubdohleVs8Um5D2UXIwyxG-5a7jRbnWd1J5R7oLaG1QkkuUJO5vVM_Ztyoo8YqsXX5qXoyTkV-am-0PjNPV_-Pt7DIZOQXplgKM5Lglu_0Em_-E_2ehvjRIMoUMQznaS5PJLqmPt4j-7wHzQu94ckFBTw3MEb2X9dOVSAy5HPh0Xte_gzdnZ-GdYa_2YaS5v1VtmxdXnmnQ90BWcHrVOZ6KCD7igPOsUsL2XisdQUpuaYAtfMDzAtk9AtnXZ9enWxED9uo4fk5bXyfiTwMkeiGkiq8q9w-MX4-X4dgj70Xc1VxGB1P50NomorHjezXT5LbLIveAFEzV9Ot0nWDaV_vzfUiWm9wmPRXMdjmK4W2xYHX8InD5ZPVmn8BgDhRbm0DM_UQKMirSLDTaZKnWb-F6OYqV4TxQnOSdpiQSItUK6fmyrCwtqp-0LEUWCC1LzQlYqcKJcAlQi-kgQhcNxVcgQlTmClxxplw8BC61DbArS3KBix0SrI_0DtaeQalbTMCvwIjglWE250fFdx08QqsuXekQZ2fFqJ_Ri-PUhTPhux7vLzoN-Adn-6ECdj5EBqFPpoLbFeP3X2195TrFwMmje9fCUPTOC9hTAak3O0nY0l8kvXRh4l_2Gp_ikUH5HNKCe-WOemDBsSODbn4J7YNOaOyGtrZujKdosiFsgJ3boKJw6s_WA3WWzMzglWQ5aeP0_RHi9pB6XkQZuxzvjJjcRklYlu2AgckhOQxqF8o15_DIuzCfwRnMBbIzNFLojsU4UU067C7i6v1Y4x9ky76j5sI5E53QHMqBFQSCP14LpykHtbDGnco22j8i4fx5yqdIiOIDC3JC6QyJmss610zEBldQhNbduDJyRw_mOMv9QK95laK9dapSGwmYfYcjfLKewJ6VrTPK1-4F8ihqHb_sTsnICzeyY&sai=AMfl-YSq7ePXxpJSCuBnDCwxcfNRA2XA1tKSPuDhcLKtLg3hwbDrU4YDLrEAtoN8ErtDj6h8xyjpkbGxbcn4ZX02AabAzXnKSvhEdtcploVHAi5N5q5iRLa_0PA4R5NmWq69stcNG35zNNtgsYZJnxAeKP3ZVCEHw39IU7wrz7jhtUJHsHwamXRdWnRFXMK2USWIigq9V3ChKdN5VJU2nyGOXvFnX-sIjN6CL_4bgUJPTjIm9wYi5GajGh61Jk-Z8-mSRyHfdlI_fe8oeX9vP5I9Vrjm94F4xII7ptAxkpj36w&sig=Cg0ArKJSzLaexlrjBR6VEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=224&vt=11&dtpt=181&dett=3&cstd=42&cisv=r20240213.91973&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE0A 0
0 41ms
41ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssz81pQUMFETB0mm5j7reFN3zNm6Rpo-XoN-tzI-hjAPOAQf79DKbdippToEvwT7y-N_7jnq7DqhwjSlYgmwcTKRSkC76M8w9R5na4fr4Go95PT5OzxbA6dkUUHWEWTBE8tcVAMEZDIBZ8Eg-D79udFMZ6DyvPl61L2W3TaiM3wjqF00AH5uqwMl83LPWD0jVIZ5RiG4fsCoxcIKDwJqo1k93Q5BNI1mxs-hbiqJZOuNikWwZTQZYg4strP90rwYrB2vMGXQUl3Vm_dJQHXVbCninbszeNpQkJReb7hEazg-vEg3UDYoMBlZ_pbNkvRE67nLDUodBCWzVJhUtVYFRjX1XaCq4LaHT3CcVbXsmxs0gJ8auhwU6Mo9OPdu09fv9v2nvbw7E9j4tPceaWrWtepo9Y2iaB7xztB8Hgo-MucLGiswABSJQJVqLhmoKw4Z7G_5RXpclKAvbRMEiMem3A4VMCqo8h915bzRQjLJvAURsM-swhavl9Z7xO-LFpV8J3Rd7FVh4Qz5j9P0UQGd1EkEDovtHQB2POzEoQj9K7sSsTttSczMTmf8zqO-SLWAD2jqQToc901v72z1XBZQvt-RlOO_sruZIVtoPS_mSXc5yJArQWlf7pc1fOztjVm3RgYq8hAL8Id4HffM0oXli-3QOGhoOvyoZv0--Z290DZiq2zQmapaIkiTvTKhI0oU0UW-kNc2jxmxnBsTGTtC68exllJGkFSTY8ZBZFXLMHMQYWlXZtUzWlX6Z1zRsCLZ3tEQlfrR7JDU0Sr0lRIK07e4g9WsJ4IOVY8OZvawt4q-dF9UBVWjMml0cW0nYiB9xE0mHg-uE4u4ZrBHWx0ntxiM9R4lnM0g-dPC-U_hoqF5S4QG7VE7tjfshK84bk5kzcJJDuhqyS6zP-mTW3P47qyD21H3639z3vi4Dfk8rVln21UDg3ZsXIsOMCj8apF2vJgS7ZkIZuXaEGVAux72LtCgnVc7OB_zH4MqwdcvwwMIEN5EOzA_OXiCVsr9FhnLWAKJVTE2IpStil0-rn537XpKky3G-_Tm46cwQUiBv8EjX1Blxs7F8ABZVoE8ULQzbm9gUnbK_eVng_JnXdNJSZbraoT4CDSYMe8UbyVN8L32g5C03zzRvqOyuDu1qHF-Glhg32j8cX-I0kvZLA4gYjsFm4mwhH1MO0RiFwWsYE3_kModojCUhJWJRwEPeU8i4RQFxZcAcGlGBELrEf-w5USmlUtbqcseiMeRagre6eFhnyV6u80JjgHql_SHJZOjtlDd7P2ARRBQ_3MTPPYw0QdpGcDSEmOc6SkaOg1pISWtinj3yNrJBPBnwPCp2Gc1InrYBXofg0HS353sfhf9IGGahN_CdnuA5SEXl34JtTnhu7FE8no8xRDJJ6AVXBjSkTDLMrX1PHGO2ZU&sai=AMfl-YTNu8IKmAVRHAzhHWyhzKVWAyImIVOR7sSwy_X5abXxPSU2ascF8wj2IDp5C4xwt2_5Bw0ix5lc1u5Ux0oPl-LUmYNEi-DorWJLHBuZ72DeivzDrdJrCHCtucEA_aCCiCbapfLY3xdtOafpRayYgZqx6IdtI_1UfRuPcq-4be5dMF8F7M9hef0xIGMJ_E93coESoGpU8rVgbM8UycQi3aMMSUV5E3QcLfHtBlghDlj3BqSF7eT2pI7mSU3w1PdgmyFQPv4ySWdSZZSr_43CZvMIgBmlyPhhr9apjw&sig=Cg0ArKJSzEh_Z7qzV94ZEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=274&vt=11&dtpt=197&dett=3&cstd=75&cisv=r20240213.94453&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AE3E 624 B
242 B 46ms
46ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNVF3JaWhRzDojbA_v2_wqwdiiN--gwGjbvYhtwT8gI8Qj5mcursJjYU2AhnFqUK39Bgk5i_eJ1dkZunF7ArJfaLdsTp3r686fOHg-4Inq94ZsW6DP7qx-_k4suQ8BZ1762576Oiet_fdz2czkwu7_s1hOo6ieGbTOEoKpyFj1kVchJxKEo

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame A478 111 KB
39 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/ Frame A478 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:34:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:34:59 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/ Frame A478 23 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 17:55:31 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A478 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126365
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame A478 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame A478 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A478 42 B
63 B 47ms
47ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BKxPbtS1puGnRsDE3DVg73v0L7qSEr9lOJWBeESqyoiTqTA_6gwNSTNO720fQsNva1O9gP3wnZGO3xLYpqxO66avZRf_9yWbsYepsoKPbAGBJ3EKA

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A478 204 KB
61 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1097
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
DATA 200
OK truncated
/ Frame 75E4 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a6274eed5bd4298d60c8506f3dbb0facd6a94963e1b025cbe7c6a02d54eda34

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 8f0cec8041c165cafb6d32d04ed8f04b.js Show response
s0.2mdn.net/sadbundle/13571457216632613580/ Frame AE9F 135 KB
39 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8eb600d1bfa136d87da7690cd2032c1906a76dcc1df0dc43fd0eb219d5356e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:57:09 GMT
date: Tue, 13 Feb 2024 08:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39491
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame AE3E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
730 B

24ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNVF3JaWhRzDojbA_v2_wqwdiiN--gwGjbvYhtwT8gI8Qj5mcursJjYU2AhnFqUK39Bgk5i_eJ1dkZunF7ArJfaLdsTp3r686fOHg-4Inq94ZsW6DP7qx-_k4suQ8BZ1762576Oiet_fdz2czkwu7_s1hOo6ieGbTOEoKpyFj1kVchJxKEo
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h15MFHvB3ibxWggILdpdSsMI8vAT88xtyUzdXqbvu150h4Jf1BSDreNt%2FH3oT1FYgbzdqTRGaViy%2FFN0XCvjCZkPw4WxM1Xrtsp6n5ubl7zCIfgdvB5153SzzQWI8Q4CCqA3TWxcsbYkRA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94f5c459022-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame AE3E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc0e-FVbLXkAAAi7AJvmjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1

43 B
735 B

35ms
34ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNVF3JaWhRzDojbA_v2_wqwdiiN--gwGjbvYhtwT8gI8Qj5mcursJjYU2AhnFqUK39Bgk5i_eJ1dkZunF7ArJfaLdsTp3r686fOHg-4Inq94ZsW6DP7qx-_k4suQ8BZ1762576Oiet_fdz2czkwu7_s1hOo6ieGbTOEoKpyFj1kVchJxKEo
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=48dvxDPM1L0MvQAjbU1jKoe0q5Cu%2FrSuQ8k9QP0QM143QRMdU%2BwyBu57wJGBDihHX2SfWmVnBq3CKyxs4kdIXzdjTVuLIeiuIvwue%2FDs7Zu7oCVUoHHTarVal%2Fj5g%2FOATL6y0u3aLFMFxA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8557f94f7c609022-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOY9Lumtu-kuRIt6KfSeNj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame AE3E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

43 B
1 KB

14ms
14ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwtPDmAEwAQ&v=APEucNVF3JaWhRzDojbA_v2_wqwdiiN--gwGjbvYhtwT8gI8Qj5mcursJjYU2AhnFqUK39Bgk5i_eJ1dkZunF7ArJfaLdsTp3r686fOHg-4Inq94ZsW6DP7qx-_k4suQ8BZ1762576Oiet_fdz2czkwu7_s1hOo6ieGbTOEoKpyFj1kVchJxKEo

Protocol

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
an-x-request-uuid: 95589fd6-51b0-4152-be3d-014d63397adc
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGRwvWcvaQnM77lII17hOBo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AE3E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
an-x-request-uuid: ae42fee9-eb42-4ea5-82f0-5aa1147f6848
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg4NTk0NzkyNTg2MTk4ODA1MQ%3D%3D
x-proxy-origin: 138.199.38.132; 138.199.38.132; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13571457216632613580/ Frame 8C33 29 KB
6 KB 7ms
6ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a45f2ec8bec6c801fbce6c76da9370e44914a051dd91fc40c9948d4239294caf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 81725
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5723
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 21:31:44 GMT
expires: Wed, 12 Feb 2025 21:31:44 GMT
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame A478 0
0 50ms
50ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvBlHZGUpqG54Ol8xYE1MpY45_soWmTyQPsqMkF8o0srxXTWWu1bLhRgzf6RePW4JFyh9pdlBZgbV0cs3PBSAix2hnQqf33B8TgStZfw6CDRBLHtgKUTXbgM9Ivxk7XKSttZBnVRC7kgwJdA_WnumbhaA7AxorFzRcxYI2p56kJ8GydI__4NA_bfFp27TB_tujACQ6Tpat4W5z2QwYHy2iBuNXgSgbo_jNe_M7BjIXPNtVsvoRHXoSz3Jkaj6tX8-zOvaayMkiCyORr-oX3bd8Z2Vn8Kg2YXVNnu2KuyTuyKQe8CaouFXceLTvMKHdqI8MjLi-x1QdzyDf7nZMJtP4Vk5oJ6-4UUPp1vmmPXRZCQ0dWOZjEsEFOXHZJluFNnzdtYIl97q51scF60uPkxPZ6S-dDtM6pjx3X3Q7RSUDztySy8PM14T7P0E9FNnqedctnPRtSc1Cbf7Gdjq7_J5aZpuEZB7sVpue6cH0J8K061wu7B6gJGlo6VBM6Nc-kvy_RwpUoG3geA0PbNgSKQBJpn1xTHv5UQ8BaYWQe_xj2pgEIMFEcriT3EnNVjzhQJK0VJRB_H6dXesUL68Z6eGLIbGWeXMFJx9x4AKIoJmyQNdW0KRmcQ6_YPR1RRIPuoaOlfYbNbghvTYLOjvzTIqN6t4NIm0-ciZ-QVQoTNviIKgQlbay2mvAZsi3MctT5XDrrgrcd44s7d1VplNcJWwNDkgAjkzGvF3twROiFiQH-4S2KxcPClqnvkiwjtOUqPk5tNwMUCAS38FONA_7ja99E38v2tkb1OCqXdtIzPdvR6992gfStj0y0gfnCo5MlA28xdx3lyXsYaRaA-SCpY8-__rqhjiEmZJOLP8twMlt1Pj3GFaD0Jgvpr48I6GgKm1J--uUrAhBl6mt4cbCqI6GcTMxrDBXjiTTNYbKJ33i5BzF_b91EsAXxwLfECGWXIixFqf_qOCnP75Odc2_Nj0Xdv4TACBoVF0044Pf88J3ufkttP3KC0aUAFWfi-7acRtKFoK7c_e6o5GdLtNfxfVH5xY9pmFL2SEkl_zfLuAxgxCdSDCSDYbhIVoVO9bgt4RDisynfJuf9ZO18bHF02dqSIXK9SUmMPXYcv8wST4k_fRpVPaiFgqowfBzFGdjfvOfmp0wHLdFwsssD984-VWy_qkPasmnE3_wuqdn-NdmdHEiRGh1J0hlyoo-rnUYgnJOjBeYHFjSYH6sc1vPfuNcbK1faJ1NshT4_YVsQhLr9zKVvmfZHEfs3yBK2icUphwl8mqNm8dR369BXJLYQ4Erf6FSBuMyv3gk6RNNKRpRD3GCMBh2kKGob4VxSJRz0nuUElMI77tn3n_GIc6lCidkdlCJ3uUdlti9j9vgF46sU0K8qiFGU7gKxAr7FEevzZOHHPLHwf8A2608Rwc1i8iyeqL74naRQ7xvv2XL5&sai=AMfl-YSybZxRTKC91mTeE5i7xagIvtmAH7tYXaB7iC2mcXnbe6NIfNCUgkkGWew4F0ir4HInN3gxy1TCgDu4exGpomvAcOZiU481_MwbvRrcLp0kbsKO0a6rQ_nBxJF9krg6V9aob1yfmlCWLzMfkogY8F3A2oF6HJA_n9rRtIXW0Wo1zicYCUcHk2JQvSpbEmC44Gm7uXTpKeES_4--ydJ3xrwqZyfunL7xOVRZLfoEc0rTUqjkkBXyuRD5Xt_u7OssU3ongXauBw89rEXohDM1rHJySwOt_gqVQgmFPnmLeGmcJCErhGdNIm9_ufJ3y_JZM16Fq7JLNUWK5Yg08d_Bt6kBUIi41ebamxt_qbLlwCy7mjMk487cYjmUhOLFDyDAX9RVXySvqQBLS0m_8_if62TaSKqEFTHtcNKNtBn3s5JU6ytsa2KlVK7FoeHo7ZzVB3ELeX4KbtnBcMuGAw6BI-WvzvepPrprfCaNTn4A8mFntPN0CNXSSUn0su3S_2vQbjgpXw3TuRk&sig=Cg0ArKJSzEVrEEwusrUiEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20saHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=54&cbvp=1&cstd=53&cisv=r20240212.17526&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 11FD 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
DATA 200
OK truncated
/ Frame A478 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b578491e57cee47fadbb1de23568e280cc5ca9b803c5eff0ee3b9d10360f7e8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E8D5 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE93 0
20 B 40ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BDLB0_B7NZfXLO9b01PIPsL62aAAAAAA4AeAEAg&bg=!lJell9jNAAaxkZ3akZE7ADQBe5WfOKuEZAP2sbpe47zf5pl1bV9ypCXw28Pib4G2Ig0IfNZRuz9yHC8B-WU57MefPYfcAgAAAJJSAAAAAWgBB5kDDIZPcEEx0bpHuaGXPdFal_yQBCb3iEJPkQwFuqeMRBKtxpNDalSWNjJfI8S4lQkMiqwSnQ9DqCd_cwG9brTJ6U1K7ygJmusfs5KSNOCDzNcrrm-6IcLLEonc1Fnwy4InpLBtAeuma95lpT7dqHHYv-oYuUh3PKIDiv1H33GC-sVeTNPpAVeSQqPflESvz6UUJvY_wfdSHcmhawHvdQNXE-ZsdVxbmy59Yg6vbTVxHWslcpiOYfKzG45432ryd8IDD5CJlBP8oP_-wRHnBLP8jvTIYiqOKF_5ybG5MlPOGmsTuf9Tjdh-szg-DYej37hFEj86W3V2QKUsAt1QShdcHs52koQK0s3O2CCuY33jfoan7djiY5OwJuORL8MV5vWbbZRsNZEhWKDjB3-tdl7eg6Utv_BKCw82sxddzHW-jpu23ycqqofU2lucTHiGBSvbxZZR6XxITH4vd2sXockM9NImdtsxDd6a8idsn9gxZZ-LNLEMUMrGyA7RLZfXA6ZiCD-Bz1S5reVQVKIQnU9qIsrrXfEc-G89-ea0FQEp6jse9lIUnC0kBOoaStKsDldwj8Oad--gKxLcCzREeJ-50MMRmC9-ki3nRacnvPnuf7CjxZ1DoGdGnS3aczX6nDcM0erk1WZL5k8lBbkwBlOUIaiCKYtQ3vE_iss_GtM09JpB6mMwiDD2d_HYgUIlRdWCxpwsPgl8YO6qyJWCZXgA8zjKro54R7jVAP0nkHrdC-p_cGbrtSgsAIq4WSyFu2jJM-afivotfYEPz4Ot2AYgMMr4Z4Z3ddPXt4oRAYMLdSmneQQB2ywh9_TMWHF-cU1VSVx7hhv1U1UoxM5SJW-unE299Nb7asfCwFGFtxWiMwRct6IKKfy4KZjvGqL1X03d0KAQHA2umYiMG5Otyo9_F2oDBf5reYfXKEpb3HxFeoidkNELREPl6SuZIz-8f42jm3Z8Gvv_z3mOpkZleePA9ZbdUh6AyYozMsW6PMyv6ubkeZ1Fb2Nc41N--duyf1kFNSghvsKQRaGAR-m5vw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 8f0cec8041c165cafb6d32d04ed8f04b.js Show response
s0.2mdn.net/sadbundle/13571457216632613580/ Frame 8C33 135 KB
39 KB 6ms
6ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8eb600d1bfa136d87da7690cd2032c1906a76dcc1df0dc43fd0eb219d5356e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:57:09 GMT
date: Tue, 13 Feb 2024 08:57:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39491
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 1 KB
643 B 8ms
8ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:47 GMT
date: Tue, 13 Feb 2024 09:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 540f418f1b60c9ea99e68eb3170f0f70.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 17 KB
17 KB 10ms
10ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/540f418f1b60c9ea99e68eb3170f0f70.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2275f4fd4e1567fa43a5716514b1cfe996bdfd17ecc2fdf19ef7fc804e28d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:37:56 GMT
date: Wed, 14 Feb 2024 02:37:56 GMT
x-content-type-options: nosniff
age: 63353
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17513
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 f557f36e85ef403c7fba15e973896f31.jpg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 10 KB
10 KB 20ms
20ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/f557f36e85ef403c7fba15e973896f31.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ead09f48ac08e2d625705224ad109afce0ffa3d195fa88dcb3150feee30f86f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:08:58 GMT
date: Tue, 13 Feb 2024 09:08:58 GMT
x-content-type-options: nosniff
age: 126291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9783
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 5 KB
3 KB 9ms
9ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:15:15 GMT
date: Tue, 13 Feb 2024 09:15:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ibm_plex_sans_700_normal.ttf
s0.2mdn.net/sadbundle/13571457216632613580/fonts/ Frame AE9F 172 KB
75 KB 8ms
8ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/fonts/ibm_plex_sans_700_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

856c41d7d47bba74b107e526ef8f49968fb2a3a129cdc3c5ef5899ba3c2dc181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 13:14:13 GMT
date: Wed, 14 Feb 2024 13:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25176
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76650
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ibm_plex_sans_500_normal.ttf
s0.2mdn.net/sadbundle/13571457216632613580/fonts/ Frame AE9F 173 KB
80 KB 9ms
9ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/fonts/ibm_plex_sans_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11ddde88c29ef7e51f5c03da7fde285085469879139d006f631a62dba9bbd069

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 23:15:38 GMT
date: Tue, 13 Feb 2024 23:15:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75491
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81411
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 40ms
40ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402080201&jk=2161306539781575&bg=!HB-lH1DNAAaxkZ3akZE7ADQBe5WfOCTBowTBtgxqSc6kGKgQNf_GR2_WG2dQkbn8BrWZf2Gz-eW3AzYl8U_4JgZ69NJDAgAAACxSAAAAAmgBBwoArY7EqmjEUTY90ybfIu4oL4TNPhuFibOeD-r0zLv6eYHLelW_dxKXBYB4a6Dr8WGF5tMvKOsVW6e9nthpn13hfyrwtTPd0jzwel9P9oagVNhsyAuvXqLqNwpPzOVAhfgELlVV77L6k1wfBYwavaZLPfPfWm4qV6HNV-bv85b0Wyck7rw0mRHvY2xXySpetjETU26Fk2PqjMHnibfYgPQYBc3qViyetPNM5uUwjO4JmQLUK0iceGuKPhXHOSmZmsikQiWVUkSJM1T0DwzDpJTF0Aun9gjkmMu34ThFC7x5QjBsyBX51stjSwDLZCsNxMWjGKKAy0jZCBeCis-C4FfHvKBi1oEqA5T63k2qfH4wqkQ3ougMdDqU_0P14ISWBk98-5a3wk8lGQ39k4SO80AbnR9rGmSa_NDZC3ty3z_8Yi1tkUKCFxls_0KLLz6sq0TPUnIDc0L6tUcSWR6sizQ7C2hVXxFPaoUPIqwGJ_vY3UkJ65FtN3GdX4Q4wLCSSrvilhcG3WuATkCHiN4066zGG_88m1hf1q5hq5BKX2T0quL9iSrTO0cPMLBeQbedNycBAhprw1_cYxO5pJUOBVA6aobMiGOxeYhJ8v-OSZRtJVov25vcrlqOwi5JF95dRvGmiMVqd1tjwkEA-CZnpmbvgxWesPp87CEdilW-n72Hp5XOW8I_cN8cRytg2GZ-cIhDYVqzC6srCue-PQHUUDfEf0kIQPuy-lzJIFLfPyCuxjEf81VF0xfELQOxXLuvJ863FC7tJdqCz9WlbKpE3FhXRFK4EM7ELatENc3tX-W5NKL8b4TzvvUH3-YI96ndSyg03EasIir3Ygza9D5acItlDTCjDh_sAbG-vAm4ZxrLqa0VAtENiG-AXZB_Wlf-M04ugQI6vdgPBrkTZSKq15HSz5F5qk_YR6Vil65h_At43R-cJUuRRDcePurY9cONPTjGqTgsh8oAhm5rGDE-gpIDODrrGx3ni3sAQ-KUTQ6VeYv0vvMb5k7abdTr61AE77vKSZy0sVPrHP4szDgfTVGhcgh-ODJc7y6WM-bSOLLDryyqiW83L88uj_fG1VMTVSbhLOwSvC-ADUpBkwZkATM7cQ9yE-2Sbbm8UmKj6FBbggMvbJWEbJgbTgZZx5OSFYLInxpi0ofkpYljYzGPHb6Wh_5KIrg7U8t5I80D2_EJsUrr9QUrHw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 75E4 0
0 41ms
41ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuI-Ao1CjapQ-Il2Vp69CIF4tWnH6TxYP9JZks3wAwprjWStSX2ptxkBT1KS2HqQZ9c2R_gJy_8ymc3ZFMYnlB3EOwh68PZtKwZ3ourxyNDsza71l7IZParmqZtpPJOGg1AsoUDC36m24iOGWU584AjkQmqi1VyHn4wMvitloA-lDyyCtDsjnFyqtOFwRKfyU74snD2_0rfxYqPPgj9LFnvBbmuo2IEUD19q9p0BE3lB4UFAr4yDYAXz3cwKAPdsGFAkC7Oqagqpel-V0jAA0quIeVeXyz5-o4k3nRBjW1g9Zwd27tOLFNzDkUI6f4ZQxgNCN3owsvNjXzaEvKbNYBZ7AYY1iV5NMD2en-2DeumjzHKPiMmyU5kxJcjxBRbDZStShJ6hhpJvAhZZSyJX9vVZtwcUL92Ufue2g2Ew0lA1zcGCGSgzF0k0t7Tcn3s2rrKEW90DIxQbxWJ3bvhgoNxZV8Sr1UIWBFc_14t4yz9IQqnsr7aR7HGid020IipXOHMJ2Ozjfb-jcug2DqPFS8nP-kSkxgdBlFWP0O3tKLH0CUgerDktU1BIdjsOGHinkVFUFQsiI_svxZdcGoKIohBpNZ_YNGtbDe0IEgBvuc5Nzh5T-ZSIFvN7wIgdf1KsuIpUxpfIWLvJMQDKkGWHu153_Vpxkhdgk8h5u3jicvcdD0KZMEMyLy8z6r6SzFl_mGpf3flCVhbUp-RGyd4gB0aDu-jWlGa7_JUj84wDQ47qcZDg9t7Zr29hVYEr9Tte1U2kudpHqZf8hXzpAotekC8dTY5sI-xOOC5yN464S3yZF0u5oQia_LJkhH4Ys3qS4PWr87w7ZPanG4LPfBVwrQsJ1s4ejJdXhViVmUagSalI40Du8u_WtNXVup7ftFB71jS0DWlOZymXoXFnrvTzLhuDfzpLxiBmOu0-IaSKKRaMAucoZ-nkpwolBUEpBFI2fnragaXIJ2-2T0jKckvSrIgRWjuTtUZyrBIzFR0fzrQPK6ro_UWha4-VXv2FZELZbOR7ATbU79L2YfndqnlgfJvE-FF873_RbSe6RQnFeZHELrxSfoaHImK0nQZ9rvfCmxRbLO1o6g1AEskZH__-Kyp4YWKR2Qlp_tXCAVmty_diu6qOWFbG2GWFzMCaxyPGWQc7vjGIX2YRqoxgZ6vWRw7yQz3xije1j6x6ViWQykpZX8tJ-ejDni9EhLBXN5l9_3smuUdgBnVkW938NW01kvtERZ_E78jmEhHNh-UvPl7NW59R04Tw0G7lPnutPcxPBfU1X2nxGRNLSuFHWdz-kzV1VDaNBFC4FbLQasA_cZz80xH0hs3X16DCxo_M2gYr_tR9AC-mpP_f3VofNrNqZkvHUUxwPa4MxzxkdxI3j4pza7AT99iKxqUTsfCDs01sBwB8qZX6Ne3aZNStq3mWtCq3s5a4lNXI0vme1wL&sai=AMfl-YRDt5cR3E0BxiGjhzourBKjg17NoMnVxrm2FM3Z4NzTIwGm5hGQGVsY5S69_z_RRO1RF0QUmtfEiCh5zTcfm7oAV6NG0Mmeb2CP4qfIrgUp2KKY0sJNYoplRBcwbHqMGIe_yuhcUUV_d39RHR19pyaqlXgS0YXLd_lA7AGMX7gkzBp06XOhoXo9zUKYSbm-jB-v2rdZwRUdCBVkQ-msHomtuR0vg5sKFPmNAZzDk1ONpP5tjabHgv6aHuUkQ_wJszBf7ZSoJH5KXo_XV53kv7KpV7-1l4zWwgKQgsc6QBPLcZX-ttZ4FQg6m1Kc4OiywuZDAPCR3LIMPldkiyxRtMHbbbZLNnEqlYQQY1JSXqmffR9jFniLdJU5auJn2qmKMZOaTB6-c8FTDJGMt2gaVTgHYOQle9-J_HpVxiD1Jvwm2iixuy-yKW7Ly4KMmkmnR0O-1THNnhrknpnTr2gZuRxPPqR5BQqQbPBftSK6vQE5ykEZTVxsUTRvRkq65ctcjI1Jmu_uZxI&sig=Cg0ArKJSzF-uNH67c-w5EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20saHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=206&vt=11&dtpt=144&dett=3&cstd=61&cisv=r20240212.77058&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame E8D5 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 1 KB
643 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:47 GMT
date: Tue, 13 Feb 2024 09:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 5 KB
3 KB 8ms
8ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:15:15 GMT
date: Tue, 13 Feb 2024 09:15:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 455bb1663a54e4b87edb5835b561c90b.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 7 KB
7 KB 8ms
8ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/455bb1663a54e4b87edb5835b561c90b.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6528221c96dda1dfc6d39b83b757bcccb0c692e9e1a472d67faaa16037c3891

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 06:03:52 GMT
date: Wed, 14 Feb 2024 06:03:52 GMT
x-content-type-options: nosniff
age: 50997
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6745
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 1 KB
643 B 8ms
8ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:47 GMT
date: Tue, 13 Feb 2024 09:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 540f418f1b60c9ea99e68eb3170f0f70.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 17 KB
17 KB 10ms
9ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/540f418f1b60c9ea99e68eb3170f0f70.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2275f4fd4e1567fa43a5716514b1cfe996bdfd17ecc2fdf19ef7fc804e28d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:37:56 GMT
date: Wed, 14 Feb 2024 02:37:56 GMT
x-content-type-options: nosniff
age: 63353
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17513
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 f557f36e85ef403c7fba15e973896f31.jpg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 10 KB
10 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/f557f36e85ef403c7fba15e973896f31.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ead09f48ac08e2d625705224ad109afce0ffa3d195fa88dcb3150feee30f86f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:08:58 GMT
date: Tue, 13 Feb 2024 09:08:58 GMT
x-content-type-options: nosniff
age: 126291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9783
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 5 KB
3 KB 11ms
11ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:15:15 GMT
date: Tue, 13 Feb 2024 09:15:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 540f418f1b60c9ea99e68eb3170f0f70.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 17 KB
17 KB 11ms
10ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/540f418f1b60c9ea99e68eb3170f0f70.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2275f4fd4e1567fa43a5716514b1cfe996bdfd17ecc2fdf19ef7fc804e28d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:37:56 GMT
date: Wed, 14 Feb 2024 02:37:56 GMT
x-content-type-options: nosniff
age: 63353
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17513
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 f557f36e85ef403c7fba15e973896f31.jpg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame AE9F 10 KB
10 KB 16ms
16ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/f557f36e85ef403c7fba15e973896f31.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ead09f48ac08e2d625705224ad109afce0ffa3d195fa88dcb3150feee30f86f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:08:58 GMT
date: Tue, 13 Feb 2024 09:08:58 GMT
x-content-type-options: nosniff
age: 126291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9783
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ibm_plex_sans_700_normal.ttf
s0.2mdn.net/sadbundle/13571457216632613580/fonts/ Frame 8C33 172 KB
75 KB 10ms
9ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/fonts/ibm_plex_sans_700_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

856c41d7d47bba74b107e526ef8f49968fb2a3a129cdc3c5ef5899ba3c2dc181

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 13:14:13 GMT
date: Wed, 14 Feb 2024 13:14:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25176
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76650
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ibm_plex_sans_500_normal.ttf
s0.2mdn.net/sadbundle/13571457216632613580/fonts/ Frame 8C33 173 KB
80 KB 10ms
10ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/fonts/ibm_plex_sans_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11ddde88c29ef7e51f5c03da7fde285085469879139d006f631a62dba9bbd069

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 23:15:38 GMT
date: Tue, 13 Feb 2024 23:15:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75491
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81411
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame A478 0
0 42ms
42ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvBlHZGUpqG54Ol8xYE1MpY45_soWmTyQPsqMkF8o0srxXTWWu1bLhRgzf6RePW4JFyh9pdlBZgbV0cs3PBSAix2hnQqf33B8TgStZfw6CDRBLHtgKUTXbgM9Ivxk7XKSttZBnVRC7kgwJdA_WnumbhaA7AxorFzRcxYI2p56kJ8GydI__4NA_bfFp27TB_tujACQ6Tpat4W5z2QwYHy2iBuNXgSgbo_jNe_M7BjIXPNtVsvoRHXoSz3Jkaj6tX8-zOvaayMkiCyORr-oX3bd8Z2Vn8Kg2YXVNnu2KuyTuyKQe8CaouFXceLTvMKHdqI8MjLi-x1QdzyDf7nZMJtP4Vk5oJ6-4UUPp1vmmPXRZCQ0dWOZjEsEFOXHZJluFNnzdtYIl97q51scF60uPkxPZ6S-dDtM6pjx3X3Q7RSUDztySy8PM14T7P0E9FNnqedctnPRtSc1Cbf7Gdjq7_J5aZpuEZB7sVpue6cH0J8K061wu7B6gJGlo6VBM6Nc-kvy_RwpUoG3geA0PbNgSKQBJpn1xTHv5UQ8BaYWQe_xj2pgEIMFEcriT3EnNVjzhQJK0VJRB_H6dXesUL68Z6eGLIbGWeXMFJx9x4AKIoJmyQNdW0KRmcQ6_YPR1RRIPuoaOlfYbNbghvTYLOjvzTIqN6t4NIm0-ciZ-QVQoTNviIKgQlbay2mvAZsi3MctT5XDrrgrcd44s7d1VplNcJWwNDkgAjkzGvF3twROiFiQH-4S2KxcPClqnvkiwjtOUqPk5tNwMUCAS38FONA_7ja99E38v2tkb1OCqXdtIzPdvR6992gfStj0y0gfnCo5MlA28xdx3lyXsYaRaA-SCpY8-__rqhjiEmZJOLP8twMlt1Pj3GFaD0Jgvpr48I6GgKm1J--uUrAhBl6mt4cbCqI6GcTMxrDBXjiTTNYbKJ33i5BzF_b91EsAXxwLfECGWXIixFqf_qOCnP75Odc2_Nj0Xdv4TACBoVF0044Pf88J3ufkttP3KC0aUAFWfi-7acRtKFoK7c_e6o5GdLtNfxfVH5xY9pmFL2SEkl_zfLuAxgxCdSDCSDYbhIVoVO9bgt4RDisynfJuf9ZO18bHF02dqSIXK9SUmMPXYcv8wST4k_fRpVPaiFgqowfBzFGdjfvOfmp0wHLdFwsssD984-VWy_qkPasmnE3_wuqdn-NdmdHEiRGh1J0hlyoo-rnUYgnJOjBeYHFjSYH6sc1vPfuNcbK1faJ1NshT4_YVsQhLr9zKVvmfZHEfs3yBK2icUphwl8mqNm8dR369BXJLYQ4Erf6FSBuMyv3gk6RNNKRpRD3GCMBh2kKGob4VxSJRz0nuUElMI77tn3n_GIc6lCidkdlCJ3uUdlti9j9vgF46sU0K8qiFGU7gKxAr7FEevzZOHHPLHwf8A2608Rwc1i8iyeqL74naRQ7xvv2XL5&sai=AMfl-YSybZxRTKC91mTeE5i7xagIvtmAH7tYXaB7iC2mcXnbe6NIfNCUgkkGWew4F0ir4HInN3gxy1TCgDu4exGpomvAcOZiU481_MwbvRrcLp0kbsKO0a6rQ_nBxJF9krg6V9aob1yfmlCWLzMfkogY8F3A2oF6HJA_n9rRtIXW0Wo1zicYCUcHk2JQvSpbEmC44Gm7uXTpKeES_4--ydJ3xrwqZyfunL7xOVRZLfoEc0rTUqjkkBXyuRD5Xt_u7OssU3ongXauBw89rEXohDM1rHJySwOt_gqVQgmFPnmLeGmcJCErhGdNIm9_ufJ3y_JZM16Fq7JLNUWK5Yg08d_Bt6kBUIi41ebamxt_qbLlwCy7mjMk487cYjmUhOLFDyDAX9RVXySvqQBLS0m_8_if62TaSKqEFTHtcNKNtBn3s5JU6ytsa2KlVK7FoeHo7ZzVB3ELeX4KbtnBcMuGAw6BI-WvzvepPrprfCaNTn4A8mFntPN0CNXSSUn0su3S_2vQbjgpXw3TuRk&sig=Cg0ArKJSzEVrEEwusrUiEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5jb20saHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=169&vt=11&dtpt=115&dett=3&cstd=53&cisv=r20240212.17526&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 1 KB
643 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:03:47 GMT
date: Tue, 13 Feb 2024 09:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 455bb1663a54e4b87edb5835b561c90b.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 7 KB
7 KB 8ms
7ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/455bb1663a54e4b87edb5835b561c90b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6528221c96dda1dfc6d39b83b757bcccb0c692e9e1a472d67faaa16037c3891

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 06:03:52 GMT
date: Wed, 14 Feb 2024 06:03:52 GMT
x-content-type-options: nosniff
age: 50997
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6745
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 5 KB
3 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13571457216632613580/8f0cec8041c165cafb6d32d04ed8f04b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:15:15 GMT
date: Tue, 13 Feb 2024 09:15:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D20D 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 540f418f1b60c9ea99e68eb3170f0f70.png
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 17 KB
17 KB 7ms
6ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/540f418f1b60c9ea99e68eb3170f0f70.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2275f4fd4e1567fa43a5716514b1cfe996bdfd17ecc2fdf19ef7fc804e28d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:37:56 GMT
date: Wed, 14 Feb 2024 02:37:56 GMT
x-content-type-options: nosniff
age: 63353
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17513
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 f557f36e85ef403c7fba15e973896f31.jpg
s0.2mdn.net/sadbundle/13571457216632613580/media/ Frame 8C33 10 KB
10 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13571457216632613580/media/f557f36e85ef403c7fba15e973896f31.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ead09f48ac08e2d625705224ad109afce0ffa3d195fa88dcb3150feee30f86f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13571457216632613580/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:08:58 GMT
date: Tue, 13 Feb 2024 09:08:58 GMT
x-content-type-options: nosniff
age: 126291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9783
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 11:10:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 5d115d22c534f80a76417856e32eef9c.js Show response
www.gstatic.com/mysidia/ Frame D20D 8 KB
4 KB 32ms
11ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5d115d22c534f80a76417856e32eef9c.js?tag=client_fast_engine_2019

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04fa628bda6f9b1ab5f71827ce6c71e8c6ad495a3a5a0ed8858c6f5b2f0513ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 05:29:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53045
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3749
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 01:25:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 05:29:44 GMT

GET
H2 200 c3f387cb159af31b8eebdade486bc9f5.js Show response
www.gstatic.com/mysidia/ Frame D20D 41 KB
16 KB 30ms
9ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c3f387cb159af31b8eebdade486bc9f5.js?tag=html5_display_upload/html5_exit_api

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

debb082a27a8f82a26f5bed523ccea13e900f5a6b0c8bbb5932ecdfa6faafecd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 06:39:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16369
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 05:57:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 06:39:58 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame D20D 2 KB
822 B 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H2 200 c558ca21a4741214d4f6a1021ba2ced6.js Show response
www.gstatic.com/mysidia/ Frame D20D 22 KB
9 KB 32ms
12ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c558ca21a4741214d4f6a1021ba2ced6.js?tag=exit_2019

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a637295cbf7a378f5b940da61df91245d2834622dd2bdfd6f93352a35d87089

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:58:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126894
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9431
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 05:57:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 13 May 2024 08:58:55 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame D20D 23 KB
9 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame D20D 3 KB
1 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame D20D 20 KB
8 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:45:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30501
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:45:28 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D20D 204 KB
61 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1097
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame D20D 36 KB
15 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 01:25:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 00:44:05 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 11FD 0
20 B 41ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B8LhI_B7NZYyyMviv9u8P5aavoAgAAAAAOAHgBAI&bg=!RkWlRQrNAAaxkZ3akZE7ADQBe5WfOMA85oZ5TAJggGsy-kBOkoadWgxaGEvtNB46mrHv6s_1vlTExvcr4QbfizoZd9aGAgAAAG9SAAAAAWgBB5kDCqwUFU1uYSEkumY17FzPg-t131NuHherYksprbUVsLuHMHQu_Ffry0-5EjF4vJjmgVXvUlHWvavWxQutJZtP-T_GEO_TLTh--SS53gyKWvxq8TlaELdKSCiO1eP960AJAwQhlijX37aTeQo54JmVvpx5zs2RV4YyYAFsyZ4ozcNTG2NwYtDFotARL9nV8gfxX7TJYzrd3-5NEFOXVZAZFC5H4V3uOdm7cTSTVv8j9iy66mDNjTnkzG053UCUJuERTxahjtGPtM8-LHAZJRcUVMppmH4yZHjF7jZXB7giuFGiQWfbOSBaByGxY8bMdYL2_i4Mbl9jGerpM_tQ3bz2ji2h8Ed-_5L4k4243PKM8-Om2WYS2No_bKboG2Kuu5AuFruATmxAVA7Gw6SbnlaTFTuDRoA7GjCbVPQz2F8ixD1cVDCPt4-TAKczw5E4jFpYytQJ9Xhq64qlDJyg1ruDv6J6vPKOn9PstU99CKVIZQN_SGphQj0bueVBujA7Ftbjaceddr43WVYw1lU6Tk4oTuzv6KsL3gvpZwvSUJDpgYtJKqFS0bLq0LajQ3AmlYZnnIz76CZ28HNGMCmABSU-4wFOfGjWuj2q2aCnAm3lOQReQsWZcjJSTK5eO2WiZdDsuZzsebhF6YVC9sv3zmHzlrATBQHC54qm_GgsGOO-DYGJm1EamnnvUEudJff1aIznh2Sl3TrvK5gTAfF4LC5HonEc48HEteDB5f_M8pIn_DQjtwNo0J2IjUjNRg2ahBf1JC2ypFdAZr0-BTYPE4tlOkB1yX-8MIvmeYjacLMCQoY1DadA7DCLi9RzJLEZPh7gS8oaamV5Zaacm3qLZFtBo1xfPsVTSFa_WSN23fLtjI3XW0fElFsHvjEFPo6cIZSxssONdbLM93GpyKGeojFd1aakpH0ZDMOfwv3U1EtJ0PYxrr7KPOIm3FbCheFwm7eyMtNJ3OFRP1t_5XBlx6g-MnNKdFyxf6owxivWSwO_QPrRq8kigR2Z5_KfxLenPl1ZmUSwKywmpDJ2Pzo

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/ Frame B120 106 KB
19 KB 9ms
8ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/c3f387cb159af31b8eebdade486bc9f5.js?tag=html5_display_upload/html5_exit_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13e945cbe50e01da11e516e213503d265eb0675745c6ffcfd11803e2cefc9454

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 128359
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 19805
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 08:34:30 GMT
expires: Wed, 12 Feb 2025 08:34:30 GMT
last-modified: Wed, 27 Sep 2023 14:02:41 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D20D 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1329bbf5ae9ceb32782f750f40acf65ddf4d09114fb9780bde80e4332c5b02b5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B5D7 6 KB
3 KB 10ms
10ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame B120 4 KB
796 B 35ms
34ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=IBM+Plex+Sans:regular|IBM+Plex+Serif:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7f0b2c03d7e7f928c516c6d263984c9cc58e83b69efa4bb8c85e50cbb3723aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 20:02:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B120 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 16:47:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 15 Feb 2024 16:47:22 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B120 34 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9394271014907902222/de-resonio-300x-250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 16:47:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 15 Feb 2024 16:47:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E8D5 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B2th8_B7NZbCMNJe07_UP57OV0AQAAAAAOAHgBAI&bg=!SkmlSQbNAAaxkZ3akZE7ADQBe5WfOKTeIv0XQ1iGiobz83NPCINsbLgfzDKCoukwoTWjxbordq3hj-uLNJhPQhNasHSLAgAAAGVSAAAAAWgBB5kDEW4CFx5IEuw21e1B2LI5KrGFkkv2y7ZBb8vHdDeyWsc8xgDIZWLiWVs8VM1Ul12FEqEft5N_lZ8EBZmGUPLoEBEejUMpvt1cB4wnYzuB-IiOWf_4iBIHo9i5HTAvvhBUqOUHZbLZTzQSQA4kILysBu13lPFgEIPh9crL3ftrXibi_snD8r19B6JLpocvV0wvP9aZrdtTGbJuSFtAXEp0dbdb6l43l44AnBq96fuhXT4bYKJTwVXyBJ-QUoK4kjWQimdScSV224QOO7srNe-O1u8XN5Xh7K7VefyPBSMyiGvXRc0Cta84CET3tbk1DtJlFDqAZ7VTyTBzyTh28LipCzq9SmkkzgILcFUqz1ortXA0y7LMwZ3KaJp72RCeSTOdLqgr9xBRAnUbQK6xdRn_26QGacQTBqz-UbaI-LzJqVyh0tTixkuZzOul355kzklfJ9LGr2lQ6M47C0fAn4dgSES8fdj4GoGrXJ0xa5Gc8P6bTRGE74u7UE2c35gVOifYSbHOCcEE78UEId-M6DEND3V-yNRy0e4Eo8rHwFeF9GyMIfO8sLU6fKyh552SsIGrZC_lPBf2s7UzaGzOB9iJzWzy2mdXsFyBeLV_ZWMSlUpe29GxcrShWpFasfkgVn5-bVhGBIDtEU0WTdN6hzkH6lFFRRFB6k0cmkIk0w6E0qFj_R6aV-D9vvnQBKqbmNjEzsgEEYzuGuvwTd0t_LhSDB0T-ZOBLhPhkjqVCporIRzSbK6BaEChvVJ29p5AsEWLTUIcdzHQQlI7MQC7-QnFYeDcWzMD8FZVd-s6qsHncX6DVgq_-jFEri8_EHXmixVnEeIQSDARWxb7B7DnkyJ1hFxXEe1r8I4r_lxMpHZ9mW0MMeyx0nTdgYpRFSF_5MqHFshkW4ezoCM7pdpwbGPpB3aLpwEkYJAqAnXz2rWCvo5_EdxVF4AIkJxZ8F_qwyvjvYtbIwb8_tQKMKWKrSg9Xl1m2_1LKV36e8in-WFFM_SDoERn4Z7zGYB-2TBEeOpKjmh1tUViTFplhNm0Q7uDjh_L

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 083A 640 B
265 B 45ms
45ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPfxrZwEEJHbqqkFGIfj-ocCMAE&v=APEucNXl8v33ET8F1Gs2YCS7TEsT6p8IltL0LQvONoZ8HI5zXtz2VW8x0AmhIr9K3aK99LRHL394BY30cMbaEfAVOWZS9IsZaZDjSeNVhIehwEpqoG3fXvY17vAADUwVOpeQKD6iHkJIEuqzlnTDzA0d3Z8ZbaB78DoyosSRsL1m4Zf4OjW6_50

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:49 GMT
expires: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/ Frame B5D7 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 17:55:31 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/ Frame B5D7 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:34:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:34:59 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame B5D7 0
0 48ms
48ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuRE_TIdnUxYjx72Khq2itRlYYZWhjOUshqBZJFHCrrwzmS8C5sw41pjN_IhTtQWoSSmfzoN6e24e9r7whPFVwCc6PCU7FI2Powhfghnt8RLA2A_py6POoMD7oLqbDa9L4gnGybnq0zd9kwbX9vRb5OLpNJA_MyseGMWsTEO6qZdBJ00t_YvY5JN_ThmMMT6jdhizPyYiZ9g5gDhtfsMooPNs2_Pvh9-bz2fmaYPi6VyrPYIAGt0V0Byb8n0xIw_cK9NsaFwv5rQX3f77c_wRs7nI1sqhNIyRqADsKXkBbRs219w8hbXpJIK5nGSOfq-04YpQ2BoHi1fpp319uxgRo9-eKwxmcUKdnlLGp3J6dn3GqU34zt8irAoTtxOl4tlT0wQtPc1wHaO9LR_OvsaR9LVKWd3v9z4Ss4qoYK-mGRwFt2yo-ILLUlmC-D08WFI-RkjYw5Hd_gaYmMIfi4LZhYfPZV_mSOvzdl6szzzctmGZxH40VWCk26lcYV6yWVm6U5M0URfg1KRzHl_C4hvjpYwrYKS4XeVZDUDBG-O8TThhsUC1QmvE0oTSwd4prHsS27inDqiokB8kaXde3NY4gMj3CLrYIhL0c-7J6ko9Qjqars73baG_2pEqonqZoirVaudPFaTdwFUaEvcXa0Ga2dKfD5r5rlXkDQNK1jW6j5aUtmsAW8LEOStUiVPPE_jVt2YaphbIYpkHbXAedxNCdmNvf1L4mAK9svXn4rkziFW1ww9UhheoIvSCBfw9MRVZmB_H2uhm0QjjlIkCl71cUtVV-iPXpV6_B_VpOvngGBjTbZt5i9nzh_gJ5AzStHkVvSciCo52CbVxbgs_xy8a-0jyVGL_VUp9dDe-OzDNXltjrchW6Eq4xXcUVq4YhbOPDM7u5snp_zy2p0tpQqvTbCJGH7P9zaYgPJxl1qgvrDqCBkdlh0SxxwpTgO6EBxShiX_ufXXBRhxtMgnssqCMmSnFGijPJ7OF_ohz8jGTWM2t0XNwIBVCNc3MGXddD1ffywOHneTAi6RJT5ScZh-8oj_hBT-qIbRjJFD62_1lJX-KvHtL2BjD7CrxYxRUomPiK9SG8_R9kC9bzmcw9Bu1RhuBYfnAoB8ZzruCMKut_es2s60zojR68iLIB-6DKUyt7O8K27_fr0cxtFA2pkINznYtxaZtBIzvuZgXrnc-WpTZdNW03nKcVcJM3db3Ch-6OyhpI_TQyy3xDXD2FcwS3VwHDPd8P8WVidcdmkvdjZCPDUh6xVG-XueBE0FIeQC6fZYQX2EpOdFxSzfDwrCryBkJjZxeI3hiuZpa1swlvszByT7KScvLj_Yy9e4D0Aj_INu2bOpJCykOyb1nBnkuAeFg7c6KBuejpZ9GiKhwIloHlDdnutfzON1LJcPwU_yD0eQbcc12cmwB9vfM_03MEXHpyFLC_zntkQbYuRY8cWBrQim2smi7BxWDizb8FE96QIQcoy&sai=AMfl-YSq9LS4r72G1eKX_2kf4o5H6cHyRNc2Bytc_lveEUttUVnS9eJGqbXq1ZyXWEy-ocqUen3xPXyWE5PDuZSB4KG2QcMnvHXmCfb5BFtGHbiWnWxNqEG2MLAOI19xMnyGdaJiQ7Qzcx47eIz-juxfDuGO5v8Atgsx6ASu_lvdXZQMcPqM5WZcmOCwtQc1LzL7jwkcrfRQ-kOxQXjiUxKlBQX7sTjWwVBO4mRbRENLyQgaLrrWtskX6HvCVfpqH9ZdchPBnZAT-cK8lwfLZFt49Kh-96ErVY86tIjcfWEVhyA1kS1-D5H5g2ShN_kDfMR_hoMVPjZWDbalUMP4Fhhsfg8sGGbNztHi0jqU4rtrkie3Om0_hx_3oQqYNjykm82IJUIBDD0fyTybhYsJa7fY3ors14iCy1XjlMhZk7lf31nPmbykaIR5ZCgpc42SPEWIhfeeNRMXxY1ZvuqSm3LaGXr4-KqwNDyg3kW7SseJrvGqIunbO6rcA3krAXh0ieOwBkTVrmg&sig=Cg0ArKJSzOsrqQ3IkSkfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9lYmF5LmRl&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240212.44396&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame B5D7 41 KB
14 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126365
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame B5D7 3 KB
1 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame B5D7 20 KB
8 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B5D7 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BebIYiEvOEJsNg7Itt3CJ7qkmPtNQA2O542K_7kzTkEXxqoeJz2xzo7UPQ1Eqz_mqtzg7BTLbw2PByO4IDDPKqCa0CUUCMLo5zyylMsTSYBmygJVo

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B5D7 204 KB
61 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1097
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 8368423733782429387
s0.2mdn.net/simgad/ Frame B5D7 90 KB
90 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8368423733782429387?sqp=uqWu0g0ICPoBEKwCQGQ&rs=AOga4qkq4R0PU8oNnu9tyv_TWTzvGaE5Gw

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6a4245519fe315fe1b3feb903735febbf1ff3ab1c3e7906eca91a200b8ee1f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:21:39 GMT
x-content-type-options: nosniff
age: 125530
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91947
x-xss-protection: 0
last-modified: Thu, 04 Jan 2024 14:25:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 12 Feb 2025 09:21:39 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3F18 38 KB
13 KB 9ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B5D7 0
20 B 40ms
38ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=44&d=1&s=1&f=0.01&bgai=BMeNx_R7NZf_0CL_C7_UPq_C1kAoAAAAAOAHgBAI

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 jizAREVNn1dOx-zrZ2X3pZvkTi2k_iI0q1s.woff2
fonts.gstatic.com/s/ibmplexserif/v19/ Frame B120 19 KB
19 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexserif/v19/jizAREVNn1dOx-zrZ2X3pZvkTi2k_iI0q1s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:regular|IBM+Plex+Serif:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2696954e1d9a90197411905f980af92c684f1b48ff097fdcabcb7ccffe32f888

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tpc.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:17:17 GMT
x-content-type-options: nosniff
age: 125792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19880
x-xss-protection: 0
last-modified: Wed, 26 Apr 2023 23:44:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:17:17 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame B5D7 0
0 41ms
41ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuRE_TIdnUxYjx72Khq2itRlYYZWhjOUshqBZJFHCrrwzmS8C5sw41pjN_IhTtQWoSSmfzoN6e24e9r7whPFVwCc6PCU7FI2Powhfghnt8RLA2A_py6POoMD7oLqbDa9L4gnGybnq0zd9kwbX9vRb5OLpNJA_MyseGMWsTEO6qZdBJ00t_YvY5JN_ThmMMT6jdhizPyYiZ9g5gDhtfsMooPNs2_Pvh9-bz2fmaYPi6VyrPYIAGt0V0Byb8n0xIw_cK9NsaFwv5rQX3f77c_wRs7nI1sqhNIyRqADsKXkBbRs219w8hbXpJIK5nGSOfq-04YpQ2BoHi1fpp319uxgRo9-eKwxmcUKdnlLGp3J6dn3GqU34zt8irAoTtxOl4tlT0wQtPc1wHaO9LR_OvsaR9LVKWd3v9z4Ss4qoYK-mGRwFt2yo-ILLUlmC-D08WFI-RkjYw5Hd_gaYmMIfi4LZhYfPZV_mSOvzdl6szzzctmGZxH40VWCk26lcYV6yWVm6U5M0URfg1KRzHl_C4hvjpYwrYKS4XeVZDUDBG-O8TThhsUC1QmvE0oTSwd4prHsS27inDqiokB8kaXde3NY4gMj3CLrYIhL0c-7J6ko9Qjqars73baG_2pEqonqZoirVaudPFaTdwFUaEvcXa0Ga2dKfD5r5rlXkDQNK1jW6j5aUtmsAW8LEOStUiVPPE_jVt2YaphbIYpkHbXAedxNCdmNvf1L4mAK9svXn4rkziFW1ww9UhheoIvSCBfw9MRVZmB_H2uhm0QjjlIkCl71cUtVV-iPXpV6_B_VpOvngGBjTbZt5i9nzh_gJ5AzStHkVvSciCo52CbVxbgs_xy8a-0jyVGL_VUp9dDe-OzDNXltjrchW6Eq4xXcUVq4YhbOPDM7u5snp_zy2p0tpQqvTbCJGH7P9zaYgPJxl1qgvrDqCBkdlh0SxxwpTgO6EBxShiX_ufXXBRhxtMgnssqCMmSnFGijPJ7OF_ohz8jGTWM2t0XNwIBVCNc3MGXddD1ffywOHneTAi6RJT5ScZh-8oj_hBT-qIbRjJFD62_1lJX-KvHtL2BjD7CrxYxRUomPiK9SG8_R9kC9bzmcw9Bu1RhuBYfnAoB8ZzruCMKut_es2s60zojR68iLIB-6DKUyt7O8K27_fr0cxtFA2pkINznYtxaZtBIzvuZgXrnc-WpTZdNW03nKcVcJM3db3Ch-6OyhpI_TQyy3xDXD2FcwS3VwHDPd8P8WVidcdmkvdjZCPDUh6xVG-XueBE0FIeQC6fZYQX2EpOdFxSzfDwrCryBkJjZxeI3hiuZpa1swlvszByT7KScvLj_Yy9e4D0Aj_INu2bOpJCykOyb1nBnkuAeFg7c6KBuejpZ9GiKhwIloHlDdnutfzON1LJcPwU_yD0eQbcc12cmwB9vfM_03MEXHpyFLC_zntkQbYuRY8cWBrQim2smi7BxWDizb8FE96QIQcoy&sai=AMfl-YSq9LS4r72G1eKX_2kf4o5H6cHyRNc2Bytc_lveEUttUVnS9eJGqbXq1ZyXWEy-ocqUen3xPXyWE5PDuZSB4KG2QcMnvHXmCfb5BFtGHbiWnWxNqEG2MLAOI19xMnyGdaJiQ7Qzcx47eIz-juxfDuGO5v8Atgsx6ASu_lvdXZQMcPqM5WZcmOCwtQc1LzL7jwkcrfRQ-kOxQXjiUxKlBQX7sTjWwVBO4mRbRENLyQgaLrrWtskX6HvCVfpqH9ZdchPBnZAT-cK8lwfLZFt49Kh-96ErVY86tIjcfWEVhyA1kS1-D5H5g2ShN_kDfMR_hoMVPjZWDbalUMP4Fhhsfg8sGGbNztHi0jqU4rtrkie3Om0_hx_3oQqYNjykm82IJUIBDD0fyTybhYsJa7fY3ors14iCy1XjlMhZk7lf31nPmbykaIR5ZCgpc42SPEWIhfeeNRMXxY1ZvuqSm3LaGXr4-KqwNDyg3kW7SseJrvGqIunbO6rcA3krAXh0ieOwBkTVrmg&sig=Cg0ArKJSzOsrqQ3IkSkfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9lYmF5LmRl&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=21&vt=11&dtpt=20&dett=2&cstd=0&cisv=r20240212.44396&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame D20D
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=C4gjn_R7NZd6VBquR9u8PwNmZqAfVvuuKc76U2NLdEdrZHhABIP6q75sBYJXikIKgB6ABzPTe3CnIAQmpAiqsz0j59bE-4AIAqAMByANIqgSnAk_QH6QJF6NX-W50Ussacic7NkfasL_K...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225784532333490716496%22,%22debug_reporting%22:true,%22destination%22:%22https://resonio.de%22,%22event_report_window%22:%22...

0
0

52ms
38ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225784532333490716496%22,%22debug_reporting%22:true,%22destination%22:%22https://resonio.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211200346700%22],%2222%22:[%22true%22],%224%22:[%2202-14%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221458110552102520305%22}&andc=true

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"5784532333490716496","debug_reporting":true,"destination":"https://resonio.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11200346700"],"22":["true"],"4":["02-14"],"6":["true"]},"priority":"500","source_event_id":"1458110552102520305"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"5784532333490716496","debug_reporting":true,"destination":"https://resonio.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11200346700"],"22":["true"],"4":["02-14"],"6":["true"]},"priority":"500","source_event_id":"1458110552102520305"}&andc=true
access-control-allow-origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 52ms
38ms Preflight
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=C4gjn_R7NZd6VBquR9u8PwNmZqAfVvuuKc76U2NLdEdrZHhABIP6q75sBYJXikIKgB6ABzPTe3CnIAQmpAiqsz0j59bE-4AIAqAMByANIqgSnAk_QH6QJF6NX-W50Ussacic7NkfasL_Kviw2UdSC31wnginp-CEUx-x-feINVNJapKPK1388a2I2qWfGwD7_cQTLIV9X3OpoKyaZjf6o4In33Jl8knZjqb9a-celITdUFMBOTcFtwDTk6k-rNOjbZaO8bojlVmXwHyFrPm0J4FQoZpaenGESMuF5hp-Z792gb7FOJ4PMpgDvJU26eSL6g9Ypm6YzFs0mY5iFC2z4aYJTwBLX7kqVLWM3BlCIWA6WWmViWGeEXQQC4krK9IbEABrdXaRNQ3KQAfsIOlnETvI-vnuJBylbRGRAZgU-PUPmSatOh85yCeHCv1jC-p6qR209feWyU0i-H_r6bh0LSByoq6fmbJrn5qSivJpnyn_kBa_kbM1L05vABP2Sotq1BOAEAYgFmvL5yEySBQQIBBgBkgUECAUYBKAGLoAHzKyvvASoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G9gHAPIHBBD59zbSCCYIgOGAEBABGB0yAqoCOgmAQICAhICAhAhIvf3BOliTvcSw0quEA5oJF2h0dHBzOi8vd3d3LnJlc29uaW8uZGUvgAoDyAsB4g0TCM_oxLDSq4QDFauI_QcdwGwGddgTAtAVAYAXAbIXHwodCAASFHB1Yi01MzU2NjE0MDgyNjM1MzM0GPaElAE&sigh=FRlxUSbfgKE&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwAvHhf_af4Wket_LrvPy4IGFUUgUehhqkPeCi5tUdX3Y0P1DMICpgm3Aec6VfChNlSpzulCE-YVaVWHQzUzndlExel5vW7vx81gVBE-izcYAQ&template_id=419&cbvp=2&vis=1&nis=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 083A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOg5AP_ZQU3xMFdmTDLaz90&google_cver=1

43 B
264 B

16ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOg5AP_ZQU3xMFdmTDLaz90&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPfxrZwEEJHbqqkFGIfj-ocCMAE&v=APEucNXl8v33ET8F1Gs2YCS7TEsT6p8IltL0LQvONoZ8HI5zXtz2VW8x0AmhIr9K3aK99LRHL394BY30cMbaEfAVOWZS9IsZaZDjSeNVhIehwEpqoG3fXvY17vAADUwVOpeQKD6iHkJIEuqzlnTDzA0d3Z8ZbaB78DoyosSRsL1m4Zf4OjW6_50
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOg5AP_ZQU3xMFdmTDLaz90&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 083A 43 B
136 B 46ms
25ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPfxrZwEEJHbqqkFGIfj-ocCMAE&v=APEucNXl8v33ET8F1Gs2YCS7TEsT6p8IltL0LQvONoZ8HI5zXtz2VW8x0AmhIr9K3aK99LRHL394BY30cMbaEfAVOWZS9IsZaZDjSeNVhIehwEpqoG3fXvY17vAADUwVOpeQKD6iHkJIEuqzlnTDzA0d3Z8ZbaB78DoyosSRsL1m4Zf4OjW6_50
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 083A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEIeEheYZntWPuHgwbWfdiFM&google_cver=1

23 B
163 B

83ms
44ms

Image
image/gif

23.211.8.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEIeEheYZntWPuHgwbWfdiFM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPfxrZwEEJHbqqkFGIfj-ocCMAE&v=APEucNXl8v33ET8F1Gs2YCS7TEsT6p8IltL0LQvONoZ8HI5zXtz2VW8x0AmhIr9K3aK99LRHL394BY30cMbaEfAVOWZS9IsZaZDjSeNVhIehwEpqoG3fXvY17vAADUwVOpeQKD6iHkJIEuqzlnTDzA0d3Z8ZbaB78DoyosSRsL1m4Zf4OjW6_50
Protocol: H2
Server: 23.211.8.12 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-8-12.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 14 Feb 2024 20:13:49 GMT
pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEIeEheYZntWPuHgwbWfdiFM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 083A 23 B
163 B 105ms
42ms Image
image/gif 23.211.8.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPfxrZwEEJHbqqkFGIfj-ocCMAE&v=APEucNXl8v33ET8F1Gs2YCS7TEsT6p8IltL0LQvONoZ8HI5zXtz2VW8x0AmhIr9K3aK99LRHL394BY30cMbaEfAVOWZS9IsZaZDjSeNVhIehwEpqoG3fXvY17vAADUwVOpeQKD6iHkJIEuqzlnTDzA0d3Z8ZbaB78DoyosSRsL1m4Zf4OjW6_50
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.211.8.12 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-8-12.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 14 Feb 2024 20:13:49 GMT
pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame 1451 51 KB
20 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 09:16:32 GMT

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3F18 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame B120 51 KB
20 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 09:16:32 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 57ms
37ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E874 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AC93 466 B
238 B 43ms
43ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhDO47_zBRiAqPWDAjAB&v=APEucNVkvOTPmEtwodRxi1ZcKXqXnhkVTufz84VHsr89G3p42oRswCLb0e7peVXhMTt2lcrS8qY2FAEpTpYo3aBaOrNRvmmTfCb195eImSPqWXLrC4UW5LQpdEpcobLGY1evAXPIj50hnikJCj5ZNkXDyLSxs2Gd9BC1z_MEdOhrdUdGWSFUaC8

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:49 GMT
expires: Wed, 14 Feb 2024 20:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame E874 23 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:36:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:36:14 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame E874 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:29:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 00:29:25 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame E874 0
0 51ms
51ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvSTOIbD2LTb8zOeJjw7Jx1NOjvhpGe7HVctOF8Wfxo5jair5WV3Ft-ZhGTqHYQKLcjU5lF3agjIKAVyKeuXStAoezGE6qWTOf4Eq4VSZ52vCd7qptz5of6SvoMjcPwoCR7UmBQ5TMcH8jFv157f0Khyy460tuADWGCWe1ksGB4PjGV9-7z9rSSohheFRYyRMHT9yRDm0JrPJykZ7lsWvJf3zU8IOWN6qb-zIGwCWQHKZsfc6f3miwmB1Iaz2uZ_yJs1mPU1VqjmNZr26RiahV87_4sMsmFA40VQj76egUkxn8cCSs8eaYg0Eo3GizGSl_t_oAeiqYm_Fe1uNUwRqZrZpEDUPLldFhA6_0P8fp9TEb7fPeEJ-RhE_YUTg9v1s1VdUWzu7l4ZALS66idNzdq6KKBsvKmYg08rlDRSfyfZM7G9qvhQUa_mFoPnCpolyGuxLHrBIVf8D39Vmht57V8UNesupBglswHSydDJFKMFrcfj3xIzNcwWqtsOKT2GckD3EfahD56B1JYgqqCBsm0udfkoRpcEDgQqhPtsRLM0Bq5F-eU3jjRQqNyzxHgdKHsjl3PtH-UT0DHT091NgHUvdM-XQW2mAOswB4iQLDfe5tgM-PrX81oHnGXlsMf67ts0UHyze3xSRNVTibbW0Z7N2ngFkP1pLxk3I0FG-wBLYyFz5nCL_MGqoQe6tch3jFLAS66MMIG-Feif2tBUBxHE_9TBjZk8FO8W-bm3EAT9bOsw67p2V4YwY1J40uzNr47I3reewxbYnt1rwMJlOacp8mxaMmCitkNSzaaM7Wooif0qtraYcP1M4ncDaIjKxwQFuEFFJIWKHn4T6IQUjqZznZDcC7mN07P6dvjBnEwfIf3k3-NBssUtdNa8-f7mYc6kwYSktZoxN7IoRP2Jt5wUUEGZCVO3_1Z9o-pIkITWxgrs_UAqkFxIaZGJAK_9nDwZsQs1b59VG2pjiT06OnEgbjQGaJABBUj-79COF0xsTSC9wbO34jc6ovIC2Hk3y3csNL6-pnKYsvFBCqCoePcfgU0V7uGCXSApWSe4dq2iCHvnkn4DgkQM3owWsXTHmM_yQfoN1hQ5Xor771iI0_XWvgCimVVGlJOnVcC8osm2rh6bQA1Z7-PyjvBwGbI1b6nBQzfnHCYNtg8qJiGc_cNb1jaEGcgrdG-dc9NIBFP-SPXK34g9MRrYpCa5ZaxPsCbIwkJp66EoVnztz1OoXktxF-ufFDd1gjRngDk9tnGDFI5nbueDLLMlRIKl_mb5-SMq72y5PbvFszLVm0ItmtQC46R3mVupcGV0t2qgzryjEoDmaitxMNLu3v9sRspQvUa5G0LBSIELoKmfFZ4RHxmvFAkfPxVMZYQ_XDKfwp_3Fm5XO_ZUWkgfCuvnjopjPdpO_KobpzSXWApNA&sai=AMfl-YQ9tm8AoMa36iCicyzs5smTm4Z1FArrBSKQJFSsdtkLDqZs03Gk1hgsXwOowBIreJD_tKK3W78D5kNAFDEzMYL_dWlb4QLPr6GQvNGM41E9ag3dTfbgEvpyFaT2gCKfhLisJfTF_f1WOVMdTo8xKFIHhzSF8CjWbE82svUpdYSm5VKLCLuqk_bJl6w_yLY6C6gTmWpMCw4jP7Ax-tGUCXx8KCKUMw-73T4YY7wXwXdZ9O0kXtPGB8g0ywJD7S4yhlskVucQqK82fqrtAv8yeZgeAHTgo6l6PXnZxTGhvO5sxT9mFrjamN4fBp3T2rcswdDDvchp4hK2yuQlnKWno7H86DQbKzloKGrDHnDL5lVl0lILKs6l5WEWL_wrN9c33EfDdysCPaJfbS2dOfSFrEhEfb7wWICPUHwmW_2mz45PY3pBy0Ogg6EEssm-tmyYRCTobrDJiPYIdWYiCrWPv-TrcTS0BhF2bGCoeebaBiuqXGPY5uARopPgSzrU9FN7RzLsCcg&sig=Cg0ArKJSzD5DVZJQDvSfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9mbGFzaHRhbGtpbmcuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=1&cisv=r20240213.09953&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame E874 41 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126365
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame E874 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame E874 20 KB
8 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:45:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30501
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:45:28 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E874 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dw4JlRqFgKLAXFPd2a3n19njwWForhXH8BrJl3LSLnUKrCgMq-8UH5f1lLPr6fPNhGKup-L58jLcAWXAEjtJ8JD7klpagramdt-XfGRpiP9109mnw

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E874 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1097
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 9151413793142883626
s0.2mdn.net/simgad/ Frame E874 33 KB
33 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/9151413793142883626

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ad7983b324bec5e904393da71a38324ee2f537e8503ba7dd2ed3dd46a71c587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 07:44:59 GMT
date: Tue, 13 Feb 2024 07:44:59 GMT
x-content-type-options: nosniff
age: 131330
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34012
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 15:12:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3F18 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BMeNx_R7NZf_0CL_C7_UPq_C1kAoAAAAAOAHgBAI&bg=!_f6l_rHNAAaxkZ3akZE7ADQBe5WfOJD8k8A-kOjgI1jO77ll55hMY_MUb-fGhTLR4bC7YSjqu9EDIPw20ob29jDezKqAAgAAAEFSAAAAAWgBB5kDEoQ4zPWKDgkqzsQUp-mXgjrOjfJJ8qbBnYFp0uOBepif8s_7ZFwmsfAAxvD_Ud4CgCloflL-lMNkt7R5Rn5DWVUubj2uo1MUxxB0s-ATLZOc_IYyQsQH2S2EBbFAEybYM426NlfE0AFWMO3ELDHr7eVx71axJxExVB2xyTA68Go1XC71nGU8KM85zSv6p8loA_ARrtCD5P_Mc9JsEkZrisVbLEmeKXBdKvXBnoQXTRce-vVsWhbhJyo10_Ow0Z43m1R20shQRCg_OMYEwC7Fcb41oBcaMWWlcR-2QfuammGqjvhVbXDYjnFM9gyfkSDC08MXSvnbruI2N5AH6yijU6Och1yA5pb8mBzZl2-WhSLJwqTDAXufeB_K7bsQthstcXu3I_axbztdj1kVDgvDlBfvgN35PLdxBEWc52eSj4PRsrerNN4G1XLfc4r9PJmUICkKLrL2sm2QGG0PK3uDa9IbJxBMmcOd7a52Cv7QwQD-7IuTiS-EChadtosPsu0fc3CaDPEX31n1dtdf6HaM8Sc9J5IkC_Mj9d4GIkGiWY_ejuzUXiaAzdtASX1pFJBAZ-extyKogMpi6UzZSmGGrBAEwnwnsz9NNtXhgN6YW3pZ2mDXWiQCUkaaC8zRpamsfnGYokutNXOs1FFr4tAo1-vu9eCN_UauJIKhhFf7pSxseiBXIIgFqRwG_xG7M10XOwn3sm9IUCgnEmLAZgvUqlZqxllHE7Y91J2hAMfo1fDcS00w2892zDtRUhZKzZsK_gTzNbufdGiPsX-s929KsqC8IcnAnXDklKqfs-qzKpr-E5A9tY8rwDfVTCkgh6wWcesMB0KTaAO6LeIA6qJ8ANKY47oN0IK1j-VH3EivLChaFhD1vl9AmIW2xLtKZ_ac0whHuE0TlaWIMZoUV32w8-EcAgPD8KMZiMkMd8Kd2e60pY8nMenu0vaTe68hgvx1akbinH0499kYDd4fK1x63GMBTney1pBpUn4cmNGagI78IaQP5t5eCdC3yrvlWAPYfDO3cPxYz1CCpp2nCq_fvFlOdQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame D3B8 38 KB
13 KB 8ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame E874 0
0 42ms
42ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvSTOIbD2LTb8zOeJjw7Jx1NOjvhpGe7HVctOF8Wfxo5jair5WV3Ft-ZhGTqHYQKLcjU5lF3agjIKAVyKeuXStAoezGE6qWTOf4Eq4VSZ52vCd7qptz5of6SvoMjcPwoCR7UmBQ5TMcH8jFv157f0Khyy460tuADWGCWe1ksGB4PjGV9-7z9rSSohheFRYyRMHT9yRDm0JrPJykZ7lsWvJf3zU8IOWN6qb-zIGwCWQHKZsfc6f3miwmB1Iaz2uZ_yJs1mPU1VqjmNZr26RiahV87_4sMsmFA40VQj76egUkxn8cCSs8eaYg0Eo3GizGSl_t_oAeiqYm_Fe1uNUwRqZrZpEDUPLldFhA6_0P8fp9TEb7fPeEJ-RhE_YUTg9v1s1VdUWzu7l4ZALS66idNzdq6KKBsvKmYg08rlDRSfyfZM7G9qvhQUa_mFoPnCpolyGuxLHrBIVf8D39Vmht57V8UNesupBglswHSydDJFKMFrcfj3xIzNcwWqtsOKT2GckD3EfahD56B1JYgqqCBsm0udfkoRpcEDgQqhPtsRLM0Bq5F-eU3jjRQqNyzxHgdKHsjl3PtH-UT0DHT091NgHUvdM-XQW2mAOswB4iQLDfe5tgM-PrX81oHnGXlsMf67ts0UHyze3xSRNVTibbW0Z7N2ngFkP1pLxk3I0FG-wBLYyFz5nCL_MGqoQe6tch3jFLAS66MMIG-Feif2tBUBxHE_9TBjZk8FO8W-bm3EAT9bOsw67p2V4YwY1J40uzNr47I3reewxbYnt1rwMJlOacp8mxaMmCitkNSzaaM7Wooif0qtraYcP1M4ncDaIjKxwQFuEFFJIWKHn4T6IQUjqZznZDcC7mN07P6dvjBnEwfIf3k3-NBssUtdNa8-f7mYc6kwYSktZoxN7IoRP2Jt5wUUEGZCVO3_1Z9o-pIkITWxgrs_UAqkFxIaZGJAK_9nDwZsQs1b59VG2pjiT06OnEgbjQGaJABBUj-79COF0xsTSC9wbO34jc6ovIC2Hk3y3csNL6-pnKYsvFBCqCoePcfgU0V7uGCXSApWSe4dq2iCHvnkn4DgkQM3owWsXTHmM_yQfoN1hQ5Xor771iI0_XWvgCimVVGlJOnVcC8osm2rh6bQA1Z7-PyjvBwGbI1b6nBQzfnHCYNtg8qJiGc_cNb1jaEGcgrdG-dc9NIBFP-SPXK34g9MRrYpCa5ZaxPsCbIwkJp66EoVnztz1OoXktxF-ufFDd1gjRngDk9tnGDFI5nbueDLLMlRIKl_mb5-SMq72y5PbvFszLVm0ItmtQC46R3mVupcGV0t2qgzryjEoDmaitxMNLu3v9sRspQvUa5G0LBSIELoKmfFZ4RHxmvFAkfPxVMZYQ_XDKfwp_3Fm5XO_ZUWkgfCuvnjopjPdpO_KobpzSXWApNA&sai=AMfl-YQ9tm8AoMa36iCicyzs5smTm4Z1FArrBSKQJFSsdtkLDqZs03Gk1hgsXwOowBIreJD_tKK3W78D5kNAFDEzMYL_dWlb4QLPr6GQvNGM41E9ag3dTfbgEvpyFaT2gCKfhLisJfTF_f1WOVMdTo8xKFIHhzSF8CjWbE82svUpdYSm5VKLCLuqk_bJl6w_yLY6C6gTmWpMCw4jP7Ax-tGUCXx8KCKUMw-73T4YY7wXwXdZ9O0kXtPGB8g0ywJD7S4yhlskVucQqK82fqrtAv8yeZgeAHTgo6l6PXnZxTGhvO5sxT9mFrjamN4fBp3T2rcswdDDvchp4hK2yuQlnKWno7H86DQbKzloKGrDHnDL5lVl0lILKs6l5WEWL_wrN9c33EfDdysCPaJfbS2dOfSFrEhEfb7wWICPUHwmW_2mz45PY3pBy0Ogg6EEssm-tmyYRCTobrDJiPYIdWYiCrWPv-TrcTS0BhF2bGCoeebaBiuqXGPY5uARopPgSzrU9FN7RzLsCcg&sig=Cg0ArKJSzD5DVZJQDvSfEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9mbGFzaHRhbGtpbmcuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=14&vt=11&dtpt=13&dett=2&cstd=1&cisv=r20240213.09953&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
DATA 200
OK truncated
/ Frame E874 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ab14612bd84560fe6583d5b22557a8c801dd9047b2aea3f1e1c50e89ede1c5f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame D3B8 39 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8297
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET

partner
sync.search.spotxchange.com/ Frame AC93
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESELznomePMeZUfDq7e6ZV9pE&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame AC93 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame AC93 0
125 B 198ms
34ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhDO47_zBRiAqPWDAjAB&v=APEucNVkvOTPmEtwodRxi1ZcKXqXnhkVTufz84VHsr89G3p42oRswCLb0e7peVXhMTt2lcrS8qY2FAEpTpYo3aBaOrNRvmmTfCb195eImSPqWXLrC4UW5LQpdEpcobLGY1evAXPIj50hnikJCj5ZNkXDyLSxs2Gd9BC1z_MEdOhrdUdGWSFUaC8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D3B8 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWAcl_R7NZbSvF4_g9u8P6sO82AwAAAAAOAHgBAI&bg=!8fKl8r3NAAaxkZ3akZE7ADQBe5WfOJs7wA1J1P2LHUN9g82DzEn49TCsz-0IIosok6o-yh0ZAwU5ji_Ow6br2mmr_6VnAgAAADJSAAAAAWgBB5kDC1BA3PVc8QvVFw7oD3oojiwAhpTdU_k8pnOJwDO_GaUiMfScxrjFYldQqaErpVRZ6HZl_GEEYBLcPOQg07oPegem0jpgNnOdnPzwz7BVGjdsoLi7H4jWve7iC7QYTL7RULFxcXMNFX4SQ5KmyZmic5U38X349AYjVDu0lQOv_NM1pT5XAWdEwLOXqHCpRWxHw4ykqpMGwDmIgH55w_usJaEP-8Iq_5Lc9IRircMLU9NkFbbHYrypsABy82JQwGAsYfY4JfClz-FKonSIIwJDJtQYsgqI5iRBzftmXWrM_o1x0HTUGF1y9aaOOVi4e2_9kic19E6UCwSH7YNOJxDDLPZbxA2kVjI8WmG8pvvLokiFHGVkFeSDkFIZtgXfWFnUR0figHmbeUWDbABmtvye3tH5l1wqUo7zsQnRK7qRaWmhu0wHT92_EnrZFd3fcIKX9YXOBeoCnCMGo-5DD1eRClK9fKJ2Wngn6D_ASlVFncuBBYtq2TUn-HszqVNytFispzlfAy6087VPJmO8q6MX9WCpF0bA72X_4p4qdb6nKjv66i7L01s88m6K2f51ZCjL0xEXw_NeaPptXmGFbdICFEe1TGFuBItrTqXbltG3kYuQG_5YFuxBlytp7jPZxtLWiyjC3cErXXULr9sqWVatwXWqInGZCEx1CwpBkehi-fHSbpObJwPztQw5GT3KfWin99ouKOKTET3js0cw6KqnE0mecfupRAr7MuCSqIQB-lX4lInl407eKx7xWpzemZsjmV4qTeC4j0vAehEzFh4rax8eyQ6D6iCggaVM6Z8z--CVGG9-nbFzDFeNteT9ZM-P9MHxt1q83XK4eQJkD0BgAAT63isS1Ul-obYiJ-4Bhqz4O_nMwkRTE0g3UGfE7WxkodaHFYuEY0YBAYYMZ0fDxzn1tcCR6QiZsQfdYOgR4lAFHg9SUkpEkjgN6n6fi4XXpg3tqRCYoLxfqQNqEUjPKk6cp-5iSSIhg6NLGmtbHBFs7Ohv_z0PO-Fu0WhKIEe9kLIw_Gt2jWh8IZqo

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012402060239000/ Frame 249D 196 KB
56 KB 40ms
13ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a7c5cebbb6d6eff010530c59b73e9e423125219661ff9bc5866c55cd17a5607

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 13 Feb 2024 16:05:51 GMT
age: 101278
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56214
x-xss-protection: 0
server: sffe
etag: "51ebc873ede2e2f0"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 12 Feb 2025 16:05:51 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame 249D 15 KB
5 KB 75ms
49ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2125b73ae211f46f82ee27eee87e5aa312c5bbf2aedca1b50b7d80f21fd3d5d2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 17:15:52 GMT
age: 10677
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0
server: sffe
etag: "1e0d3e55ad08d21f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 17:15:52 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame 249D 95 KB
28 KB 68ms
42ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70651252ddc3ae3cc902b7f374fb9037f0a27192fb31b66acbf5300441b45ad3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29043
x-xss-protection: 0
server: sffe
etag: "f8b65ff06b47be2a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame 249D 5 KB
2 KB 72ms
46ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

288fd8ba8cb04967d8ffdb274e8828d79fe679e6991ceff828f0f48e04f315db

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "a50cf387c592e9af"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame 249D 40 KB
13 KB 55ms
29ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da80171367ccb86206235641cfa5efc267725e1870f5cc5c2a777dc57c7d5ebe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:22 GMT
age: 180147
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12948
x-xss-protection: 0
server: sffe
etag: "cd1beca569c88c8d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:22 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 249D 14 KB
1 KB 17ms
17ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 20:12:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 249D 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64973
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 249D 295 B
325 B 10ms
9ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85849
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AEBA 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012402060239000/ Frame B258 196 KB
55 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a7c5cebbb6d6eff010530c59b73e9e423125219661ff9bc5866c55cd17a5607

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 13 Feb 2024 16:05:51 GMT
age: 101278
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56214
x-xss-protection: 0
server: sffe
etag: "51ebc873ede2e2f0"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 12 Feb 2025 16:05:51 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame B258 15 KB
5 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2125b73ae211f46f82ee27eee87e5aa312c5bbf2aedca1b50b7d80f21fd3d5d2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 17:15:52 GMT
age: 10677
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0
server: sffe
etag: "1e0d3e55ad08d21f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 17:15:52 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame B258 95 KB
28 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70651252ddc3ae3cc902b7f374fb9037f0a27192fb31b66acbf5300441b45ad3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29043
x-xss-protection: 0
server: sffe
etag: "f8b65ff06b47be2a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame B258 5 KB
2 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

288fd8ba8cb04967d8ffdb274e8828d79fe679e6991ceff828f0f48e04f315db

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31303
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "a50cf387c592e9af"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame B258 40 KB
13 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da80171367ccb86206235641cfa5efc267725e1870f5cc5c2a777dc57c7d5ebe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:22 GMT
age: 180147
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12948
x-xss-protection: 0
server: sffe
etag: "cd1beca569c88c8d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:22 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame B258 14 KB
1 KB 16ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 18:50:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:49 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B258 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64973
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B258 295 B
325 B 7ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85849
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
DATA 200
OK truncated
/ Frame 249D 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09d6c3294a3d9fa4aac84441cc6585fd15e8dcfc311fe3077daecf8af99357d9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B258 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 685a6c2c6a3512de04b3430473eb70049796f6b6a0fa0fac70ce2d1b19cf4731

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 249D 33 KB
33 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mphealth.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 04:54:54 GMT
x-content-type-options: nosniff
age: 55136
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Feb 2025 04:54:54 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame AEBA 5 KB
694 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 19:40:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:50 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C068 14 KB
1 KB 21ms
21ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 18:14:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:50 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame C068 2 KB
831 B 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/ Frame C068 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31678
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:52 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame C068 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/window_focus_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31681
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame C068 20 KB
8 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame C068 204 KB
61 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1098
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame C068 36 KB
15 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70185
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 01:25:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 00:44:05 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/ Frame AEBA 22 KB
9 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:11:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72120
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9141
x-xss-protection: 0
server: cafe
etag: 6041988417631582345
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 00:11:50 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AEBA 205 B
229 B 10ms
10ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:53:15 GMT
x-content-type-options: nosniff
age: 73235
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 12 Feb 2025 23:53:15 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AEBA 604 B
628 B 13ms
13ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 04:03:39 GMT
x-content-type-options: nosniff
age: 58211
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 13 Feb 2025 04:03:39 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame B258 33 KB
33 KB 13ms
13ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mphealth.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 04:54:54 GMT
x-content-type-options: nosniff
age: 55136
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Feb 2025 04:54:54 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4180 42 B
64 B 47ms
41ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFhHkeexqe5VU2X7D7kJiKU1-9ymxvU2M6mI81G3nG_Iw-VtOyTWihuniDOdFSxAxACTAmFmLElZmCvpY3USlB0hq-O_Y_o0uDbNMEJONQdF0D7TTB55wIjSU-CB9ubIIrFMqJR-1MwpSP46i_TTt5G5rbir6hDIoVFw&sai=AMfl-YQigQZ6teLvUhKT2cOeJZp8WTAGN4jcteaqYvQCb0r9h6lhAXxbYWgDIMX0mIeE5rWPOmA_rH_0vZ5YnVLg3ZYZ8SYfu7-qUYk_6yOb0sTgbaRVp8BcyIQCexCU-7LY9Tj8A6sXFt1fo1tceiJ7MA&sig=Cg0ArKJSzJer1LQzSTdwEAE&cid=CAQSTwAvHhf_rS_0Y7fOnUcokXOB65TzBMywserCAfocMNtG-laFYG4KZIztaG_ZlM3SH6XinnReyswmnRScAkAPcRBuWX9E3drnpQ8mz3XKYxMYAQ&id=lidar2&mcvt=1015&p=135,650,385,950&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20240213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1091134190&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=387442900&rst=1707941628870&rpt=170&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 249D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

15ms
15ms

Image
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Redirect headers

date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame B258
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

40ms
40ms

Image
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Redirect headers

date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 249D 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64974
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 249D 295 B
325 B 12ms
12ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85850
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B258 2 KB
2 KB 12ms
12ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64974
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B258 295 B
325 B 13ms
13ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85850
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame E14B 51 KB
20 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125838
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 09:16:32 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 249D 0
0 50ms
50ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CMWeu_R7NZYK0He2h9u8Pzt-N-Az8pP-oddm_qoCrEqnCuoiRDhABIM6niZ0BYJXikIKgB6ABqoqXtAHIAQHgAgCoAwHIAwqqBKcCT9DXApFJ2clzz0K29isZDm_iyn3IOjbttRdLBjr3FYV7YxbsJVP5RmrR4RwyYKuoEtIXboLjO58RLm-iD1rgynfX8mcEB9jwLlvZRYwSfP24T4SeZokK2rA69VFVIbzb-b8S3kS8SHo7srHkPqnr9R4ii-BP0A0HFZulyy_uEc5TqFqzQhyV1kjcfvCOWNV1sHiBkURfx0HJy5DCimYuZNvbQrfdMkbPmFqvcWAIQGSPgn5bBTwe29xIfWILI7vGl7blCokaMGKgTbMlENB0fM2bEy1rg4fVBmdNufVsRymlZTINMllJLW-8m6ZUIOQzrm5kPK7CGrEC_HYD1KnacHcbCYrUXSRjklBbXWaIJf_v1igAJCuTptGvxRoZ-WYX7Q_22IUFw8AE0vPH1dYE4AQBiAW4ltP9TZIFBAgEGAGSBQQIBRgEoAZmgAe-9ejLAqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcB8gcEENnXDNIIJgiA4YAQEAEYHTICqgI6CYBAgICEgICECEi9_cE6WJaoxLDSq4QDmgkxaHR0cHM6Ly93d3cuYWpvYmxhbmNvLmNvLnVrL2RlYWxzL2FsbHByb2R1Y3QwMTIwY4AKA8gLAeINEwiK4MSw0quEAxXtkP0HHc5vA8_YEwLQFQGAFwGyFx8KHQgAEhRwdWItNTg4NTQ2Nzc2NjU0NjEwMhiO5pUB&sigh=IMkbNBfI3GA&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgAvHhf_zd8s4ejyK-y9U2AJMeviqWQL-fN3s9g2ClSKoWcyLXc9Qd54frtReqxDTvuwUFE5Ho9LBbaTv7GfG8ORZrVOeLkYwEx8elGTjhgB&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B258 0
0 54ms
53ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CeQo2_R7NZYS0He2h9u8Pzt-N-Az8pP-oddm_qoCrEqnCuoiRDhABIM6niZ0BYJXikIKgB6ABqoqXtAHIAQHgAgCoAwHIAwqqBKwCT9ATS_NMC5t1EOzlU-WeFMrd66XQv_3fCW7VBiv7W9_nzu8XttQ7K29h7OpGiDbv75tfpyLcyp9oFXkADt3GNeFFbGySH9b_Dp7u4b_ZzpAT-_xAhoqLIQxT9s7ByVxnAsRUO1iD_qNgnoc_P_vuNnQp0bf_SCxgP1MHnIUSiz7AS52usyxgKtIP1NFdyotD-LSTcVg3Y0tQyRjNQnxsVKOLpAGo7DhUy5QS8PU_8wJ_A2Mum3g-qCyjyE7eJW_bDoughS-mInLSQNg6OZlvfjq23SFwvWknFDJk88_ekmZrgfe1zhRAmckBrJlJrXArWtw8ulLUnQZG0vRSfj0XXggYN3k3p4JbDsclAUqc8inVDFZgzZVMCLu7mmvW9lfVfLYxst2JWr-Fe3l5wATS88fV1gTgBAGIBbiW0_1NkgUECAQYAZIFBAgFGASgBmaAB7716MsCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhvYBwHyBwQQ-49P0ggmCIDhgBAQARgdMgKqAjoJgECAgISAgIQISL39wTpYlqjEsNKrhAOaCTFodHRwczovL3d3dy5ham9ibGFuY28uY28udWsvZGVhbHMvYWxscHJvZHVjdDAxMjBjgAoDyAsB4g0TCIzgxLDSq4QDFe2Q_Qcdzm8Dz9gTAtAVAYAXAbIXHwodCAASFHB1Yi01ODg1NDY3NzY2NTQ2MTAyGI7mlQE&sigh=-Bn6hx6s9U4&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgAvHhf_zd8s4ejyK-y9U2AJMeviqWQL-fN3s9g2ClSKoWcyLXc9Qd54frtReqxDTvuwUFE5Ho9LBbaTv7GfG8ORZrVOeLkYwEx8elGTjhgB&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4180 0
24 B 38ms
38ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6677504020406&version=m202401290101&ct=119&x=1&cor=12942473823103857000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE0A 0
24 B 39ms
39ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6543353172246&version=m202401290101&ct=119&x=1&cor=14105542882210722000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 75E4 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstrmYiDEzyeFG3EgXYr8gA21fxyph4liSCzB7i7Ag6fJW4srA8JTa_BgU2-n3GS93OM9wzo3T530ogg7K5lzEMdcWR9CzDIJx7sW4rNxfEpDNt8Kc0msIjq2Ugujz0WNuChmN9oIc-cBoiq6lfLlDHOysUYWlTruKZjTw&sai=AMfl-YSLjpFhTa2T0iu6KmuffDFQExfeq1mAIhz1yS5tuXPRnAE8CaVHz7k9LUMDrpZGtRD49jQIW6GEnowAUeNAk8Fpii7lFm5swOop5xAAxBJEhFecSRe3lI0CVqkjHjQU-OImPxsGsmQbjRdDevyUzA&sig=Cg0ArKJSzCN8rOpAOpqbEAE&cid=CAQSTwAvHhf_0aUaC806GHxq6veR5Y8wC7Os5Fz9wfPQxKxXhUEqWq6kV8eC0ksfbOsZ8KfqB7RdXOhe9OG3X9MEM9Qj8MkfuSfngIhwtIgXtokYAQ&id=lidar2&mcvt=1000&p=445,632,725,968&mtos=720,1000,1000,1000,1000&tos=720,280,0,0,0&v=20240213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3558811071&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=387442900&rst=1707941629137&rpt=135&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012402060239000/ Frame FBF9 196 KB
55 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a7c5cebbb6d6eff010530c59b73e9e423125219661ff9bc5866c55cd17a5607

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 13 Feb 2024 16:05:51 GMT
age: 101279
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56214
x-xss-protection: 0
server: sffe
etag: "51ebc873ede2e2f0"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 12 Feb 2025 16:05:51 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame FBF9 15 KB
5 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2125b73ae211f46f82ee27eee87e5aa312c5bbf2aedca1b50b7d80f21fd3d5d2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 17:15:52 GMT
age: 10678
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0
server: sffe
etag: "1e0d3e55ad08d21f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 17:15:52 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame FBF9 95 KB
28 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70651252ddc3ae3cc902b7f374fb9037f0a27192fb31b66acbf5300441b45ad3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31304
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29043
x-xss-protection: 0
server: sffe
etag: "f8b65ff06b47be2a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame FBF9 72 KB
16 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08d631a369d2ed43e50e4e6dbb4619589fcf7a0b46d215ece86e1493b85fb464

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:36 GMT
age: 180134
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16667
x-xss-protection: 0
server: sffe
etag: "edd7ffc7036628c6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:36 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame FBF9 5 KB
2 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

288fd8ba8cb04967d8ffdb274e8828d79fe679e6991ceff828f0f48e04f315db

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31304
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "a50cf387c592e9af"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame FBF9 40 KB
13 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da80171367ccb86206235641cfa5efc267725e1870f5cc5c2a777dc57c7d5ebe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:22 GMT
age: 180148
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12948
x-xss-protection: 0
server: sffe
etag: "cd1beca569c88c8d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:22 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FBF9 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64974
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FBF9 295 B
325 B 8ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85850
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 bg.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 29 KB
29 KB 19ms
19ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/bg.jpg

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ac38aad3b021ce82aebf9bdbd44080e8413ed535e3d9238ab715ecd1c2df9c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:02:15 GMT
date: Tue, 13 Feb 2024 09:02:15 GMT
x-content-type-options: nosniff
age: 126695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30024
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push1.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 7 KB
7 KB 20ms
19ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push1.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

324387f70cc6c0fe72a9c83e68de7649907d9abebba8215c3c62a48dab2413c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 23:52:34 GMT
date: Tue, 13 Feb 2024 23:52:34 GMT
x-content-type-options: nosniff
age: 73276
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7277
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push2.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 6 KB
6 KB 17ms
17ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push2.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7d4dc366eb50db897ad584de186d975eb22d323c2ca58dc05d3f462c3649265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 01:02:36 GMT
date: Wed, 14 Feb 2024 01:02:36 GMT
x-content-type-options: nosniff
age: 69074
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5845
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push3.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 6 KB
6 KB 18ms
18ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push3.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcc2706dfc387db1247f925f35e7811f9203da43e803791aeb3826e7a1548341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 06:41:32 GMT
date: Wed, 14 Feb 2024 06:41:32 GMT
x-content-type-options: nosniff
age: 48738
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6060
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legal.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 21 KB
21 KB 15ms
14ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/legal.jpg

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84925a1fc46baecfd3cb667b5bd6caa0121c6451e49d54c262c373c0a90394f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127028
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21894
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 6 KB
6 KB 16ms
16ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/logo.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3915bbfbaa4321e537ee86450dabb72ef5062c66de5d2a01f315818bbfebd488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127028
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6613
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame FBF9 5 KB
5 KB 17ms
17ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/cta.png

Requested by

Host: mphealth.online
URL: https://mphealth.online/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41b974664e19df7a95aec890ea3ef921969b24f8926d5b8f3dbf381e3213bd30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 07:59:51 GMT
date: Wed, 14 Feb 2024 07:59:51 GMT
x-content-type-options: nosniff
age: 44039
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5459
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FBF9 0
0 47ms
47ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIRt0_R7NZfbaNvf-9u8PtsidwArIq-_bdaKh4-y5EuuEhsvCARABIM6niZ0BYJXikIKgB6AB1Z75nAPIAQmpAiqsz0j59bE-4AIAqAMByAMIqgSrAk_Q5Y6zXkQ9VwVcGl1IiXF43XN_x3tQc1wG1TBnDcdvywZ2aYtxh_-ImnRbm2veD_5h9pa3mgmPVX595gfhRleiMatJhNsr_DEkE6anP816DNW60BQlF4QLbWKgkHJib44eYS25Cws_rCxSWBo4WkpZXC4mSrb7JLblm2dFJVhjnugw4SZstelyKl9eLQekDTZnHYnifeYzZbJXsOclKPY6I59rPbMy3AE4_dzHxVVetxYt4U3NhqkQyMURh5TdnYYIqY6mHiLV4D0Ljv8x4W4gwAhiLI7HGqlAU6YlWleLvppo3T1LQs58IlxbM3mDo1chqegClSgymi74SgmnRtGGKc6Be0YdKSQEUY5dKaYKMkIcE5jtEQYGjuxPsUjHk8UhxiW3ZDIFaojBwASpjuiO1ATgBAGIBceWqZxOkgUECAQYAZIFBAgFGASgBi6AB-ns2WioB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G9gHAPIHBRC1p7YB0ggmCIDhgBAQARgdMgKqAjoJgECAgISAgIQISL39wTpYx8rEsNKrhAOaCR1odHRwczovL2RhY2lhLXdlYmVyLWhhbmF1LmRlL4AKA8gLAeINEwjq_MSw0quEAxV3v_0HHTZkB6jYEwrQFQGAFwGyFx8KHQgAEhRwdWItNTg4NTQ2Nzc2NjU0NjEwMhiO5pUB&sigh=6ZePPnRDHgc&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTwAvHhf_FrUnjehHIT7JrMpPGiCiLJWIkLypDJ6EuEr3gEde8Y_BC6lapzH8JPHktXLVIpeDK2Cm_cxR2q5YOAglfQIbVCfKAOOKEEq6LDkYAQ&template_id=419&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6063 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FE0E 398 B
225 B 46ms
45ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBikiIODAjAB&v=APEucNVeS4vr2-POs2_iS-R0a8F5gxMZuNj7nqUHxYMzN-pVH7gS5XkVsBBWpl0JXkH8-I6dBnOf7CG-XoCjuXffscT9ka2jjL1K1zrlESYEGZWzIoDNtfQ2Ib21XyHOjKAZOjpXRz3SSzWjkUP52LYkgWQ_dRRQjTLtTOjLnqngICsJxuld0NU

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:50 GMT
expires: Wed, 14 Feb 2024 20:13:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6063 93 KB
33 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:50 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6063 42 B
67 B 40ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DwFbHlmT8hkgD3_Y70Yv_H7lIkr9agzPlW1BQhjQxQIuN_DcEvGQw3b6iUFa0QjIdqldzOCjmPjf6qBkr4wXEQJFshzqlz7FbYJrDIamEvlycndr4

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adition.js Show response
imagesrv.adition.com/js/ Frame 6063 32 KB
8 KB 3394ms
221ms Script
application/javascript 217.79.188.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adition.js
Requested by: Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.10 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 83946dd9da911bc3e00743ceee62daf150a00c7b37e5a2213c63508f91ffc2db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:54 GMT
content-encoding: br
last-modified: Tue, 30 Jan 2024 13:44:43 GMT
etag: "1890444290-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 8414

GET
H2 200 js Show response
ad4.adfarm1.adition.com/ Frame 6063 3 KB
2 KB 57ms
15ms Script
application/x-javascript 217.79.188.46
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.adfarm1.adition.com/js?wp_id=5165308&kid=6342734&clickurl=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CVAJx_h7NZd_SEqf_9u8Pi6Oo-AfM3L7TdYrRgeuzEve3vs-IChABIM6niZ0BYJXikIKgB6AB9_fphCnIAQmpAiqsz0j59bE-qAMByAObBKoEiQJP0C3NHwSs_LSc8t6TTF6soCnPi-eGUtu2B2_jPOuODpbrJCu2XHd18bWR-JT1xsuxa0XfJWClQ_4zTOsH5C8B9P65TeSNEt_yAyX7SGUT9-fZ7aQNijAHVK1E1JhBomJi4hG97qEmaPAjSdepH75hcdza3aAFinZT1UnSJVUA4iHmVloPdl0xI9gQzaP6AFgwzj8veSQHW4oimLWb81PiP90yQHeQ5tHuHESJFY5qM7d6G-wTRUJ0-_ycaeYG1S7vEkW_aHNlznV5a5m1b82esVI_3gIrfrNhH9VLo_4cIpEPqE1J2Rmjf_hj7Vw3Whyg5UDHb-xuDXRIqWbHrEpeIZ9C95VjDLUdwATln5ebzATgBAOIBcifkYpOkAYBoAZNgAf3r7rkA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCCsIgOGAEBABGB0yB6qCgOCfgAE6CYBAgICEgICECEi9_cE6WP_JxLDSq4QDgAoDmAsByAsBgAwBqg0CREXiDRMI5_LEsNKrhAMVp7_9Bx2LEQp_sBPyouQW0BMA2BMNiBQG2BQB0BUB-BYBgBcB&ae=1&num=1&cid=CAQSTwAvHhf_nBxPswOeKVYeGuIlSMvZ4SGA47Lh30nJHvfNo0y8WAFiWy_XfdgNldondPVnNeMADXKL8E1ohKzD8cFZSQGEo6LREwc68S0ALqAYAQ&sig=AOD64_2ZhHDLw7RzUZUx9dj4_xKVU747yA&client=ca-pub-4572385462794337&dbm_c=AKAmf-CohccRiLksDOnP8uDg44C17uyC5ioj1NrL_zQ4vb4gc2fV4jeFdECsYKyvIOGhFFUWK2UTpPViAVCf06FF1KAy4GKV22ZJoNgivLvft9FOm6kQ1h9oCCSSoyNk6NfsIzT2_fRyaBntLlYIBiVLqrt8pFJvN9iPvSm8usOSVdXLRtsAT5g&cry=1&dbm_d=AKAmf-AI9oUyI5IFcofn7XeE9a4UENJBF5wSiNjMMnFhQQVFmQQODlgvWIvFGwnQ-qDi_Mg3vqzDfa4IiYBIv9hq7KvZPUMpWyUcXsv9tZudnJESHYdyIIEIWr2MIrglCm0AJlrUlq1NoRA1QcY1rKtG3v4zyW4jCYIngnb-DTyXWsn5AWbJJ10Wxz6e41bVu_SjCQqCjgnXuOn1EuCOT0V7xK4bWnsFDKr0HQqe_PBEF57OHRPMPlNa79IQaeYSq9xzjpDQrI75m0yiBGkYFxqn4vUtFNkxsqGXHuQbdqmL2mRDJN7kmq5K3BSCUH1LF0YT235egKSfl4IzL8Wc0mwKUG4VStQ7JyR23tALp4pwb4Ho-_CM0HVqf9SPT_JApi5pEoestuEJPROlagVejKoKCx1xrMnqY6g4GDcuAZpxQTzDtFWbWo-6pAYRn_fGJ44pyM8HZRXth1FwOzL6V7Nz4SW1LNTwGcUyriQMGf671H4pCYPl-HTOC9n-HOAysEN_hWyXFvjrLnn7QuisDrOsulrMW3hakCxyBfjho09dIUOtAXOKQrQ&adurl=
Requested by: Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.46 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad4.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 32ee494ad6b9a784c167dc344bf8ef3751ce8044c68655be5e6a0abccc4364ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 14 Feb 2024 21:13:50 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame 6063 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame 6063 20 KB
8 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:45:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30502
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:45:28 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6063 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1098
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame FE0E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESENiHTuAzqwoROI_fEt7D9Zo&google_cver=1

43 B
163 B

44ms
15ms

Image
image/gif

5.135.209.104
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESENiHTuAzqwoROI_fEt7D9Zo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBikiIODAjAB&v=APEucNVeS4vr2-POs2_iS-R0a8F5gxMZuNj7nqUHxYMzN-pVH7gS5XkVsBBWpl0JXkH8-I6dBnOf7CG-XoCjuXffscT9ka2jjL1K1zrlESYEGZWzIoDNtfQ2Ib21XyHOjKAZOjpXRz3SSzWjkUP52LYkgWQ_dRRQjTLtTOjLnqngICsJxuld0NU
Protocol: HTTP/1.1
Server: 5.135.209.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-5-135-209.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:50 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESENiHTuAzqwoROI_fEt7D9Zo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame FE0E 43 B
163 B 51ms
15ms Image
image/gif 5.135.209.104
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBikiIODAjAB&v=APEucNVeS4vr2-POs2_iS-R0a8F5gxMZuNj7nqUHxYMzN-pVH7gS5XkVsBBWpl0JXkH8-I6dBnOf7CG-XoCjuXffscT9ka2jjL1K1zrlESYEGZWzIoDNtfQ2Ib21XyHOjKAZOjpXRz3SSzWjkUP52LYkgWQ_dRRQjTLtTOjLnqngICsJxuld0NU
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 5.135.209.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-5-135-209.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:49 GMT
transfer-encoding: chunked
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6063 0
24 B 38ms
37ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9566526533665&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6063 0
24 B 37ms
37ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9566526533665&version=m202401290101&ct=77&x=1&cor=16184508396930607000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6063 34 KB
19 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DskMdSNaWfjPtrGRIJ5F8gGl9RDnEZS-5k5gN12DhCTGZB0lAEN0U-vf90vKeILKeY2hAO775BzBtbNWWXQLaw0PxaJhCDXO_yvlZt4Otv17uZA6rkyTH_WFHqvrCYp6FtTCSE25K8TqG6D3R8OK7EQcxQIlO3TrROv6g_p3COTkHsUic&cry=1&dbm_d=AKAmf-BjFSTLEweCIdodx95CrT1tkNaKYG1Kh_X8t79xG4a_6p6PNPR83hz_1eAZ8vTXIoZhHaTtRIxfL0jTKH6I8Paiq9AKB-IbC1uhUXT8g33z4JqAI2AnClfbrACdC0WlM8D0N-1FnAmEfuMDAFxALZ8g8T1Tt23Q8AYIpRYqSMdnHan0KWSHz_5yDjOKnHJz-GBtlowob21E_AM-z5j8YvgZBRvetQoe0fX3Uv6r_IKSLfsGExNB4xBVe8igjTI0DbjrPl0JNiRCtgB6iGaMfa3iRZsRBHCx0glrJOa0wrLcZ_pDDlIlXDkm6dKyVo8ninFhMLDXWkLlaLwVdep3g-7RZGdO089wP4tKk4km8c_5gN3ZvCqwDbiZLaxMx1lK4iGTPY9iUYfLIk3LgJab0vH8_nP4Gh65WknqHeOfLKs6LYBliN0iLSLB9WzKTl3-0z9NGg_q97OgYUe7CtvTLIz7RlEB2nQj8nATrGPUh-I2BVqAH6Njy73g2CcZ5TTlxo50qs3kHo52zzT-arRzwexE0iv-I4nhKtOjh5IUx5RxXN6pwgBRVCh2N78VpDOSDcdVJ03Jii4RZcuUYIelAYAAo2b78H5zM4AJe5zy29EVI4lH13BrA9S5uxmHb2NjRAWMXUn8CuOteJFTI6X3bwSlW8pGG6ghEeyL4YegETNt8Xtwxn2Ml2h3bk7sEYxaMWykmdT4EUQc-jz8s90DC4ESM06XC8zxOrIDDLtacYwZ9KjyoKbOmml4dyLrsYdeWlKhxaCIzlsrG9z4WLZChc78gFu6ZYOelbpnXZSON31AqOYbblvC1JuPQoR2uk0SVYh_vi58Pg9p6opAdYK4Pfoj7lFGZX46JzWJbCFNY86CEmmxNBz-uDeGzLxiODs2jZHCxIyGNcFRApBLbJlOOMLKmBPYetBrlPTwXTxOM3ZU8j_n2PgEfAizJxPdGmSuPx87fDYENY-PYO0X7ptgS2Ses6zZweQSGMRzyEoipyqUXjXRFKSLT0XO3vBjFQ0_usZemR2t4mtD3dn0T-sp8wZLhHAuFq9cNGNUNOBZtIbWaW7oxeEZTvYxCHvmBv30jfu7UCDgh6DLGeLWa5aJYIuhiJjmI7c2X1l3M5IKJbdbqXAGg0_gGW0YIzpCG8kBC0Y8OJRX1kUQ8YdlhnucOclIygQOBYfUK9cwWRVmkATiSlZaUafQnioNCjs5Pa0y_ebaWTWer15yMrQyAAe3LLZF_jEzWzv_dCysRezE2_b50AL6TL4KIwTjMT3gWSNMJWnC3-3gxwxQlo_fngYHJs6zjCq-HDgZnqw58VrgUdYtIAWIEeHhodSsr4e_eANJ_3eMl1-Dx5tUISQEPknzM74ZlqP7e4Q_rMtzrDGOvc6iQqEUF17BnHXUBPReWpvI0hF7UZ2QJxe9skynM84is3CqxWUZ2SNRWeEg_y6npkcKMQAAnYyRgBiI1TzoVMMn7uAHaIHb96SVaIFS2NEVTjdjWZJwZXJANA8keFeUfZMjQ7cyIjizhyO9aY2jrYcE-Oqj1cR2NinbJUoZ8QrZuzxOo2JbkihiZ4Fw9-z8TeTDEhl_JpDbY9w7dgvvZZaPhULa3m35agvc7OEtqRFyluAHAxt1ZMBG-n0S8yTt3DzXMk2cCUXfjcfjjXjbZS0_nnunsec01-7WQl2QXxkCW_KnJCZvtzBbfeO65qfBWqo7U2Y-8yddNxGj_2h0DjjiqpykXA2OgXBXQm2dXcK3B9MEVKDlGCxKWJjAKL8dnBlcmYRj4E-3CElkx00biMjp7XHAXpuEoSDWQqSS8KAxm8MIE9aEzZBwRgIWToZ78dIxRPgkz0N7xvpBUbVCc2Z6rFBM3wXZEvVxrfAKY3p1JX63QXeNMQ5NEY2L8Co7e3Cqipny8KDro78E41anJl7OjWPGOOoR38TKusf95OL3_YN9fKAArYKdqLNZ-PL9iZTG92orO1D67NokeBZHWtGl97i4hCrJzHKFKexCQ_I71BR5IZ1UWSb1jYF38ccXaE6lf1i7e3UrXuMB8F9UYyCxQaoxYXfkdA5PT9KsnjItzahpcXrXjUgR7RtbFrG4ts_xgLBgMa98T-3zYCx_xflHFdx3uU5H39En53XT3L8cQ1O4YX3oNPDCUyiuO8Nr8dCOvJdoCcwktlkdUVvE2cFNSmak8zm7AoAjloE2YBmnKQeqLxHw9Z0Mz0cI9IrMlr2zg3RRwEEz--42F6bjn4OlazjQacp1PoH1eTvetJIgPpiGkK_srz0S7RWzsIxvZa8Rl6Fx7l40uk7OK-fU96vFc21O__m8Q8AXwbZKJKXD0WvrayhLdzn9oiPcfKJX_7pEO6UTZBiFttRhcKr1TXECV7mbp9cJyTmg2aN-B7nBjVF7mU2owyXmb638F1p92Dd2FSt_9hog-9_Tf01k9ikH8fcID02iTB7eiCOyphd8BrS8G95JJS3DieKtEd6xsTlm88SeDKihZKslsu0Vj1C59GTFFFpYlb2B3yGb4W2qYI9MQW3xjl6dqfDUE7tJRKZPJXgKYRCVIPf9LjuBYM-8Dmfr1XQbis1SfDiRRn88NTfNW-_li7Nc02SwuCO5UDhcU7wArL8ByZ7oZKxqbCDE0QFlcAGAkZ8XxebEtora82OXlOpK2bmBuu2VnylaNLceQj2pjE_-7l-ZOedbE3dMD6GklPGCfPTapZRD244_5a2kQCIwZoP9ClttHWsaszXcmIS2s6iAdfUpql8oD1l0CHMCKmWSJR7KT8pu8KlwUZm4movZm3KE1otPZRqw68ExUwsFDqi_crlo3o93IZeOLHgvDV6nADYC61B0tIXlc1HzUceN65xu3hSPqkmRaFvxCe840rlR_dqcseV0g--jiidiRn7MixwrEVOmjPXlaZXxhaGrjI4MrIibVrRj-dFKKdg6_5N6NXpiaoTxbYRjDat4uhUgN1QU_GUjn8oo8EEmy24p-xJf6UXYs5d6pHDiVXMakzQdOmEHv38bwxDjz-nXmw5D1lVl4IxD4GYNnNIBDErLEfMA5gWDaTCBQ6JI9LYeEzmbZPFv0tCzVuTVqG_sY9GvSgNL1Lwgedkv6Ci72kixCEvsGr1bzUlY_cmnMsJJzpJ6UNUueDpqArZLkxIL-auNAlkpzNEkWjM1EtjXC1G8IRPcvfKmXQfnfsZPzKoc_SnYAkPb0NgBoWH_AjdfNgOer8MWOfOyTQB7SPlXh1IwTonD1cJ67J9QRhWXc5DgN7_TUGqT_T5qnkpTybufKRIWFxCEs3mfZVVzD_hJlbkRLB-2zGftq_vJQeYwa1EBavU1wfefyUtDAsOpz-Ndz9UntYghmOwnGtfunLTpkZLyIz-8_dE2haYecJzhATLISN5fF_FAHv5cRSaZKg2KM6QOlEv0gIo9qgKj8RDDVd3VsiEhyxhoku6l5MQqW2pYctTm9oRlNkLT7Jhw5AcfXTekt224Bdv_DKTviNG8-_3VhMAFJHfSNpAsjKk1-LvhgYch1OL-n6sOif-Iwr711YxICUvxCzG4u_SmoIzLZK2T78DWoUDMVEgxqyu7dUyRQSueZW9bO6yICimtPTmPCIKWrY878gdxKbPrpcRe1nmdXkXqU0MUiqOgB-EgpveljgvAzSzTsm5iu47wwltBQQeWgdGjiChAlZRKpUh1R5Qn5OMWCt21B7u7irqZ0vnDcXcjgA1LXbIhK4zSSwOTCoeKJFYClwLFxTG8Qr3XUNuD9BGrAD4Ru_lu_duvtNfgeWepM7HJa4fbcJMauEzgxptCW-Q_1SxavXoD_XVBbiv35PSU62mMbZupftEguGjY0d6DK39npDEkqIvfiDRvXNDbVcH1XCnTKMj_ZgM5Laff00F9roqkyRTOAEuZaCb3L4A3dqOPQg8HhdkbDwxBbrj489jLBD23L9DDJJDMSaSfgg&cid=CAQSTwAvHhf_nBxPswOeKVYeGuIlSMvZ4SGA47Lh30nJHvfNo0y8WAFiWy_XfdgNldondPVnNeMADXKL8E1ohKzD8cFZSQGEo6LREwc68S0ALqAYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=16184508396930607000&adk=3037181501&idt=52&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33541e0fe5d0e913b02df71737a00e0a1085e9cb3c480ea7c8355a7cfc4ce2f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19622
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame 6063 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DskMdSNaWfjPtrGRIJ5F8gGl9RDnEZS-5k5gN12DhCTGZB0lAEN0U-vf90vKeILKeY2hAO775BzBtbNWWXQLaw0PxaJhCDXO_yvlZt4Otv17uZA6rkyTH_WFHqvrCYp6FtTCSE25K8TqG6D3R8OK7EQcxQIlO3TrROv6g_p3COTkHsUic&cry=1&dbm_d=AKAmf-BjFSTLEweCIdodx95CrT1tkNaKYG1Kh_X8t79xG4a_6p6PNPR83hz_1eAZ8vTXIoZhHaTtRIxfL0jTKH6I8Paiq9AKB-IbC1uhUXT8g33z4JqAI2AnClfbrACdC0WlM8D0N-1FnAmEfuMDAFxALZ8g8T1Tt23Q8AYIpRYqSMdnHan0KWSHz_5yDjOKnHJz-GBtlowob21E_AM-z5j8YvgZBRvetQoe0fX3Uv6r_IKSLfsGExNB4xBVe8igjTI0DbjrPl0JNiRCtgB6iGaMfa3iRZsRBHCx0glrJOa0wrLcZ_pDDlIlXDkm6dKyVo8ninFhMLDXWkLlaLwVdep3g-7RZGdO089wP4tKk4km8c_5gN3ZvCqwDbiZLaxMx1lK4iGTPY9iUYfLIk3LgJab0vH8_nP4Gh65WknqHeOfLKs6LYBliN0iLSLB9WzKTl3-0z9NGg_q97OgYUe7CtvTLIz7RlEB2nQj8nATrGPUh-I2BVqAH6Njy73g2CcZ5TTlxo50qs3kHo52zzT-arRzwexE0iv-I4nhKtOjh5IUx5RxXN6pwgBRVCh2N78VpDOSDcdVJ03Jii4RZcuUYIelAYAAo2b78H5zM4AJe5zy29EVI4lH13BrA9S5uxmHb2NjRAWMXUn8CuOteJFTI6X3bwSlW8pGG6ghEeyL4YegETNt8Xtwxn2Ml2h3bk7sEYxaMWykmdT4EUQc-jz8s90DC4ESM06XC8zxOrIDDLtacYwZ9KjyoKbOmml4dyLrsYdeWlKhxaCIzlsrG9z4WLZChc78gFu6ZYOelbpnXZSON31AqOYbblvC1JuPQoR2uk0SVYh_vi58Pg9p6opAdYK4Pfoj7lFGZX46JzWJbCFNY86CEmmxNBz-uDeGzLxiODs2jZHCxIyGNcFRApBLbJlOOMLKmBPYetBrlPTwXTxOM3ZU8j_n2PgEfAizJxPdGmSuPx87fDYENY-PYO0X7ptgS2Ses6zZweQSGMRzyEoipyqUXjXRFKSLT0XO3vBjFQ0_usZemR2t4mtD3dn0T-sp8wZLhHAuFq9cNGNUNOBZtIbWaW7oxeEZTvYxCHvmBv30jfu7UCDgh6DLGeLWa5aJYIuhiJjmI7c2X1l3M5IKJbdbqXAGg0_gGW0YIzpCG8kBC0Y8OJRX1kUQ8YdlhnucOclIygQOBYfUK9cwWRVmkATiSlZaUafQnioNCjs5Pa0y_ebaWTWer15yMrQyAAe3LLZF_jEzWzv_dCysRezE2_b50AL6TL4KIwTjMT3gWSNMJWnC3-3gxwxQlo_fngYHJs6zjCq-HDgZnqw58VrgUdYtIAWIEeHhodSsr4e_eANJ_3eMl1-Dx5tUISQEPknzM74ZlqP7e4Q_rMtzrDGOvc6iQqEUF17BnHXUBPReWpvI0hF7UZ2QJxe9skynM84is3CqxWUZ2SNRWeEg_y6npkcKMQAAnYyRgBiI1TzoVMMn7uAHaIHb96SVaIFS2NEVTjdjWZJwZXJANA8keFeUfZMjQ7cyIjizhyO9aY2jrYcE-Oqj1cR2NinbJUoZ8QrZuzxOo2JbkihiZ4Fw9-z8TeTDEhl_JpDbY9w7dgvvZZaPhULa3m35agvc7OEtqRFyluAHAxt1ZMBG-n0S8yTt3DzXMk2cCUXfjcfjjXjbZS0_nnunsec01-7WQl2QXxkCW_KnJCZvtzBbfeO65qfBWqo7U2Y-8yddNxGj_2h0DjjiqpykXA2OgXBXQm2dXcK3B9MEVKDlGCxKWJjAKL8dnBlcmYRj4E-3CElkx00biMjp7XHAXpuEoSDWQqSS8KAxm8MIE9aEzZBwRgIWToZ78dIxRPgkz0N7xvpBUbVCc2Z6rFBM3wXZEvVxrfAKY3p1JX63QXeNMQ5NEY2L8Co7e3Cqipny8KDro78E41anJl7OjWPGOOoR38TKusf95OL3_YN9fKAArYKdqLNZ-PL9iZTG92orO1D67NokeBZHWtGl97i4hCrJzHKFKexCQ_I71BR5IZ1UWSb1jYF38ccXaE6lf1i7e3UrXuMB8F9UYyCxQaoxYXfkdA5PT9KsnjItzahpcXrXjUgR7RtbFrG4ts_xgLBgMa98T-3zYCx_xflHFdx3uU5H39En53XT3L8cQ1O4YX3oNPDCUyiuO8Nr8dCOvJdoCcwktlkdUVvE2cFNSmak8zm7AoAjloE2YBmnKQeqLxHw9Z0Mz0cI9IrMlr2zg3RRwEEz--42F6bjn4OlazjQacp1PoH1eTvetJIgPpiGkK_srz0S7RWzsIxvZa8Rl6Fx7l40uk7OK-fU96vFc21O__m8Q8AXwbZKJKXD0WvrayhLdzn9oiPcfKJX_7pEO6UTZBiFttRhcKr1TXECV7mbp9cJyTmg2aN-B7nBjVF7mU2owyXmb638F1p92Dd2FSt_9hog-9_Tf01k9ikH8fcID02iTB7eiCOyphd8BrS8G95JJS3DieKtEd6xsTlm88SeDKihZKslsu0Vj1C59GTFFFpYlb2B3yGb4W2qYI9MQW3xjl6dqfDUE7tJRKZPJXgKYRCVIPf9LjuBYM-8Dmfr1XQbis1SfDiRRn88NTfNW-_li7Nc02SwuCO5UDhcU7wArL8ByZ7oZKxqbCDE0QFlcAGAkZ8XxebEtora82OXlOpK2bmBuu2VnylaNLceQj2pjE_-7l-ZOedbE3dMD6GklPGCfPTapZRD244_5a2kQCIwZoP9ClttHWsaszXcmIS2s6iAdfUpql8oD1l0CHMCKmWSJR7KT8pu8KlwUZm4movZm3KE1otPZRqw68ExUwsFDqi_crlo3o93IZeOLHgvDV6nADYC61B0tIXlc1HzUceN65xu3hSPqkmRaFvxCe840rlR_dqcseV0g--jiidiRn7MixwrEVOmjPXlaZXxhaGrjI4MrIibVrRj-dFKKdg6_5N6NXpiaoTxbYRjDat4uhUgN1QU_GUjn8oo8EEmy24p-xJf6UXYs5d6pHDiVXMakzQdOmEHv38bwxDjz-nXmw5D1lVl4IxD4GYNnNIBDErLEfMA5gWDaTCBQ6JI9LYeEzmbZPFv0tCzVuTVqG_sY9GvSgNL1Lwgedkv6Ci72kixCEvsGr1bzUlY_cmnMsJJzpJ6UNUueDpqArZLkxIL-auNAlkpzNEkWjM1EtjXC1G8IRPcvfKmXQfnfsZPzKoc_SnYAkPb0NgBoWH_AjdfNgOer8MWOfOyTQB7SPlXh1IwTonD1cJ67J9QRhWXc5DgN7_TUGqT_T5qnkpTybufKRIWFxCEs3mfZVVzD_hJlbkRLB-2zGftq_vJQeYwa1EBavU1wfefyUtDAsOpz-Ndz9UntYghmOwnGtfunLTpkZLyIz-8_dE2haYecJzhATLISN5fF_FAHv5cRSaZKg2KM6QOlEv0gIo9qgKj8RDDVd3VsiEhyxhoku6l5MQqW2pYctTm9oRlNkLT7Jhw5AcfXTekt224Bdv_DKTviNG8-_3VhMAFJHfSNpAsjKk1-LvhgYch1OL-n6sOif-Iwr711YxICUvxCzG4u_SmoIzLZK2T78DWoUDMVEgxqyu7dUyRQSueZW9bO6yICimtPTmPCIKWrY878gdxKbPrpcRe1nmdXkXqU0MUiqOgB-EgpveljgvAzSzTsm5iu47wwltBQQeWgdGjiChAlZRKpUh1R5Qn5OMWCt21B7u7irqZ0vnDcXcjgA1LXbIhK4zSSwOTCoeKJFYClwLFxTG8Qr3XUNuD9BGrAD4Ru_lu_duvtNfgeWepM7HJa4fbcJMauEzgxptCW-Q_1SxavXoD_XVBbiv35PSU62mMbZupftEguGjY0d6DK39npDEkqIvfiDRvXNDbVcH1XCnTKMj_ZgM5Laff00F9roqkyRTOAEuZaCb3L4A3dqOPQg8HhdkbDwxBbrj489jLBD23L9DDJJDMSaSfgg&cid=CAQSTwAvHhf_nBxPswOeKVYeGuIlSMvZ4SGA47Lh30nJHvfNo0y8WAFiWy_XfdgNldondPVnNeMADXKL8E1ohKzD8cFZSQGEo6LREwc68S0ALqAYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=16184508396930607000&adk=3037181501&idt=52&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:30:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74596
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:30:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6063 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126366
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNzk0MTYzMDc5MzE5OQogIHNlcnZlcl9pcDogMTM0MDU2NTg4CiAgcHJvY2Vzc19pZDogMjcxODM4ODkwNgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMjYyNDc1...
ad.doubleclick.net/ddm/activity/ Frame 6063 0
22 B 43ms
42ms Image
image/png 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNzk0MTYzMDc5MzE5OQogIHNlcnZlcl9pcDogMTM0MDU2NTg4CiAgcHJvY2Vzc19pZDogMjcxODM4ODkwNgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMjYyNDc1MgphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vZml0bmVzc2ZpcnN0LmRlIgp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDI4NTUxNzQyNzQ2MDM1ODQyMDgKZGVidWdfa2V5OiA3MDc4NjI5NzA4MDI5MTI0NzY5CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNC0wMi0xNCIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDEyNjI0NzUyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzg1NDYwNDk3CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMDk3ODEwMTUzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIwOTU5MjE5NjU2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNTQzMjEyNTgwCiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2ZpdG5lc3NmaXJzdC5kZSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMi5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQKZG1hX3Byb2R1Y3RfaWQ6IDEyMjcxNTgzNwo

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x5bac248cc2b1e1320000000000000000","13":"0x2cf06bf950ec7ec20000000000000000","14":"0x1264cf5b7bb9bb390000000000000000","15":"0x9d118c843d66e0b30000000000000000"},"debug_key":"7078629708029124769","debug_reporting":true,"destination":"https://fitnessfirst.de","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["12624752"]},"priority":"0","source_event_id":"2855174274603584208"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8AA9 38 KB
13 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8AA9 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8298
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AA9 0
24 B 43ms
41ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BF8PS_h7NZe-0MIyV9u8PqqWdkAoAAAAAOAHgBAI&bg=!kJOlk9zNAAaxkZ3akZE7ADQBe5WfOKoEFp1DnCCMB_UDZutY11UhmezM6MR4UO9FJ9bRui6PaTYQi4OnxSDlvxvhDeiRAgAAAChSAAAAAWgBB5kDF3unub_KOQfRfp_0e4Lo7QbVBOWDnMg2C7_taey3WVz0oa4r-CXp3gOr9GRRN8dZvVzGstCdJLughjgBIGwEUY72BUW4XJjfCBVW71E5MhNEOCpHLwk33IIthYuvontLy7Lk99p6cvpEtaQnMOPiXdmxBquc_k_Nef7NWn3-G2Fff-xfFOOURfGpHAXd2kOvcWCxKFV71wT8EjGJOYi_FC8cTxf1ibPd5WUWYFU8znbL54EjMxDkLLoQ3XUQWxmzMhHYpshH5YFGGO7OkqrUGNDE2UKMbIQZL_Uczm5vxdbRMgs4cHfkcS4QWxEFVSuUZnYGjDwdgonsBB7KVyRdjfIJtPtUXq3WCc9A9IcgdXoK1Tky9LAFJtVKhvyVJw8zg7u_jm4v1sMLokJTMYQK5DrYFFpu7f8q0JoQKPEFqfRowkpDbwV4nifQbQVQq3a7RnXluXGNYcqTu1-3JEAiQagFkj0cxaqMFMEynTCDKOn7tLaL0umNugzwMjrE5WHETzG-r6Jjj0i3PhnZUpKB07YPuGO0kZIlN1x6ULL0Jp6ks8FNTn6k2Nvl3QdCJ1E-4f22GFXVM2JPXibZDubd-DBWKA3NFKhPgYSjsz-HgtduMeYwKhfG9YCqQHkJsCG8tvqC5nuAqfNP3ON_H56ySyc06lHbSNn3h1JmInOfLpyNxL7dove81wFqiP_fb4FeaB_DF5e9ltdEuy5A_gPMX2cru14UNQQrA3sUWimtTj0V-PROAkzxII9aC30uMlrAo3ZKEADu7tRjmjmcYUzUAgJ66_Rlzd4TV_w_VvSfgKw8IANANc5a9DIg0Vh3hLHndwlBwQ8Wrs7S0v7BxmkIIDWlGWw8t2Ljn-Vx-AgzrisaYV3vgC3bC5YTuw_xCv0JTZFPn-4fUmJFdzTq4ynbSwMSq3VJ9NfZDJkfrVY5PeIAl4v8EKNkPgsGNb8MbsT-onZcvoXQ-_XZfn3_eEjAu4SL0G1Bmae1AhYXLbrrrKhkk2LWjA4EdhBvrOZAMPxhOrLx3JZhi2BejvpF2fB6R1pM17HRThUO

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C69B 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AAC5 0
21 B 45ms
44ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM_cnJQCEOXw25gCGKbCx4cCMAE&v=APEucNW1LL5pMrkf97l1W6_S3w5BGUKricSCx1MYie4EuqTSXFD1L1bJpdoIMLBgZgVzEx1IsFgeuKmqfQVFXDefYY_xFV5AeQMjP3PAH55PLhRYUT1cjrPr0FIOr3C_LMlOcqn_wRuSHXmWp9nDTUlKbANH2vdRjbQaszvADExH2A3yQN-6RSY

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:51 GMT
expires: Wed, 14 Feb 2024 20:13:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C69B 93 KB
33 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C69B 42 B
68 B 39ms
38ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CB5kqhZY8ggMCG1kDFpynQn-3ivf_BtnRd9ED7vjUu7IXSo_Z1e7xVCyBP-H0QK0Cmgnuy6R_OfsnbHkBe_dZsXz-zV9YyvDnb82kI5WP-P_2S-q8

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame C69B 43 B
1 KB 122ms
29ms Image
image/gif 213.202.235.8
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=300&extProvApi=roller-dv360&extPu=ROM&extLi=44879321&extCr=552722726&rnd=1707941630672469

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.8 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Wed, 14 Feb 2024 20:13:51 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mi, 14 Feb 2024 08:13:51 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 713
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame C69B 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame C69B 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:45:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30503
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:45:28 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame C69B 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame B258 42 B
69 B 41ms
41ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkxtmHIvv7u1ajQyqM6UT80e0_ckhnowLR_xxHp4OfmNnB0sbHuPln0SbPVHw14ty7d4OfrRaqThRyBrYSY7Y8IB4Ayf5HQM7IzFZAIRPvJhB7v37sI_O5NoeMPYV7WPVGQYnGbqeOq6k8Bt9gbrPeGjuGTz2oJvpsKQ&sai=AMfl-YQd3iXRWalRubP5DC_eYcBEqZ3NCa7h7zlnRr8Q6OjiscgNx4InoFYDBYH8pLYTi-_AyTgS6QQODjF3-EMA_Vj7c_76XhrM6kPdtomU5fulWr8A6x4EXJTrKz7AuDcH5BjCN_feAVkY0aOOFkLo&sig=Cg0ArKJSzHAW398MmtPVEAE&cid=CAQSTgAvHhf_zd8s4ejyK-y9U2AJMeviqWQL-fN3s9g2ClSKoWcyLXc9Qd54frtReqxDTvuwUFE5Ho9LBbaTv7GfG8ORZrVOeLkYwEx8elGTjhgB&id=ampim&o=632,107&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=237&tls=1237&g=100&h=100&tt=1238&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C69B 0
25 B 37ms
37ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4897109337254&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C69B 0
25 B 38ms
38ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4897109337254&version=m202401290101&ct=119&x=1&cor=4888376872528543000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C69B 90 KB
38 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DPQHd705cfCrchGyy5jhpHwTDbz86bYXloXB20mQtGcpFObP-4w2SiTsRh8IuvNSbi4Ji-PYb_GIEN_B8aCT59lRPmAKo4WdGsTCB1P3w4ZwZ-EtALGek8UhgYvkQVaQv3rWCpWwTYN2bjnz7KP69fjBdehkEMy1t25p6G6lP4khfqeV0uGlWl9aU6t7-SLtlcRKM3&cry=1&dbm_d=AKAmf-AjZ5y5sKZtI5ZJGiSk8RdYEoUamPWK6naXzfF1mCJ4awLJKb86EnpmB-TgKptZyKSNpeeG53Zj7tmaUEmalibv5bu3dEbwU2jebbXUO3-J442o30q7VClfqLoN7CtXhyw4iGiFha_z-N7n5FCUMBTWayqg_SS4jiq-64gFeP9fE6BryZUeFVkTccGuAH4E2jBwbQFAwkT-pWBciXjoZblTo9v1vf65SUGTSFM4xh3-L-dsho3K0CoP0Qvh-SbPHaJR-xDLfs8Pde1k4lnulxtYOo-Rqx6Yj_-6rT-k1X2dEUXQ9L_AKEm6RKoJcjLEOrsxfQ2q3JMHo2jzJ-pRnbYRwZNnd_11znfYo-yDIGnsAyS5_Mv4NK_m_kSISovRDAxDFvvw4_Nq14_FR2dIXJ9AQG_C8owXyJ8WCEagLXRkRQNHpUE7gOU2p-ix8CzRFv6X6xFYCwigve9ltMplRAue-FBvVMhGupUTft81lHIhPihR0OUh2xNvOppgmkE8cV0FBx62bFG7cn0x5cje_niyO37Z6CbOlqpLctMpw-voAKzJObHHFZMi4dwbpUa8poddlFUH8n5Oo_l1WC4kKFHCHL0SDApCRl9AdmqtNidAzIKShrHmeCp9QNFwZC89I3uwhk5Cj5Z1_vFzTtLZG3UspEmdXYD-dsWy45-ysbGnIuFK9blPFjQ_qPfoQ5kC6796Gnml5HWniwdI62b2H8yN_FRm5V7ACGTLVpCHAIr5FJSwSPUhUKfJYY3_u9jn7kSosDey_R6OH-MgfyS9Gid9URwJvisykah5G6N7bgw8x_rZLAMiephZlugHifsLYAXQYzDc6tnKLxC9Dc1U5Mli6hnqrQhJGJ9MWRf5Fsr4d58690fUcm3KpBW7ZFp_AyJsS9UklODOC9qiAgPpqzKI1oRypCv8AevnzdnJoym7mmIgRUrn_geNd_izNIxcuq6Qk6awcXPuRw_O4P2DONSMC5orGVe1DV9yHojoqCUl2xHgPgTQlYsKMSpuSvtsqo8P9BV-6xbjOKT-bSW3KIB-OuehwlzAlUkkqL6pbgWc2rr2pcVvwwKQ94n-AVtkTEacKbcqY5QaJpu0uc-PKDhI82KntdZc6m-ALDke0MMlCOZ4OGxG3vlnMfSAx3RNl-3O6c5ZW-6T_P4kkygixyGF_pz_zTr9JzC-aLSNHf_7SmgCdwx2-6jSrvXhyzX38qgnjEmD3QFTLCGnDCT1imIsBUo0OSPMB3uURynR4YsQgPIAtdqvmRffiRVhONchNzi8WVnwLX3XMywIYDNLD3k-SJK5ioHqsFYDBlwTYZ25qdq_4ywLpdwOkAWule17PBUObK2Qk56sklgBEp7QzrlGwQ-CC4Gz9jdfVF3_ThW4Ra7shpYg8I2LQVntMnxu-0IoLDgCaDzx6UCGRZ53kCELELBlmAiwNbtkGX0rai8eMaWsOacV1PIYgYvcJy2hHT9Za5vsAp4I5cSv4jMT7VBcan4dunAxAn7RV18iX6ayRi5h38SNDXv_bEP0ktollBRgBYoTqzoVvUq-TglNeqzAE377VQ-_X3TvlV0oWhyW3lw12c4Yy7XkvIOeRR1z-VEQcLFOiHAKqlG9XL2MlVv4xAQeJHP04egnVRGb90eNVIv68i28vbB3BIKzsq0Gj6MchU6I3E0I-_Wh33DKTttEGudRvsxKM-xPiTSDRJ_fPO-73gGqb9d66oh4nmLBS1RKpKVOOIvynDNrKEyU6LwLDkJUNtZsiU84L3KB8TbllwQykL9Jbe_oYZjr-_EUIjn-sjmW1ZCCMtcdh75Y2YXw0dvT78VIuE-kc45BzDkq0Gu7shDBX_2hu8aLhv7uE_UbZNflvjSf37f7zmkAt1mPgmgGBjvZyIHCQTwNYOxhdn0j9j0fcavVisI5l5yjlhC6K8mP8k9C0LQvJJBQjZh0veZ-LeA3-5tLrV2o3zKS7z2_d0Xa6qO4S1OC2qNSmfYAnXiUMIhcz7JrNePWy491rHAvAn_XK_VVJ1ZxbXPi7UOTx7S-McJnqjloltjyawWvLIn6e1FpXKrczEMFXv5sO-KE__5HgnqVveuWjHzF-DMGYVWwjT9v67KCf7qZf3eCp2iX2U61tYWMW3cmxcRpeu3M_dTMEJVIlDZ3Zd9UHBkX0YG3OetCrlVwQhWEIbfQID12DrIiN3_FkZUpRZj2dktEOFGd7nE-qNueMf9Vo_q1Ls2dTV7oggk6_ADvWDczdJnEpeD07xMwRsniKt_b9iqggS-417_G_t0oBxrMtaFckL_SCIiosmMgcR3j7NYSUF3AwKGHe8oHa5E8GNpq_3aKDtrW500hEf5shnNdVO56ycKIOsrVTErSdzWQL7O94aVCeoCvALLVLN4HoafH7ZQhiww5pNa2xnbpnlvTbpNrlY1fLY0ROyNSTkkPPjK1IooPr_ulwiw4o8G7BO6R--zepQGVag0xWORYKyGuv9HQ8piboX7v0QAa4FMcHHG9Nmyf8-wl2fE9cMxz9r-_PZOnCOXdd-OweN1qIOtY_bunE3qtdaPyFFQ81TEH9BGpH5el3SRFARUeLbNpBMK2KrLclNJKEb42lRom9r6S3Kr5h5ai9BFHyKb8VCamN0ytGer7K8tZKkp3xaUeOeYDbMEjn4a07woB8Kfe2o7e3tpK6N3xUT_jSnNHL0PWp4P63K6XfobMWYo0YbFt1wknLFKjXc0RRAlDQ_G5Kks_Gl-I3_1tUsWdmYLOdbOmz93oq3eqTGDkYE-HtZO7XBUBe8K26NlyN_QHOV8XE1nDWlovyRtJ5Jey18S-i1zrcAZOu9f_aqAnPr4fU-yLTBmT6zfmdZ-J0zXl_8i_izq_ksh_pqxMqkivvsB2dsvBgfstrzgLA37i67mFO34WNBj3OynJKSVz8mVR8ocnTxxOgbOnEBTZs8DWlRVWWp7_ZLn4lItvc1A64s2Sh5whI5XfxfQYlBkO9BmLidCFlGsofA72Oh7B-jIsWClXCJDzXxrD-aZvK2GmH8fUL5tbAYXFGYo5DsbQJKIPDQFPXo_g7VuEWLUWpPiAa_FIBHKU4LOwDIMpDmTbQ8Ncv8T0fVLRf_oJr_EI6vR50Q6hpuFaEflG1gM4ZE7ACYRJSxDjdm90GR-fmmPy9Gh4KOB_UQ8IRms4psa7GSoU0bBLTcFOWqGrWQpM0M2jJU-ki1mJPVIcgb0EQcJKD2jjQkwJY1P0kz4dHygnb8tZz_qFzMFVLvamIX0zINUVHCh8nUXZNkyr5AvLCpGeW_2j52a6FdBqbRNL5eCBDx3WhVxrXK9vHI2Q2Vznqw2CRt2RwNId4V6Ohd4RuPhmmaAz9MZRltTWfcCGvm5EmJJNWENLRg4fsqGNAaMANEV--sE2EFJp-euwOn8oRNaW6MNO0ZfJPRxTYYjnPhKMcSMKjwNLBsR2g_a60Y6X-_NXrryPZ9EB27bc5qip1GaQHc0y68rvM9ebfZULc6vj89oyGvanQoCWhB9wOXzhh_2JKLMB5oZ-gu3RP3z6pk9yikdlfX1SWNgeqpsCH47NlGgAJWce6lcWkfkCVaQPDUNWxbCXhHgMcKcpIaiWkFrsHD1JE_9QMj2sKiPpf_WQNtAiF6l8BPXFM0jRSmHmfTfOgBILN9Y0g7s67TuTDRXChFx_9eKrChvEiq9IbV7HHbD0wHkexyLqliDRhAqJP-WZAY2fYeAd1_EJNUc7UvDoRRtT0yiGq02gtTfWjlAO3YpAJPbKL2zraUWtE3Ezwa_SXe9_h-8CJq2Q5M9trqwAVhLAKQc5OXxavURilxQihUNg75omkR7ck3qOpi3Y0z3zKc9o1V1pjOzHHyswuQympITokAZS1fZGvD4utDo4G83mO7Ae23qOdXgE25pOwwBymdgPXEkKCm6aFHEnsFps_JB4vVGCyjoEkRFU8fMDAtVfqp4xsIEgFaqo9oQxygXjthdYikgRPWtZ933RbWp7EOJ26Sca1ZUB_AEz4g&cid=CAQSTgAvHhf_MX8K3dutS5G_kMUEtiJGcTsSssTdYHwC9YpR1EsfAJYgWwcYJWXeb8TlBBwICEarwHAb0QYIqsXX4Q5kCDjFoQ7b5kyAi8tJaBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=4888376872528543000&adk=2004672171&idt=51&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e124d2a14c313799b8c6e9fd95e72801afb3fcf29d6486d4bdd7a1cb8636c38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38740
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame C69B 111 KB
39 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10743
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame C69B 12 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DPQHd705cfCrchGyy5jhpHwTDbz86bYXloXB20mQtGcpFObP-4w2SiTsRh8IuvNSbi4Ji-PYb_GIEN_B8aCT59lRPmAKo4WdGsTCB1P3w4ZwZ-EtALGek8UhgYvkQVaQv3rWCpWwTYN2bjnz7KP69fjBdehkEMy1t25p6G6lP4khfqeV0uGlWl9aU6t7-SLtlcRKM3&cry=1&dbm_d=AKAmf-AjZ5y5sKZtI5ZJGiSk8RdYEoUamPWK6naXzfF1mCJ4awLJKb86EnpmB-TgKptZyKSNpeeG53Zj7tmaUEmalibv5bu3dEbwU2jebbXUO3-J442o30q7VClfqLoN7CtXhyw4iGiFha_z-N7n5FCUMBTWayqg_SS4jiq-64gFeP9fE6BryZUeFVkTccGuAH4E2jBwbQFAwkT-pWBciXjoZblTo9v1vf65SUGTSFM4xh3-L-dsho3K0CoP0Qvh-SbPHaJR-xDLfs8Pde1k4lnulxtYOo-Rqx6Yj_-6rT-k1X2dEUXQ9L_AKEm6RKoJcjLEOrsxfQ2q3JMHo2jzJ-pRnbYRwZNnd_11znfYo-yDIGnsAyS5_Mv4NK_m_kSISovRDAxDFvvw4_Nq14_FR2dIXJ9AQG_C8owXyJ8WCEagLXRkRQNHpUE7gOU2p-ix8CzRFv6X6xFYCwigve9ltMplRAue-FBvVMhGupUTft81lHIhPihR0OUh2xNvOppgmkE8cV0FBx62bFG7cn0x5cje_niyO37Z6CbOlqpLctMpw-voAKzJObHHFZMi4dwbpUa8poddlFUH8n5Oo_l1WC4kKFHCHL0SDApCRl9AdmqtNidAzIKShrHmeCp9QNFwZC89I3uwhk5Cj5Z1_vFzTtLZG3UspEmdXYD-dsWy45-ysbGnIuFK9blPFjQ_qPfoQ5kC6796Gnml5HWniwdI62b2H8yN_FRm5V7ACGTLVpCHAIr5FJSwSPUhUKfJYY3_u9jn7kSosDey_R6OH-MgfyS9Gid9URwJvisykah5G6N7bgw8x_rZLAMiephZlugHifsLYAXQYzDc6tnKLxC9Dc1U5Mli6hnqrQhJGJ9MWRf5Fsr4d58690fUcm3KpBW7ZFp_AyJsS9UklODOC9qiAgPpqzKI1oRypCv8AevnzdnJoym7mmIgRUrn_geNd_izNIxcuq6Qk6awcXPuRw_O4P2DONSMC5orGVe1DV9yHojoqCUl2xHgPgTQlYsKMSpuSvtsqo8P9BV-6xbjOKT-bSW3KIB-OuehwlzAlUkkqL6pbgWc2rr2pcVvwwKQ94n-AVtkTEacKbcqY5QaJpu0uc-PKDhI82KntdZc6m-ALDke0MMlCOZ4OGxG3vlnMfSAx3RNl-3O6c5ZW-6T_P4kkygixyGF_pz_zTr9JzC-aLSNHf_7SmgCdwx2-6jSrvXhyzX38qgnjEmD3QFTLCGnDCT1imIsBUo0OSPMB3uURynR4YsQgPIAtdqvmRffiRVhONchNzi8WVnwLX3XMywIYDNLD3k-SJK5ioHqsFYDBlwTYZ25qdq_4ywLpdwOkAWule17PBUObK2Qk56sklgBEp7QzrlGwQ-CC4Gz9jdfVF3_ThW4Ra7shpYg8I2LQVntMnxu-0IoLDgCaDzx6UCGRZ53kCELELBlmAiwNbtkGX0rai8eMaWsOacV1PIYgYvcJy2hHT9Za5vsAp4I5cSv4jMT7VBcan4dunAxAn7RV18iX6ayRi5h38SNDXv_bEP0ktollBRgBYoTqzoVvUq-TglNeqzAE377VQ-_X3TvlV0oWhyW3lw12c4Yy7XkvIOeRR1z-VEQcLFOiHAKqlG9XL2MlVv4xAQeJHP04egnVRGb90eNVIv68i28vbB3BIKzsq0Gj6MchU6I3E0I-_Wh33DKTttEGudRvsxKM-xPiTSDRJ_fPO-73gGqb9d66oh4nmLBS1RKpKVOOIvynDNrKEyU6LwLDkJUNtZsiU84L3KB8TbllwQykL9Jbe_oYZjr-_EUIjn-sjmW1ZCCMtcdh75Y2YXw0dvT78VIuE-kc45BzDkq0Gu7shDBX_2hu8aLhv7uE_UbZNflvjSf37f7zmkAt1mPgmgGBjvZyIHCQTwNYOxhdn0j9j0fcavVisI5l5yjlhC6K8mP8k9C0LQvJJBQjZh0veZ-LeA3-5tLrV2o3zKS7z2_d0Xa6qO4S1OC2qNSmfYAnXiUMIhcz7JrNePWy491rHAvAn_XK_VVJ1ZxbXPi7UOTx7S-McJnqjloltjyawWvLIn6e1FpXKrczEMFXv5sO-KE__5HgnqVveuWjHzF-DMGYVWwjT9v67KCf7qZf3eCp2iX2U61tYWMW3cmxcRpeu3M_dTMEJVIlDZ3Zd9UHBkX0YG3OetCrlVwQhWEIbfQID12DrIiN3_FkZUpRZj2dktEOFGd7nE-qNueMf9Vo_q1Ls2dTV7oggk6_ADvWDczdJnEpeD07xMwRsniKt_b9iqggS-417_G_t0oBxrMtaFckL_SCIiosmMgcR3j7NYSUF3AwKGHe8oHa5E8GNpq_3aKDtrW500hEf5shnNdVO56ycKIOsrVTErSdzWQL7O94aVCeoCvALLVLN4HoafH7ZQhiww5pNa2xnbpnlvTbpNrlY1fLY0ROyNSTkkPPjK1IooPr_ulwiw4o8G7BO6R--zepQGVag0xWORYKyGuv9HQ8piboX7v0QAa4FMcHHG9Nmyf8-wl2fE9cMxz9r-_PZOnCOXdd-OweN1qIOtY_bunE3qtdaPyFFQ81TEH9BGpH5el3SRFARUeLbNpBMK2KrLclNJKEb42lRom9r6S3Kr5h5ai9BFHyKb8VCamN0ytGer7K8tZKkp3xaUeOeYDbMEjn4a07woB8Kfe2o7e3tpK6N3xUT_jSnNHL0PWp4P63K6XfobMWYo0YbFt1wknLFKjXc0RRAlDQ_G5Kks_Gl-I3_1tUsWdmYLOdbOmz93oq3eqTGDkYE-HtZO7XBUBe8K26NlyN_QHOV8XE1nDWlovyRtJ5Jey18S-i1zrcAZOu9f_aqAnPr4fU-yLTBmT6zfmdZ-J0zXl_8i_izq_ksh_pqxMqkivvsB2dsvBgfstrzgLA37i67mFO34WNBj3OynJKSVz8mVR8ocnTxxOgbOnEBTZs8DWlRVWWp7_ZLn4lItvc1A64s2Sh5whI5XfxfQYlBkO9BmLidCFlGsofA72Oh7B-jIsWClXCJDzXxrD-aZvK2GmH8fUL5tbAYXFGYo5DsbQJKIPDQFPXo_g7VuEWLUWpPiAa_FIBHKU4LOwDIMpDmTbQ8Ncv8T0fVLRf_oJr_EI6vR50Q6hpuFaEflG1gM4ZE7ACYRJSxDjdm90GR-fmmPy9Gh4KOB_UQ8IRms4psa7GSoU0bBLTcFOWqGrWQpM0M2jJU-ki1mJPVIcgb0EQcJKD2jjQkwJY1P0kz4dHygnb8tZz_qFzMFVLvamIX0zINUVHCh8nUXZNkyr5AvLCpGeW_2j52a6FdBqbRNL5eCBDx3WhVxrXK9vHI2Q2Vznqw2CRt2RwNId4V6Ohd4RuPhmmaAz9MZRltTWfcCGvm5EmJJNWENLRg4fsqGNAaMANEV--sE2EFJp-euwOn8oRNaW6MNO0ZfJPRxTYYjnPhKMcSMKjwNLBsR2g_a60Y6X-_NXrryPZ9EB27bc5qip1GaQHc0y68rvM9ebfZULc6vj89oyGvanQoCWhB9wOXzhh_2JKLMB5oZ-gu3RP3z6pk9yikdlfX1SWNgeqpsCH47NlGgAJWce6lcWkfkCVaQPDUNWxbCXhHgMcKcpIaiWkFrsHD1JE_9QMj2sKiPpf_WQNtAiF6l8BPXFM0jRSmHmfTfOgBILN9Y0g7s67TuTDRXChFx_9eKrChvEiq9IbV7HHbD0wHkexyLqliDRhAqJP-WZAY2fYeAd1_EJNUc7UvDoRRtT0yiGq02gtTfWjlAO3YpAJPbKL2zraUWtE3Ezwa_SXe9_h-8CJq2Q5M9trqwAVhLAKQc5OXxavURilxQihUNg75omkR7ck3qOpi3Y0z3zKc9o1V1pjOzHHyswuQympITokAZS1fZGvD4utDo4G83mO7Ae23qOdXgE25pOwwBymdgPXEkKCm6aFHEnsFps_JB4vVGCyjoEkRFU8fMDAtVfqp4xsIEgFaqo9oQxygXjthdYikgRPWtZ933RbWp7EOJ26Sca1ZUB_AEz4g&cid=CAQSTgAvHhf_MX8K3dutS5G_kMUEtiJGcTsSssTdYHwC9YpR1EsfAJYgWwcYJWXeb8TlBBwICEarwHAb0QYIqsXX4Q5kCDjFoQ7b5kyAi8tJaBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=4888376872528543000&adk=2004672171&idt=51&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:37:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame C69B 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:30:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74597
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:30:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame C69B 41 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126367
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
DATA 200
OK truncated
/ Frame C69B 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6a3ff8500d1e30d7b38deb90196c05736c61f329a20c98f0c7b85e2c8db067e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 18B9 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126192
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4769131828568643930/ Frame CD65 8 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1494cb6896c9322d25bf02f6a2ff597661556cafd22b974cd853488dc0cb935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 91877
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2864
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 18:42:34 GMT
expires: Wed, 12 Feb 2025 18:42:34 GMT
last-modified: Fri, 09 Feb 2024 14:39:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C69B 0
0 49ms
48ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsulsYzw00z6IsuEN2RleG9VWa8B9dm8Nn71klJa4Cj41Djz8gsReEiuluklZWjWcnN1y2siVFyESHlPmZYuMPgxp-u0-2uz7M2hTVoG7ALxR1A4SidQfic1FtNPgskZ3V6P5puFPq8_8wIutDdgp_Ap_EYcMif9DeTMhTho0FPtIfMi8Om-3swKv329yRFgbT0tiGnNNLJNMXbiMoeHhbXegGzwai7W7KEfnwZ344EZDEmJzrOdp2xzSUYlkcNm5-qN95HsAbVfKUISHLNnXrB--q7C3Ny0h4BRalprtNAtXvg1KsYnhhQjRTpu4Jve4XYE1cxEl-K3yKmdzXQMDHWfR6gUc0l5zMx849dT-0pntxajIp4CJRYyl_59VQZmmaB83tRZ1hxCkBKn1hCEB2FA2TJCf3LLH20PPDzJ80tdwoXiTwlszPDQm1xGl5OGIIalQcrLsn4tFxIs3HxHFbxcngNqAqnO3xO2zxiIqIzYzYLQ_frAdKTiWgiwZw6c-aikNtkSP9GLz7SS0p-jfQmyQptvhcKxDSriMtcZwcU2rRWN_TMLrH6Vfp9vdxgDfGj3B80Id-CcF-rAqbvuCzIoSYuznizKIi0FJ6kasljZ-pb9EyeAgtWd-9HTTiAjtTxBfw7a6Pn_cjOPOUKpembGT32lgVUbjY0oqimTT-fgCeisSXA9TMhshLoj__ANJarD7xUMt9cebin0pdVbUEK0UZ21n2Qs6Zpz82e3chvULMlzQGNcq39Bg_XPpHxVrWmtBKu8X6-ZApQuwh2NBEkc0Gty-7ORVUf8tVBiqBEBOXqIceMME-BMmzvJq4unOoLWy7tdCYAXcALp_EHX8G3XZmNPShRRhvR_8ZVpLALpKJMXvdr2hitLZUxAi17Paxz8YNu21tzbldeCT5t7h463VMEYE_oVt9jQyxs1i9680dA4N3sDEgOSKgFtaF9RVJGEJKt7GQiE4DsZf4V2jV89skqgZcqTfU87UL6xT4TS_Xntc-WH0-yat-cJxtM7a-pEPHHGCZJMdmZNt9h0vKqVrTXpQibzL2N6ThBB4Hl0SN3NDLeh1dvTvzEfqnWZewfBxKqCSGGbL5i-ZBwk5e6RxUBN2QEE7lCThe_UwJUzFWjfFQLMc_Dq5P_IuRmVxIWue6WWRnkvCKG6wyqYo4Huzd_FefYHCiLMbPFmgWksZ-qXVU61QG6b8HwOvWgEr3UYaXYsMk3JneHiyOPYxLmG74oBLNfiuo9JEulkHvBR6AgWI7J5Djn7ZubJgAr3DhuZMTK5wr3SPbj58ebFGpOlyqBRVmw2tyHQhUAmhfuJbCtAAw9RAgLQgid4Itb-gi-YjRfYXFDn0JJ9SvUEooGBzBPMhP0sGdyY3HZtDIVFxVDXoOfiys3f-HWrXlEPFuz8FyDaYLV7&sai=AMfl-YRc0NETtLAjQOozqIpSHfOKQyfUuJu1vyTriENHJgTsfZjN0LK01DsLbFfCxhSraxF2ZgZyPdovxRt8HYrja9vBjm47NvcvTcSwOsVgtg4UuaVX67QWv5IysiHsqJLvEnUpuvnM73FnsV8iLsRfmH5G1tLcLHCZz1ka5IIRV_3SGksQdxINYJk8T2eVY72O0d2UHWOMiSfPJ_y9g1uDYrA4cKduIQeegg6RjjYFGSgQeCjwVXAiAvOhPlnYN2CJ8J-oz8w5Cc56_2G0seEw6XJgt8UFcfWCIR0quA&sig=Cg0ArKJSzNc5J5jaKddsEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=32&cbvp=1&cstd=32&cisv=r20240213.00633&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame CD65 236 KB
63 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame CD65 2 KB
649 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Cairo&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43921eab8f84a686e32276eb21d658bc575ac6f172fe3aa73526c3760e3e5444

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 19:35:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 roller-kw25-300x600.js Show response
s0.2mdn.net/sadbundle/4769131828568643930/ Frame CD65 33 KB
7 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4769131828568643930/roller-kw25-300x600.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9319d145bc67531bbe1c3d03de7fa7805df08dc1c680c9a0d592036eb03c555d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:49:52 GMT
date: Tue, 13 Feb 2024 08:49:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127439
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7601
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 14:39:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 18B9 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 200 roller_kw25_300x600_atlas_1.png
s0.2mdn.net/sadbundle/4769131828568643930/images/ Frame CD65 80 KB
80 KB 8ms
8ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4769131828568643930/images/roller_kw25_300x600_atlas_1.png

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

40480c56eb2337d7600727123e501eb69f2c27b02a405b9a69cdfb9fa29a4553

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4769131828568643930/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 00:54:18 GMT
date: Wed, 14 Feb 2024 00:54:18 GMT
x-content-type-options: nosniff
age: 69573
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81649
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 14:39:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C69B 0
0 41ms
41ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsulsYzw00z6IsuEN2RleG9VWa8B9dm8Nn71klJa4Cj41Djz8gsReEiuluklZWjWcnN1y2siVFyESHlPmZYuMPgxp-u0-2uz7M2hTVoG7ALxR1A4SidQfic1FtNPgskZ3V6P5puFPq8_8wIutDdgp_Ap_EYcMif9DeTMhTho0FPtIfMi8Om-3swKv329yRFgbT0tiGnNNLJNMXbiMoeHhbXegGzwai7W7KEfnwZ344EZDEmJzrOdp2xzSUYlkcNm5-qN95HsAbVfKUISHLNnXrB--q7C3Ny0h4BRalprtNAtXvg1KsYnhhQjRTpu4Jve4XYE1cxEl-K3yKmdzXQMDHWfR6gUc0l5zMx849dT-0pntxajIp4CJRYyl_59VQZmmaB83tRZ1hxCkBKn1hCEB2FA2TJCf3LLH20PPDzJ80tdwoXiTwlszPDQm1xGl5OGIIalQcrLsn4tFxIs3HxHFbxcngNqAqnO3xO2zxiIqIzYzYLQ_frAdKTiWgiwZw6c-aikNtkSP9GLz7SS0p-jfQmyQptvhcKxDSriMtcZwcU2rRWN_TMLrH6Vfp9vdxgDfGj3B80Id-CcF-rAqbvuCzIoSYuznizKIi0FJ6kasljZ-pb9EyeAgtWd-9HTTiAjtTxBfw7a6Pn_cjOPOUKpembGT32lgVUbjY0oqimTT-fgCeisSXA9TMhshLoj__ANJarD7xUMt9cebin0pdVbUEK0UZ21n2Qs6Zpz82e3chvULMlzQGNcq39Bg_XPpHxVrWmtBKu8X6-ZApQuwh2NBEkc0Gty-7ORVUf8tVBiqBEBOXqIceMME-BMmzvJq4unOoLWy7tdCYAXcALp_EHX8G3XZmNPShRRhvR_8ZVpLALpKJMXvdr2hitLZUxAi17Paxz8YNu21tzbldeCT5t7h463VMEYE_oVt9jQyxs1i9680dA4N3sDEgOSKgFtaF9RVJGEJKt7GQiE4DsZf4V2jV89skqgZcqTfU87UL6xT4TS_Xntc-WH0-yat-cJxtM7a-pEPHHGCZJMdmZNt9h0vKqVrTXpQibzL2N6ThBB4Hl0SN3NDLeh1dvTvzEfqnWZewfBxKqCSGGbL5i-ZBwk5e6RxUBN2QEE7lCThe_UwJUzFWjfFQLMc_Dq5P_IuRmVxIWue6WWRnkvCKG6wyqYo4Huzd_FefYHCiLMbPFmgWksZ-qXVU61QG6b8HwOvWgEr3UYaXYsMk3JneHiyOPYxLmG74oBLNfiuo9JEulkHvBR6AgWI7J5Djn7ZubJgAr3DhuZMTK5wr3SPbj58ebFGpOlyqBRVmw2tyHQhUAmhfuJbCtAAw9RAgLQgid4Itb-gi-YjRfYXFDn0JJ9SvUEooGBzBPMhP0sGdyY3HZtDIVFxVDXoOfiys3f-HWrXlEPFuz8FyDaYLV7&sai=AMfl-YRc0NETtLAjQOozqIpSHfOKQyfUuJu1vyTriENHJgTsfZjN0LK01DsLbFfCxhSraxF2ZgZyPdovxRt8HYrja9vBjm47NvcvTcSwOsVgtg4UuaVX67QWv5IysiHsqJLvEnUpuvnM73FnsV8iLsRfmH5G1tLcLHCZz1ka5IIRV_3SGksQdxINYJk8T2eVY72O0d2UHWOMiSfPJ_y9g1uDYrA4cKduIQeegg6RjjYFGSgQeCjwVXAiAvOhPlnYN2CJ8J-oz8w5Cc56_2G0seEw6XJgt8UFcfWCIR0quA&sig=Cg0ArKJSzNc5J5jaKddsEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=94&vt=11&dtpt=62&dett=3&cstd=32&cisv=r20240213.00633&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 249D 42 B
69 B 40ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstOL1Yl4yYVr37ULtBbzIKh3-8QtF2hW5jFOGkDJqRpI8MQFXYvdShLzkNnP6TJqhtn5PiQOmjM3TOqrt1z0bw2uA3RlFhEv5GUp5ZbmglNsGGVL8bfqKwNQLBsbAokpFZ7ttITl91bgsLZbP5lhXFKOYxw2Fbo16bmUg&sai=AMfl-YTbxqhsXS1RT3OjApo7M-E3NUZRFnXQdC9RJlCNLwJQsnZCW7WVFRENxT-R8hlRX5LfSzK_Elj2D7LdkV3b1AOM1RMlT5JR8tumj3dgww7KmgkjPa0XEcHDHHDDthkoEVcwL4zat-UvtvAu-b6i&sig=Cg0ArKJSzIxiuFBSHg1TEAE&cid=CAQSTgAvHhf_zd8s4ejyK-y9U2AJMeviqWQL-fN3s9g2ClSKoWcyLXc9Qd54frtReqxDTvuwUFE5Ho9LBbaTv7GfG8ORZrVOeLkYwEx8elGTjhgB&id=ampim&o=298,1206&d=1005,124&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=261&tls=1465&g=55.645161867141724&h=100&tt=1465&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18B9 0
25 B 58ms
58ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BEF91_x7NZcGsD-3O7_UPmu-qwAgAAAAAOAHgBAI&bg=!Z2SlZCvNAAaxkZ3akZE7ADQBe5WfOGNhyI-3ZH9-Mgbo7vPTaJ_ufbBGbDBY7QmM30TvcJIitAAohP_J6QgbpifwFs5zAgAAADJSAAAAAmgBBwoAC-NtpsDZhT7PjhVLmQMO9CVXv6R0YDNcpVeksr_k-ILUzaByYW8wRqMZizRM0QZf30eB6K9Q5nc_SkrK_X8zaYnqDW-zCSUdevSUCctNUMjAip19cZcVUveQB586s3KkpZVVYY9_Tr91pP3c5NN4mpNPjN4dG7dvyFVuMK8ya5jHJR_kbnSMoZ0_oOxj3_Mk5qG1i71_gv7LqbcdeammT5eyBedmOyfAkosonlkPI99cRolAb0v73H8xaxIwvxocnw7HhaxVmWlKYgzuQU8305prsLCg32IccVUuop3yBR_YfpRbG-LVfyPwwWdymk6aIybwiaOJ6-t5J_Pkrht8jFkTf3FpmLJLDnDVF0INiIGSEsT2atHCK0uRKcOI0llTjDJEBdCzg9lRl2Xu17gaJjhIgwqbj6SRcwwvWcH-WFCt2QJTYsLjDbwcJgJ_4UGCeXQe8JS62BQ0cq4yDWEsizFEpcln4OhOvGJQdEOPQAV_TEFcU3yOJqEjsDRiAC8pAnnAjNtePk_qSwwBfvuDnWAYUaCs4iraLNYASMDrkhL_uQtCiqOPGrlxC_RP8oTjUnAEgSqKq6dbN-3SYGMr3BVL60gLty0rAYZ7tyMQVwNQSMvdh9lkyaOeP7UVeD6rCq9RjjO_GdWC1fEeNqT0K11-LNVsrlHkUQ_EeyrSfZLBkbTERBxxZI5-7WUiXCVGYwlk65yiwU6Mk4K437gueXpWr4W3_pet_t2cocFMebDMTnk2yO-t6Xe2f5dCmpG9yTSrT_o3qwebBXBvpXgPxvAL4XAs-ROcSaP2T6T6amB3yuWhZ8KH1-VF5ee_qWVZPsSD6odxYPjDCUfOzcUspifb1TJCnsPdWRWjkl4dWNfNH01Wak4mA0-l1iuhR_fDvHt_TSMj-u3lBf_c5F3bs3BMv1yA_Lwr4rRfqboc8yYTT8iPjF2z3Pac_FbHhHWfjFOYca6JgfZu8p0u-CdkAitVPwABzMYju_Hh9Q1IPUAo4ZJETbL7OOLOil_ttyufwDnYlq63f_gQ08pnOLJVLiRt149vgwXtJpdAwGg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6A6B 6 KB
3 KB 9ms
9ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 948E 0
21 B 44ms
44ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COjcx54CEPOAoaICGLf6iIQCMAE&v=APEucNUErJQJGCLM5Yt4gsiz8Nyn5-VynLjovCIt-X6ftTFdsOJND4WIfKApyk0FA7dJXnUqgibVDIE-KKLWQQj92GPBCYfTVdMeuVs7T3ImvKFOi3irp0FERNfNCPhRotrS-lzwUokNxieWI-FlBeTpy6ny4JyHFexuBWbHv_fBOo6bn2I2C-o

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:51 GMT
expires: Wed, 14 Feb 2024 20:13:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6A6B 93 KB
33 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A6B 42 B
68 B 40ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DInNG0C6YeWi3QsjUyh7o8D2hwNjYjuAQ3nwOsc7YtZf2jIz0zQG_oXnHIDAD2oTyVtZ_K82NnzIpV_PvUzEBoGf2h3wpUbCNBTWDvB8Nai5ghZ5E

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 6A6B 2 KB
1 KB 80ms
18ms Script
application/javascript 2a02:26f0:480:9::210:ee0e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=10267456&cmp=31319114&plc=386260564&sid=6531361&dvregion=0&unit=300x250
Requested by: Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee0e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e55c01e3ca797dbf8af251c9d68755f6039f7792afe6866e46269e4036697d3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 14 Feb 2024 20:13:51 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 15:12:34 GMT
Server: UploadServer
ETag: "a8006a511aee2e57196f5e8bee81dde8"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 932
Expires: Thu, 15 Feb 2024 20:13:51 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame 6A6B 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:25:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31682
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:25:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/ Frame 6A6B 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240212/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:27:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74771
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:27:40 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6A6B 204 KB
61 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1099
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
DATA 200
OK truncated
/ Frame FBF9 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1506a28234d664d35dfe79e044e427b02ce3e69a1feb0175472b455af1f76f20

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 SLXgc1nY6HkvangtZmpQdkhzfH5lkSs2SgRjCAGMQ1z0hOA-a1PiLA.woff2
fonts.gstatic.com/s/cairo/v28/ Frame CD65 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cairo/v28/SLXgc1nY6HkvangtZmpQdkhzfH5lkSs2SgRjCAGMQ1z0hOA-a1PiLA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Cairo&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc8b30e9bfe6a385b5619c0d0a34b8f562e02ee4c09ab0637eed496ca3944fcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 16:36:08 GMT
x-content-type-options: nosniff
age: 99463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 14:51:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 16:36:08 GMT

GET
DATA 200
OK truncated
/ Frame B5D7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c77efee2a9cf8237553a08b675aca04dc7635a45dd88017d791d29b478e3f3b3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A6B 0
25 B 37ms
37ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2076486587428&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6A6B 0
25 B 40ms
40ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2076486587428&version=m202401290101&ct=76&x=1&cor=3774424942509558300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6A6B 16 KB
12 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BX5luYLa8uINzSWeOnMsKghbRIDvV1FK9dAMvDAf6kYxNwsv6LE7hmQnLsBDszlEicVZcRnC7oV-yTSXtBpc5oyYeAjA0mP8wOs4RTxUFeHM4P5LmXvVi8-iJFOTtZYuHkCevvNAovLMKy5nESmmOW21LH3m9KpyTEuVgYhauHJ8ZkVAU&cry=1&dbm_d=AKAmf-CRVeMc2DZLQHxVsjz9nNdtP4TNVSodr5BcbRxANSQCjKuN_ulbLxopj9f2COrfUy_MM5soFevrfzj-L3MBSj3SSLjcgUu0QAOklcilsq4JY7qaErdfEgCwa9eBYi63k-G00Dh2hnixE-6oFqV_xfKLLeKdyWQILOG_cDBm5yltk220j24Z7eZzL1RbNonEm8bUZrfOOvcS_upFVVp2EXB95Anuez_5QMR7YlwkwAooq2vYG0z96VQPWVC7nxTY7mbn4KrNhvYgLeSF-cCnsWysyVfvcNZ0t3Tg0tuW-um2N6kz2cY2oGcc7l0L_B6E6OTjiPVWKyb8jiQ6VNURW_Gxub2rpgcZvMvQFP0VnKBEfqpQHUsht6NAFnbR6Qj_H-3NvBn1I1ukRyJWjkBVzndDKTfnXmf4jJjNfkDwxtsz4vYzySeNrCeA_xA5CxnvZ-6069bwTZAi0Gz_JatbbJsR7m9YGC2wFcGx0ZLGECr1JP1gUPDDCBxz8Xjrh_jnk9l0QrmUyLlx99Vq6ivWpZhZt0TMjqyCWN-9XE9wrQhm5_-nRROvpoQld4Nl0MJEog9ckR40-BVM46XkNV4_X7B3mezvGW4uhfcamHoa5QBBreOiQ7YpTqqoc0Wy6ZddfJWqzx1bX-GJc9-W-RyMNYnuW03GIgGvVj5gFEN49GdESLrERMfMI9lW79L3-s7aXULhx-NjiUDkaK8nCzBYHv0LYocl14mAD2u2o4Jg0UwkV5eMrmH33xCmTeBkMiQfglTiVsVLB90J1Z4M76rkg6idWBJChJDM5Wc407P8K2HooI-ff4YnbfVUubYwW1I4xI5YwLTqyq1wUdNTrZlc1-s4Nd7q2JJ5w8fMAn_MGu1j4BUPcj358i9U6SYyb73_1urUWbZf0AU_VxNhMHILkXSNdVC1e16xBDpxH-pHxbLuOs_4Il6XVuAUlaeNIPwmemuZNafPozbb3YkhMkTL5wyUUh2KOnHO3pztn1bYxIIcYWJ0hL5ZJWiU5zwObymI6F8gaqDIO9myCHsnohBipHZz0q7hyPCHosp76lDJrIZAdv2afSdcvVEOWu-yH_CNRX027vnVWX7Ht91oix0q4HmesWGnrYqRYrXq5PW_nClLLD8gBPF1BQcQqKxntOi9FcO2KQudfegObm4oyg8WqrYoAf4GlYhLH1ss_W2Eq07dTMFQeE9SAyDwtoR_6YXmoQikFIfaG636qhp9IOyRXkRvaVt3tieUJ53T93_mndPRRry4AlkgZeOkygmzbYQMdwQ5GMvq_s3Fh8ZRgeuNDcwCViQIY9y7J2_5kg_SxImZkpesOAyiKW4bD6HWkxTiNiVxX4qmx1ou73qcvQlld38KFS5jN2-0xqatZxn0SoqT7AobavmR0Saq9-1iHZxJJbDH8O0NBWsGGZt9VEpLFndg13pW15EZojRccI5dqLN2jZmvwk34_XWemqBL4Kse_BtiaiDMd-l7fhrv41P4wPXIElD0UnB8JqtYBnXBAKj-hZmbkAystMtk_t-swawB1AljTWgUWwC-ehHBTG2H690N5WFyK2fyPT2B1c145lv5OQqIXlmYpE2cTryNUOekv5ABlhqkAs8Z9xBKEO37J_uqVZlsLIQG50m2AF1FNrxscBlXQmF7qrrYZcAIjixHZ3OUhT_rBdPxil0CZt7Y9Pkoo3wSz01uvTgZ1Y1NcmRZcMYTtBM-ao4NdQWowSPTAhOtiHi8-FTCTPfAI-1JOefEPnuMk553IZjYAt0tqBORlAe-L11MG7PFyP_xSybwqBuvCGKVfMy5LVSPXL9hNKiaMgKzytdKCjb6Y0_J8B-NiFPy-CzY7pN6p9x5BQVcdAe5gJ_ten65JwNqMn5VkCbB1AKrVzg2tkqX9KMgOGeiHgv5gY8F4rA4o4qXLe7knBON54FMqyngH-2G2xo_XaYpweIF6jMhEOM6ZR5vs_qUHbvkUDUJcFfD6YHcEMEH1eIt2V8ONj-wfO9INQ9Zvj5ajFZqKf1aRhTwYL2SC1il0fAAceiF-8Txi5Tp4VZ99kekKa6bpkk6bJfd8x_yXy-G70f0ZU7IcvwV6JpeTezoitqANYZgTk8-C65p9PXQmZ_7sijXN_N0fVM9-uQN58r5Ql5WK9wE0oe6ld_3vSotkGJvbsHeELIJtSJd5xlGNnMyuH_SXszbxP1sODF4SgPA4MVyq_q3Tl1DndSw8RaxHuMrDOE0jF8wvGTwQKCpOT10Swp6n0BhxOK0n4C8qlgeGhnmV6hwL2H2JfPDS5CainQ47XbJPB2h-bXZAayfp2b4S1sSdwz_5fjTN0vCf-FBBVzBSEa61n5Ue6hjQUfXqqQnJ2leP5QkhZQJ_PO5pZx-5uzOg2R0GcRkbcGcRldxf5pksGqucsQPBKRBovfCbsWOuohQJL4k3IjgSkAUhnDIS7QfbJkDexzmNpx3ikvP8P_gH9g1EsTPMoPk9rnYcOJb_2emInian0BOu1TNadzcvDtF9TRME6-C7yOqg0T0X7H5pw6yBJErD43aAihuaCVeAjxc4OuR5jMWE0kvU03_Sv4TYVZZO-C7i-D8WMfBL9TkH4J_XR8XpmBDqqFyjxijXaEOYfsoufsxBb4aUWOf7_crYj3t3DawIweIcgVCQp4h9JPrtNzuE5YBL_hCBorWmhDG5gPVbB-Akw5g7JSOUC8VnBqr5YqB8ZT4kp_2AkNWLQfgONgysA_7QQ_cVv1vhUzFyadPZMxgvTbfbWjlTJhPOfELoKOecGds2Ju3rZWBCmDQGKTLOaVd0hN_s0lpDhLqiJg_0dJUamlfGhYU43wX747uSkMU365uK7tpGNxewPbdEnBxJJbgJ8gQ7SYJNKZw-ZXgqArR8jYJNCsX7EyBYwym0pHAyBpva40IlLIZcWEtz_ElfnvxKT3n6QdCGKxS7Ea-wf2jmrqsvBd8BH-RIYuilb08DascT4wAHywjeXPI25ZwqMt5BtGGEUOqAiQFz5ujsUWCgKtvPBzFuap61RrKu5KYjxjqxtKFW89T3KUdCY8Fb_easORScHS-xMHBs4b44qffPgcSl9TAdLy_JlNfI0kCl7abAh1jaz4YbP3a2RVkBf-E4RrYP89rdjlkkbgcXyqOYvQVt9RUEIsNSI7Dchdcx2FKFPTZtpBrjB_Wn8vd_ElhBZPey8I0SL1Hi6STe5qwZSNNEXWcVipm2pBwGWwJ_cI-TE7MQC6tXvfpkMPkEBWRyUZsZQcFBwnRGclDo3JghjTrIDfDj5bq4650BR_mMRWTZ7TcVdvEow&cid=CAQSTwAvHhf_40xv47xTiVrp0mPVMeByXeEUvtFP4eRBqZg880BVKCkHAzf9D7Qt53W-OmMWwHTbqmKiFB03dr_kXCnHMuKNqgSH3cC3HtpeAv4YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=3774424942509558300&adk=792902354&idt=55&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

269fd096a739f6c50f1389bd5999c125dd7f5456ccb6fb5d8d42c8a6e4b4e922

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6A6B 41 KB
14 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BX5luYLa8uINzSWeOnMsKghbRIDvV1FK9dAMvDAf6kYxNwsv6LE7hmQnLsBDszlEicVZcRnC7oV-yTSXtBpc5oyYeAjA0mP8wOs4RTxUFeHM4P5LmXvVi8-iJFOTtZYuHkCevvNAovLMKy5nESmmOW21LH3m9KpyTEuVgYhauHJ8ZkVAU&cry=1&dbm_d=AKAmf-CRVeMc2DZLQHxVsjz9nNdtP4TNVSodr5BcbRxANSQCjKuN_ulbLxopj9f2COrfUy_MM5soFevrfzj-L3MBSj3SSLjcgUu0QAOklcilsq4JY7qaErdfEgCwa9eBYi63k-G00Dh2hnixE-6oFqV_xfKLLeKdyWQILOG_cDBm5yltk220j24Z7eZzL1RbNonEm8bUZrfOOvcS_upFVVp2EXB95Anuez_5QMR7YlwkwAooq2vYG0z96VQPWVC7nxTY7mbn4KrNhvYgLeSF-cCnsWysyVfvcNZ0t3Tg0tuW-um2N6kz2cY2oGcc7l0L_B6E6OTjiPVWKyb8jiQ6VNURW_Gxub2rpgcZvMvQFP0VnKBEfqpQHUsht6NAFnbR6Qj_H-3NvBn1I1ukRyJWjkBVzndDKTfnXmf4jJjNfkDwxtsz4vYzySeNrCeA_xA5CxnvZ-6069bwTZAi0Gz_JatbbJsR7m9YGC2wFcGx0ZLGECr1JP1gUPDDCBxz8Xjrh_jnk9l0QrmUyLlx99Vq6ivWpZhZt0TMjqyCWN-9XE9wrQhm5_-nRROvpoQld4Nl0MJEog9ckR40-BVM46XkNV4_X7B3mezvGW4uhfcamHoa5QBBreOiQ7YpTqqoc0Wy6ZddfJWqzx1bX-GJc9-W-RyMNYnuW03GIgGvVj5gFEN49GdESLrERMfMI9lW79L3-s7aXULhx-NjiUDkaK8nCzBYHv0LYocl14mAD2u2o4Jg0UwkV5eMrmH33xCmTeBkMiQfglTiVsVLB90J1Z4M76rkg6idWBJChJDM5Wc407P8K2HooI-ff4YnbfVUubYwW1I4xI5YwLTqyq1wUdNTrZlc1-s4Nd7q2JJ5w8fMAn_MGu1j4BUPcj358i9U6SYyb73_1urUWbZf0AU_VxNhMHILkXSNdVC1e16xBDpxH-pHxbLuOs_4Il6XVuAUlaeNIPwmemuZNafPozbb3YkhMkTL5wyUUh2KOnHO3pztn1bYxIIcYWJ0hL5ZJWiU5zwObymI6F8gaqDIO9myCHsnohBipHZz0q7hyPCHosp76lDJrIZAdv2afSdcvVEOWu-yH_CNRX027vnVWX7Ht91oix0q4HmesWGnrYqRYrXq5PW_nClLLD8gBPF1BQcQqKxntOi9FcO2KQudfegObm4oyg8WqrYoAf4GlYhLH1ss_W2Eq07dTMFQeE9SAyDwtoR_6YXmoQikFIfaG636qhp9IOyRXkRvaVt3tieUJ53T93_mndPRRry4AlkgZeOkygmzbYQMdwQ5GMvq_s3Fh8ZRgeuNDcwCViQIY9y7J2_5kg_SxImZkpesOAyiKW4bD6HWkxTiNiVxX4qmx1ou73qcvQlld38KFS5jN2-0xqatZxn0SoqT7AobavmR0Saq9-1iHZxJJbDH8O0NBWsGGZt9VEpLFndg13pW15EZojRccI5dqLN2jZmvwk34_XWemqBL4Kse_BtiaiDMd-l7fhrv41P4wPXIElD0UnB8JqtYBnXBAKj-hZmbkAystMtk_t-swawB1AljTWgUWwC-ehHBTG2H690N5WFyK2fyPT2B1c145lv5OQqIXlmYpE2cTryNUOekv5ABlhqkAs8Z9xBKEO37J_uqVZlsLIQG50m2AF1FNrxscBlXQmF7qrrYZcAIjixHZ3OUhT_rBdPxil0CZt7Y9Pkoo3wSz01uvTgZ1Y1NcmRZcMYTtBM-ao4NdQWowSPTAhOtiHi8-FTCTPfAI-1JOefEPnuMk553IZjYAt0tqBORlAe-L11MG7PFyP_xSybwqBuvCGKVfMy5LVSPXL9hNKiaMgKzytdKCjb6Y0_J8B-NiFPy-CzY7pN6p9x5BQVcdAe5gJ_ten65JwNqMn5VkCbB1AKrVzg2tkqX9KMgOGeiHgv5gY8F4rA4o4qXLe7knBON54FMqyngH-2G2xo_XaYpweIF6jMhEOM6ZR5vs_qUHbvkUDUJcFfD6YHcEMEH1eIt2V8ONj-wfO9INQ9Zvj5ajFZqKf1aRhTwYL2SC1il0fAAceiF-8Txi5Tp4VZ99kekKa6bpkk6bJfd8x_yXy-G70f0ZU7IcvwV6JpeTezoitqANYZgTk8-C65p9PXQmZ_7sijXN_N0fVM9-uQN58r5Ql5WK9wE0oe6ld_3vSotkGJvbsHeELIJtSJd5xlGNnMyuH_SXszbxP1sODF4SgPA4MVyq_q3Tl1DndSw8RaxHuMrDOE0jF8wvGTwQKCpOT10Swp6n0BhxOK0n4C8qlgeGhnmV6hwL2H2JfPDS5CainQ47XbJPB2h-bXZAayfp2b4S1sSdwz_5fjTN0vCf-FBBVzBSEa61n5Ue6hjQUfXqqQnJ2leP5QkhZQJ_PO5pZx-5uzOg2R0GcRkbcGcRldxf5pksGqucsQPBKRBovfCbsWOuohQJL4k3IjgSkAUhnDIS7QfbJkDexzmNpx3ikvP8P_gH9g1EsTPMoPk9rnYcOJb_2emInian0BOu1TNadzcvDtF9TRME6-C7yOqg0T0X7H5pw6yBJErD43aAihuaCVeAjxc4OuR5jMWE0kvU03_Sv4TYVZZO-C7i-D8WMfBL9TkH4J_XR8XpmBDqqFyjxijXaEOYfsoufsxBb4aUWOf7_crYj3t3DawIweIcgVCQp4h9JPrtNzuE5YBL_hCBorWmhDG5gPVbB-Akw5g7JSOUC8VnBqr5YqB8ZT4kp_2AkNWLQfgONgysA_7QQ_cVv1vhUzFyadPZMxgvTbfbWjlTJhPOfELoKOecGds2Ju3rZWBCmDQGKTLOaVd0hN_s0lpDhLqiJg_0dJUamlfGhYU43wX747uSkMU365uK7tpGNxewPbdEnBxJJbgJ8gQ7SYJNKZw-ZXgqArR8jYJNCsX7EyBYwym0pHAyBpva40IlLIZcWEtz_ElfnvxKT3n6QdCGKxS7Ea-wf2jmrqsvBd8BH-RIYuilb08DascT4wAHywjeXPI25ZwqMt5BtGGEUOqAiQFz5ujsUWCgKtvPBzFuap61RrKu5KYjxjqxtKFW89T3KUdCY8Fb_easORScHS-xMHBs4b44qffPgcSl9TAdLy_JlNfI0kCl7abAh1jaz4YbP3a2RVkBf-E4RrYP89rdjlkkbgcXyqOYvQVt9RUEIsNSI7Dchdcx2FKFPTZtpBrjB_Wn8vd_ElhBZPey8I0SL1Hi6STe5qwZSNNEXWcVipm2pBwGWwJ_cI-TE7MQC6tXvfpkMPkEBWRyUZsZQcFBwnRGclDo3JghjTrIDfDj5bq4650BR_mMRWTZ7TcVdvEow&cid=CAQSTwAvHhf_40xv47xTiVrp0mPVMeByXeEUvtFP4eRBqZg880BVKCkHAzf9D7Qt53W-OmMWwHTbqmKiFB03dr_kXCnHMuKNqgSH3cC3HtpeAv4YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fmphealth.online%2F&ds=l&xdt=1&iif=1&cor=3774424942509558300&adk=792902354&idt=55&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126367
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H/1.1 200
OK dvbs_src_internal125.js Show response
cdn.doubleverify.com/ Frame 6A6B 60 KB
20 KB 8ms
8ms Script
application/javascript 2a02:26f0:480:9::210:ee0e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal125.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=10267456&cmp=31319114&plc=386260564&sid=6531361&dvregion=0&unit=300x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee0e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: a7e081ac2862a2c9fe794a716293c201eb0cc90623edfe349438c3af8f58ca6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Wed, 14 Feb 2024 20:13:51 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 15:12:36 GMT
Server: UploadServer
ETag: "8188d451e0a669939fa9ed400c00d127"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19695
Expires: Thu, 13 Feb 2025 20:13:51 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 6A6B 1 KB
927 B 129ms
23ms Script
text/javascript 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_257363577745&jsTagObjCallback=__tagObject_callback_257363577745&num=6&ctx=10267456&cmp=31319114&plc=386260564&sid=6531361&advid=&adsrv=&unit=300x250&isdvvid=&uid=257363577745&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.10&dvpx_strhd=0.10&brid=3&brver=121&bridua=3&dup=null&srcurlD=0&ssl=1&refD=1&htmlmsging=1&tstype=128&m1=13&noc=4&fcifrms=17&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=172&eparams=DC4FC%3Dl9EEADTbpTauTau%3EA962%3DE9%5D%40%3F%3D%3A%3F6TauU2%3F4r92%3A%3Fl9EEADTbpTauTau%3EA962%3DE9%5D%40%3F%3D%3A%3F6Tar9EEADTbpTauTau7hhb727beg75hed%60gbg4agbd__h2f2e7%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&dvp_exetime=4.30&callbackName=__verify_callback_257363577745
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal125.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 76a911400c8b66de025a2156ab7c41e292cc8da506bd523e80b1f5cb481a6f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 14 Feb 2024 20:13:51 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 02/13/2024 20:13:51

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 43D3 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126192
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 43D3 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 43D3 0
25 B 41ms
41ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BhXKo_x7NZfKwH4uyx_AP7Ya2oAgAAAAAOAHgBAI&bg=!b2ylbCPNAAaxkZ3akZE7ADQBe5WfOAKlS7zYOBQJtyLfoI_qj-qXJ3QL0tATvPmyYSIumwqhNCVD9SSdTaUHp-381BHCAgAAAC1SAAAAAWgBB5kDEGPgtWBCa0ps03i6QR_ZdhSejDiiob4fUIjGIKuNK1yAB28LQXTuKZD9htgtBye9rRQRKNQ4xmHOAfno2NhhmhgA-TmA-JQ0Ciupi5_GWYZAqO-NW3gUoiZNRoFPhMsDJOum6YanQRr0_1AEWnvTsI9SZ1R94evzZycSAiG7D35_zbi_HuEoW4D1pN6zbEQX20938spa0tfVTEJDz9UQPY3Vv3I8aJh1TDJsamAFcolC-WNIdPj10vzfzkNhFITSj4SesRzkvYg4Z9rqymPlq3SHnYDC_3tvs0AKvl4kbhPBqg1vaFCHbA6Y2LeC-VQnAkWEX80f0TkC3vrb60qGYcecHmV6DrtIppKqtvIdFfwbmQpdjFLI-WDBWGSNAzVgywwvyipDGbxQuuJrfMrblu-m9BHJsj_seML6AeEwQ8liqwGrOklAB6S1kPUHaaZsHbzV2ZNTqiNTTarINjV-hKhOtIhBp9F5DRKHMjWKwnoqegLGabGPWTnK4z2vN5VJ33PbU9deV0noV6V9i90dYit-oOw_eZnSGkXAcLjd_-aaDFvG7r6I6i_vZcruDNnQjT8XGEsEj6vClJKsvO5-RCz7YbPtsqDWrSW7kpYqSshT_YAEppdABjciwmu1fzESYnrtqHRex3S_NqRqi8Z2TlxpTxNJszjeI9biz-_VmH7edS8CuxW5Cqt5KAb5Pj1XuC8HU_cD8NOwuHwlc3sJnRHSJWYcFrU2UcibldLdAP-vGHRWaGRdtedAo_2hUt89_eMnFvkN2piBnVP5CphIf-eBEpnfr8egwwFGg_AJmskTj3WFzGu8nrMJ0m3LD4EPqxwTArdMLnHJtmQ4wralZs4T8KPu10TI8HDN6rG3bYnAtX2oiMvVEFk9R-ojsWAlqHHWzEqsZOhDQt3eyM_hr8YCcvWRf9noiwE5h0PqFEncXi5kl9DjIU66u0t4xpVrL-LFL-sJayjvwxsuaZDPX4cCLbqsxb32NPXPFGAFTtWolbwJPlEC9gIH-60Sxnucf3dozc31a1zcYb7GPBmhvA8

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-ew1.doubleverify.com/ Frame 6A6B 0
345 B 86ms
14ms Ping
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ew1.doubleverify.com/bsevent.gif?flvr=0&impid=f9624e85a33846c3a95a001edecc4560&vfdur=131&cbust=1707941631690236
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal125.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
Pragma: no-cache
Date: Wed, 14 Feb 2024 20:13:51 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true, true
Connection: keep-alive
Expires: 2024-02-13T20:13:51

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 6A6B 18 KB
8 KB 78ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal125.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 820
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 14 Feb 2024 21:00:11 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 6A6B 59 KB
23 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 23:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161312
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Feb 2025 23:25:19 GMT

GET
H3 200 B9689862.280410797;dc_ver=99.292;sz=300x250;u_sd=1;dc_adk=792902362;ord=brk8g0;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmphealth.online%2F$0;xdt=1;crlt=Irp8B... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame 6A6B 66 KB
30 KB 41ms
41ms Script
text/javascript 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=99.292;sz=300x250;u_sd=1;dc_adk=792902362;ord=brk8g0;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmphealth.online%2F$0;xdt=1;crlt=Irp8B'D2n-;stc=1;chaa=1;sttr=19;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e450d5946a9e1073ceb670fbd651a9572a76d7f9d70593fb1bf946b608b29587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30339
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012402060239000/ Frame F9FC 196 KB
55 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a7c5cebbb6d6eff010530c59b73e9e423125219661ff9bc5866c55cd17a5607

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 13 Feb 2024 16:05:51 GMT
age: 101280
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56214
x-xss-protection: 0
server: sffe
etag: "51ebc873ede2e2f0"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 12 Feb 2025 16:05:51 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame F9FC 15 KB
5 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2125b73ae211f46f82ee27eee87e5aa312c5bbf2aedca1b50b7d80f21fd3d5d2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 17:15:52 GMT
age: 10679
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0
server: sffe
etag: "1e0d3e55ad08d21f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 17:15:52 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame F9FC 95 KB
28 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70651252ddc3ae3cc902b7f374fb9037f0a27192fb31b66acbf5300441b45ad3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31305
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29043
x-xss-protection: 0
server: sffe
etag: "f8b65ff06b47be2a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H3 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame F9FC 72 KB
16 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08d631a369d2ed43e50e4e6dbb4619589fcf7a0b46d215ece86e1493b85fb464

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:36 GMT
age: 180135
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16667
x-xss-protection: 0
server: sffe
etag: "edd7ffc7036628c6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:36 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame F9FC 5 KB
2 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

288fd8ba8cb04967d8ffdb274e8828d79fe679e6991ceff828f0f48e04f315db

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Feb 2024 11:32:06 GMT
age: 31305
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "a50cf387c592e9af"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 13 Feb 2025 11:32:06 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012402060239000/v0/ Frame F9FC 40 KB
13 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402060239000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da80171367ccb86206235641cfa5efc267725e1870f5cc5c2a777dc57c7d5ebe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 12 Feb 2024 18:11:22 GMT
age: 180149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12948
x-xss-protection: 0
server: sffe
etag: "cd1beca569c88c8d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 11 Feb 2025 18:11:22 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F9FC 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64975
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F9FC 295 B
326 B 8ms
8ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85851
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 bg.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 29 KB
29 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/bg.jpg

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ac38aad3b021ce82aebf9bdbd44080e8413ed535e3d9238ab715ecd1c2df9c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:02:15 GMT
date: Tue, 13 Feb 2024 09:02:15 GMT
x-content-type-options: nosniff
age: 126696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30024
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push1.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 7 KB
7 KB 9ms
9ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push1.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

324387f70cc6c0fe72a9c83e68de7649907d9abebba8215c3c62a48dab2413c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 23:52:34 GMT
date: Tue, 13 Feb 2024 23:52:34 GMT
x-content-type-options: nosniff
age: 73277
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7277
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push2.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 11ms
10ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push2.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7d4dc366eb50db897ad584de186d975eb22d323c2ca58dc05d3f462c3649265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 01:02:36 GMT
date: Wed, 14 Feb 2024 01:02:36 GMT
x-content-type-options: nosniff
age: 69075
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5845
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push3.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 11ms
11ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push3.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcc2706dfc387db1247f925f35e7811f9203da43e803791aeb3826e7a1548341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 06:41:32 GMT
date: Wed, 14 Feb 2024 06:41:32 GMT
x-content-type-options: nosniff
age: 48739
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6060
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legal.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 21 KB
21 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/legal.jpg

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84925a1fc46baecfd3cb667b5bd6caa0121c6451e49d54c262c373c0a90394f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127029
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21894
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 13ms
12ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/logo.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3915bbfbaa4321e537ee86450dabb72ef5062c66de5d2a01f315818bbfebd488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127029
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6613
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 5 KB
5 KB 15ms
15ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/cta.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41b974664e19df7a95aec890ea3ef921969b24f8926d5b8f3dbf381e3213bd30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 07:59:51 GMT
date: Wed, 14 Feb 2024 07:59:51 GMT
x-content-type-options: nosniff
age: 44040
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5459
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
DATA 200
OK truncated
/ Frame F9FC 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2a9b613db7afe8895751350c031b2ce7d55c374532da421dc5d6c029af87beda

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6A6B 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=99.292;sz=300x250;u_sd=1;dc_adk=792902362;ord=brk8g0;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fmphealth.online%2F$0;xdt=1;crlt=Irp8B'D2n-;stc=1;chaa=1;sttr=19;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:36:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2252
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:36:19 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame 6A6B 12 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:37:26 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6A6B 0
0 41ms
41ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvF3ckdc7OsR8zA5BtYD6PA1aSzE3xsR80GgYdQbDwOyOkUON2_Sa1mwfacn1UYGXCZYYUtbpO292lzjFmdjF0Heo6_LMZwk3p7an_WMt0cqg2ULEgDDBKmHo0EjlIlG0knmEUgJAl3vGmgCgE3iqAK7tik93CYmaieaNK0WM4q9KdReDuxyb5o-eY_g-c&sai=AMfl-YRnPVs4Rn-XyxC8zmHuz6TkEQYgP409O1nyU_e9RZ2qHADpw35oik6uqhknfpkPcyiPiD1LAHBBpwYbczdI31PS-3ceiid2t5XOpw&sig=Cg0ArKJSzMT4q8vo6HFrEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240213.84751&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 6139721057214901104
s0.2mdn.net/simgad/ Frame 6A6B 145 KB
145 KB 8ms
8ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6139721057214901104

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

396a6e88a02b6f7035b9d69c01a2277c5867c6f2cde39e36277246e3f403f6f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:46:31 GMT
date: Tue, 13 Feb 2024 08:46:31 GMT
x-content-type-options: nosniff
age: 127640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148035
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 19:29:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F9FC 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 02:10:56 GMT
x-content-type-options: nosniff
server: cafe
age: 64975
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 15 Feb 2024 02:10:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F9FC 295 B
326 B 8ms
7ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:23:00 GMT
x-content-type-options: nosniff
server: cafe
age: 85851
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:23:00 GMT

GET
H3 200 bg.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 29 KB
29 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/bg.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ac38aad3b021ce82aebf9bdbd44080e8413ed535e3d9238ab715ecd1c2df9c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:02:15 GMT
date: Tue, 13 Feb 2024 09:02:15 GMT
x-content-type-options: nosniff
age: 126696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30024
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push1.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 7 KB
7 KB 9ms
8ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push1.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

324387f70cc6c0fe72a9c83e68de7649907d9abebba8215c3c62a48dab2413c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 23:52:34 GMT
date: Tue, 13 Feb 2024 23:52:34 GMT
x-content-type-options: nosniff
age: 73277
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7277
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push2.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 10ms
10ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push2.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7d4dc366eb50db897ad584de186d975eb22d323c2ca58dc05d3f462c3649265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 01:02:36 GMT
date: Wed, 14 Feb 2024 01:02:36 GMT
x-content-type-options: nosniff
age: 69075
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5845
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 push3.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 11ms
10ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/push3.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcc2706dfc387db1247f925f35e7811f9203da43e803791aeb3826e7a1548341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 06:41:32 GMT
date: Wed, 14 Feb 2024 06:41:32 GMT
x-content-type-options: nosniff
age: 48739
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6060
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legal.jpg
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 21 KB
21 KB 11ms
11ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/legal.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84925a1fc46baecfd3cb667b5bd6caa0121c6451e49d54c262c373c0a90394f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127029
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21894
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 6 KB
6 KB 12ms
11ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/logo.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3915bbfbaa4321e537ee86450dabb72ef5062c66de5d2a01f315818bbfebd488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:56:42 GMT
date: Tue, 13 Feb 2024 08:56:42 GMT
x-content-type-options: nosniff
age: 127029
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6613
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/11860170179568756624/ Frame F9FC 5 KB
5 KB 12ms
12ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/11860170179568756624/cta.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402060239000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41b974664e19df7a95aec890ea3ef921969b24f8926d5b8f3dbf381e3213bd30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 07:59:51 GMT
date: Wed, 14 Feb 2024 07:59:51 GMT
x-content-type-options: nosniff
age: 44040
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5459
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 13:40:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 1016 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126192
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6A6B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80e2bf2febd628de323265490cafb4dcb24b5cce4e4171f4ae1b48bbffa54c73

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6A6B 0
0 41ms
41ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvF3ckdc7OsR8zA5BtYD6PA1aSzE3xsR80GgYdQbDwOyOkUON2_Sa1mwfacn1UYGXCZYYUtbpO292lzjFmdjF0Heo6_LMZwk3p7an_WMt0cqg2ULEgDDBKmHo0EjlIlG0knmEUgJAl3vGmgCgE3iqAK7tik93CYmaieaNK0WM4q9KdReDuxyb5o-eY_g-c&sai=AMfl-YRnPVs4Rn-XyxC8zmHuz6TkEQYgP409O1nyU_e9RZ2qHADpw35oik6uqhknfpkPcyiPiD1LAHBBpwYbczdI31PS-3ceiid2t5XOpw&sig=Cg0ArKJSzMT4q8vo6HFrEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=37&vt=11&dtpt=36&dett=2&cstd=0&cisv=r20240213.84751&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 14 Feb 2024 20:13:51 GMT

GET
H3 200 s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1016 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3a2e8fb24ac4c5b337a2716b8b0ac9bd0481d80368ac25a4abcafa10bad4ed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15173
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Feb 2025 17:55:32 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F9FC 0
0 57ms
56ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CozlC_x7NZcTXGJ3U9u8P5oqyyAvIq-_bdaKh4-y5EuuEhsvCARABIM6niZ0BYJXikIKgB6AB1Z75nAPIAQmpAiqsz0j59bE-4AIAqAMByAMIqgSrAk_QuOjQqZGfRkAhEmahigOn63rXqx67rIZqQilVqVyIFui9__qq30EVimZDsTdCbGKOmF6yjhbhKYmKPO5PbbLJKs84D_CWeQ5oV8e7LLsdC21C0CjuYZ9msiYm6feC3tQNEmtGfBN7I4i_AdPbkmhDjwIfN4m_bLfNM73B9V7w5O8i_HDHBUwegW_PfdUr55I8g6TY9DRaIE98Xvnll7pSVTu4wUS6Q5ygFe3cU9mXOIfob-raLjaPQqBQ2NeIQ1RKj6v-4ClB3eswwHki6ikgj7WSLKo3n0G5edolchA0LN3vkuqbxPTbM83qS9hh9MhSFKsufFb6XJ0RGKbeyfiWmtahAWZLAJCwCuEwZyYRxuEF_xDypX07lAHczFehWUbrMlRhMoC1JNlYwASpjuiO1ATgBAGIBceWqZxOkgUECAQYAZIFBAgFGASgBi6AB-ns2WioB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAfVyRuoB6a-G9gHAPIHBBCSpxTSCCYIgOGAEBABGB0yAqoCOgmAQICAhICAhAhIvf3BOljFxMSw0quEA5oJHWh0dHBzOi8vZGFjaWEtd2ViZXItaGFuYXUuZGUvgAoDyAsB4g0TCPnsxLDSq4QDFR2q_QcdZoUMudgTCtAVAYAXAbIXHwodCAASFHB1Yi01ODg1NDY3NzY2NTQ2MTAyGI7mlQE&sigh=DBEludSs6fs&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgAvHhf_lPU5z0IkZt63lsDmuh9eDVNoBEspGbkIPqo3xjWvtxXGEgcMTS3eoenc1K-oIfExjYOSANK_bC-grqzSPQxESwmtVfXdXJCLOhgB&template_id=419&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mphealth.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1016 0
25 B 40ms
40ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BZhtA_x7NZZCPMZDgjuwPqua0mAMAAAAAOAHgBAI&bg=!DQ6lDkHNAAaxkZ3akZE7ADQBe5WfOHOP6Fr2Y_U5XK_v71x6wqfRhQYYChnSbvyvZG9XEPwrtvDMfpw6HwAnAL2Sl9CiAgAAADZSAAAAAmgBBwoAGjRMyWKmpnZkNy630zDef3y2uwlyPYbSjMAOmQMUwumHmW9NN6Eua71awlAT1lBPe7L97mG_Y5vzqdrrmh97ALQ3DiPdzVz_KUC3XCdjZVMTbIJzQTA0IizpswYkRSITQ7ROhBRYiShn3JOhFelFiGGEqToiihU1zdY2CuJegn2gLqzj-WyBDD1inv1Gxkss9yi8IZEcwXZLc_L23vNh7VDtYrRCC6o1uadRWIxH5JUdqNupvLCjSMkGIS9TNxaKvFeLf2ygJ88Mrd_Marf5T_YcH4BOznDYVhTIxBRZFLQqAW9qKJena6moBua235XZakizLcTIaiQ3P5x7tWXOANoPodwcoKdGE0ZQH5gsTXardBuzGeH2yUZPujLkg_0o8GxKQ7xCjWGS7-jLAQuhC9thmNJQM33omJnGFpuuHqgUHHESNVjavyVKIxYdV5HE-ashJNzZeMZ40XLDv9aT9uiTV_tRzebZ0ghVakZR_pWgWNuoZZdN_Pe9bAsLv4vT-6CfHdE_tS8ZA0Ayg094P9qzOAQJrd5PvRNXePgTTeHqrztww2LnO8UT5MH_GdGr51WUBNfYN6y--ZRwWyMEIEhs-gahSZopT5GucmxeeEhhzSGICAA3F7j4Uw2rBrxuNnwOsGLyAIMyewqtovRopDnN07pXpgLSdUnTpoW0WrRiKiwh2i3KGXXNoKy8T-gjh-1xWJmuwHX2Hs4AtSDipsOg-qJzusUSrlKmvtImGtGwsMzjSL1pmHkXKTQGiHTq_v4AZDDmy4CIHOKlV-eH5hWSelh364A9n_ifGSFitHy0uQ9XmjgvM-2o5E8z_VsikHrA76hWql-7gY0i05N-xIFbmc9LzMi8ZOMd1MnmQLxL7ByJetm6SWDe_RXcQy9r-cwDN6-sP1A_imMN0D9g_fVT67L3P9ckjYGSp-GXDSdKTiJPHWowDYiMEJYdYdi3OfrCSygn5Getn_PadBOU4eB8lF9TsiUzRHot5ACtSJXzH4HoWsgZlnOHpVhqVRyfMInqTH6GP3sKhB5_jTnEWZkQXO7XwXOR-BPNTZii3aGnjI3MnR34P7hvSM-XYD8d2u4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 279D 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402080201/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mphealth.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:48 GMT
expires: Thu, 13 Feb 2025 20:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8FCA 0
23 B 43ms
43ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPHmIRDTx9OCBBi109aGAjAB&v=APEucNVuXRivMRtsvLFQFY5AYCyl_3krurq2oGQerqtuyDw7xf-U55GHvIhhwCqt29F3kw83FQVydf0uvHynfpqURSGlVO7zeHTjOA9ZwM5CzbVujFsv3KElqDB0diQzomcimT2DWYmWl9wKV2V5cyQpe4ucLTCSSlb448jJfZt-tvR6Tob6MY8

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 20:13:52 GMT
expires: Wed, 14 Feb 2024 20:13:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 279D 111 KB
39 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Origin: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 17:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10744
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 15 Feb 2024 17:14:48 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/ Frame 279D 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:29:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71067
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 00:29:25 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/ Frame 279D 23 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240213/r20110914/abg_lite_fy2021.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:36:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74258
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:36:14 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 279D 41 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame 279D 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/window_focus_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:29:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74657
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 27 Feb 2024 23:29:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/ Frame 279D 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240213/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 11:45:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30504
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Feb 2024 11:45:28 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 279D 42 B
72 B 38ms
38ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ae-94oGUXs-bmV-p2a3bB4b-Hv_UZ6y3N7qba5BqBoxH7_xHmuUl_-DuzdEdgHD6s2UHuJ47lTQpFpEOc_hhyfvlqW9OcA5oqpCpJ3gB-iyWoqnXY

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Feb 2024 20:13:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 279D 204 KB
61 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com
URL: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0263ae4f7e587123e23dd226393d624068f51722610bf0cb53c56c7e1e680ede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 19:55:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62867
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-7
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:55:32 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9178 38 KB
13 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126193
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/382026566746888105/ Frame 248A 36 KB
6 KB 7ms
6ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ad106729d080be06675595d9c82304ba5b5ddf96b2ec682c905b050766e34ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 126604
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 6419
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:03:48 GMT
expires: Wed, 12 Feb 2025 09:03:48 GMT
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 279D 0
0 50ms
50ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst4VAsOcJDxTF2t_z3-H3eFAOmX5f9HAuhMZuMEdWgtWVRKF8NcrtomoJI53Ur-8-trU5w6XuYOltb9-_wh7VlIPCBkTUtnk1TOhjUXnDpqfS5jloRJ_XQfST3pXOlWdM0QZ3aTxPwoZns4s0yAvLx6Fvhs3rCPREfeZrSHbIwGvHjDVT0LXMoVRJls_3J5JHmdeeiA9DOsBkXIiBRi8XBtOZak533MQ-wa7zWZx0-xHtY2fT_4c9g0bt0PJuTjgcOYpceUZL6kCbSfd0f70ShuxenXwzaiVriwJmUeHNcLEzuT4MnCYzMOvxX5o-ozLKbzJfRXGIsXpUPE69rkpsPiwYFZrTvSVOR9Ps2G-y6-ixb1_JxDqnmapq5jEVYs_dSZ5J-lHTtW97sRLSaPs2uZi9A1A0ShoiVraXbFrRMgpyfKqAkb-Rl86ltelI2lplEY800mfyTMke84WnolO81JolPU6mVx1WROCdPofOUn2PxGXCvFvdfpymDF1OMQ_GXOM8BqAyHQ2GxfSMqXaMdMUBLVhFDxRiX22kf4aB3Oz6cAZSh0hK46aaeokcVkxKZCu_xY1Ily6rXwfY6b2qhdXgwJWQVyj5dlASgTRd9mc8RjNdw35B-RCYvk6bmSTBxH33rb3J7iHbqB1ZC43KhRWIzp2Udtwbx24LtyURgXXnASxiQv50Nj4SITtthAqMTAHEXsw1aFDHqL1mbfJAWm3CF-R8Jzy80VTbc-v_YDcGNB7lR2AG0Rk0DRo_b7MoNmwFKA6TsHrla7jaeRDrjeq9e806lF6YIEsJseO_14GTNWxtptmj-tbFJXAJEHCeatTn5YyrIa_lqCljPhGD-tZYjphJuaf3GVnsL1wcRp7KRX6Wfd6s1moXlwKqb2Ka9aiUiLWEKqps02zy7muF6y5YZMf0DfPBaypKwGpZpE0aAYQLeAzNgKpBimmsaz_hCNmbV2LolI43Jz3M8Cg15c6K1b-6f5BmZwA-7i1HZfkw4I7BwVck2PnL1EZmFjo4iQBJHyDjmdIag4YpygJd90EeCktoAJdEAzb_fM1JkS-zNnKthXFLuGupxDc5Gzb8CQ0hKrMjDCbOomCoEleGpAwSPMFXEErY-avV6XmkcvLrWnmR7sNhIIsrQJiZzcwWtXz9xclFaIa0EaNomR7xZ7ohw6lvpjJrnDeS7c1dO5t4FqAIHmu7X-sbEMBCfgzG15FADXQ13NMMasZWBOfLq0zGuOqwxF-zVV0tAwMyBFBd9A2OAyIbAn9fqiKs7R2QoizacM20jlzxJVOlHCzI41p8Klsdkam6kGNJ1uuJ1mgwk9PHHFfm8Lc0C_VWjyl6r3HAHbqLfd8zu-qc0sC7zhbHUWjb4NYmJ7X_kUylU-oZ1RPD2G_lMPB7GX0JEbL18lupD_&sai=AMfl-YSqcJaOHr6Aw6Nglfsw0wxySPIpEUJFG_k28nXbVv9GUhnnYuQw_3Zct3B3iXehyDh2jl0NloUZcCnGvnvP57dnZjn8IlZlJGRMKw1O9x8MJqQz4wRYM8oM15OaxnBSjl-po5cRsfB-7EkmtdCaTxn8e4tB9uRHDQWQeizu5Ykj85KFf1HxUJouUKw0yWBZeIWSwaVT18N2eSNiwgBbZ5ZNn5lxK3JI5gKgD89U1zrwO4CKy492U4MJZcUjdtuJlLsixKHeBrhgY5LmyLnhfy6Us5j1aLXW_Eb-y9Gt9C992Vn9W3uaYfPwX6oyxNn0i-DPkjHsIeRgtVMfnqw77rWdsh-7IIUVDkbooKdV7WyGw_p5vRqRRVsmnx-01794uhUHu6CulPFb10PR-ouS8aIEXiU7OLuEMUkDJlsJff-mMiqw5hcxDQ-4yAaReMjiFQnfamN-p_dOWdRrFhSFUR7ooqDwurzMJkjCBN9ogaf0HWBA7MV_haCcZzb2aOMPH8sM4zEdUkv6Ig&sig=Cg0ArKJSzBUErCgNllyOEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly80ZnJhbmtmdXJ0LmRl&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=15&cbvp=1&cstd=14&cisv=r20240213.67047&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f993faf368fd9651838c2835009a7a6f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 14 Feb 2024 20:13:52 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 14 Feb 2024 20:13:52 GMT

GET
DATA 200
OK truncated
/ Frame 279D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e6eb23a36b9d6171d5e1e2f2baaa6b06917bd694767671fb1a4cd7d4f2ba1c0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 0411811fcddd006df8f5e7c9b2651821.js Show response
s0.2mdn.net/sadbundle/382026566746888105/ Frame 248A 81 KB
24 KB 8ms
8ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/0411811fcddd006df8f5e7c9b2651821.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3cf53a072a0d47dc4a28bb7796c231eeaec427f2eaa80a14d6a4d4cf668bfa6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:50:48 GMT
date: Tue, 13 Feb 2024 08:50:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127384
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24223
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js Show response
pagead2.googlesyndication.com/bg/ Frame 9178 51 KB
20 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNhlv5sea-oDTsdMVC1Eb9NbJKPPeymnKy6ovSZ5Mj0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d865bf9b1e6bea034ec74c542d446fd35b24a3cf7b29a72b2ea8bd2679323d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125840
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19987
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 09:16:32 GMT

GET
H3 200 7724c54327068c6537a6f009cf4e35b4.jpg
s0.2mdn.net/sadbundle/382026566746888105/media/ Frame 248A 17 KB
17 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/media/7724c54327068c6537a6f009cf4e35b4.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d593af06ec4f1ad270faa4056f71db8c92b40c6f30a03eb253f7b29dcd20beb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 09:11:59 GMT
date: Tue, 13 Feb 2024 09:11:59 GMT
x-content-type-options: nosniff
age: 126113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17207
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 19b95ae41a9903997906a2a53325b2d8.svg
s0.2mdn.net/sadbundle/382026566746888105/media/ Frame 248A 364 B
299 B 12ms
12ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/media/19b95ae41a9903997906a2a53325b2d8.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b2f5c01a6d67444db8d4730f2206386da7ca7359806e56438f0c26f180220e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:40:18 GMT
date: Wed, 14 Feb 2024 02:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63214
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 259
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 8536ae1f1068e126b7a6b2a1d2af155d.svg
s0.2mdn.net/sadbundle/382026566746888105/media/ Frame 248A 990 B
408 B 12ms
11ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/media/8536ae1f1068e126b7a6b2a1d2af155d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b63abcbff7befd2dfb11d24a818a0b8a95a3a353670a830e07d5f7dafdfd9113

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 20:03:56 GMT
date: Tue, 13 Feb 2024 20:03:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 368
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 theinhardt_500_normal.ttf
s0.2mdn.net/sadbundle/382026566746888105/fonts/ Frame 248A 90 KB
42 KB 9ms
8ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/fonts/theinhardt_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae579f4a45268584ab5575b7c1d5c5f7a4c858a1a8c706c76d22e7c5554b7d62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 02:44:31 GMT
date: Wed, 14 Feb 2024 02:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62961
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42561
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 theinhardt_700_normal.ttf
s0.2mdn.net/sadbundle/382026566746888105/fonts/ Frame 248A 91 KB
41 KB 9ms
9ms Font
font/ttf 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/382026566746888105/fonts/theinhardt_700_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

056cf69bd02e7b6c0eb358416868042c64ba693d59d7daa4eb98a2d67dcea62e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/382026566746888105/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:51:42 GMT
date: Tue, 13 Feb 2024 08:51:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127330
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41821
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 12:07:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 279D 0
0 41ms
40ms Fetch
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst4VAsOcJDxTF2t_z3-H3eFAOmX5f9HAuhMZuMEdWgtWVRKF8NcrtomoJI53Ur-8-trU5w6XuYOltb9-_wh7VlIPCBkTUtnk1TOhjUXnDpqfS5jloRJ_XQfST3pXOlWdM0QZ3aTxPwoZns4s0yAvLx6Fvhs3rCPREfeZrSHbIwGvHjDVT0LXMoVRJls_3J5JHmdeeiA9DOsBkXIiBRi8XBtOZak533MQ-wa7zWZx0-xHtY2fT_4c9g0bt0PJuTjgcOYpceUZL6kCbSfd0f70ShuxenXwzaiVriwJmUeHNcLEzuT4MnCYzMOvxX5o-ozLKbzJfRXGIsXpUPE69rkpsPiwYFZrTvSVOR9Ps2G-y6-ixb1_JxDqnmapq5jEVYs_dSZ5J-lHTtW97sRLSaPs2uZi9A1A0ShoiVraXbFrRMgpyfKqAkb-Rl86ltelI2lplEY800mfyTMke84WnolO81JolPU6mVx1WROCdPofOUn2PxGXCvFvdfpymDF1OMQ_GXOM8BqAyHQ2GxfSMqXaMdMUBLVhFDxRiX22kf4aB3Oz6cAZSh0hK46aaeokcVkxKZCu_xY1Ily6rXwfY6b2qhdXgwJWQVyj5dlASgTRd9mc8RjNdw35B-RCYvk6bmSTBxH33rb3J7iHbqB1ZC43KhRWIzp2Udtwbx24LtyURgXXnASxiQv50Nj4SITtthAqMTAHEXsw1aFDHqL1mbfJAWm3CF-R8Jzy80VTbc-v_YDcGNB7lR2AG0Rk0DRo_b7MoNmwFKA6TsHrla7jaeRDrjeq9e806lF6YIEsJseO_14GTNWxtptmj-tbFJXAJEHCeatTn5YyrIa_lqCljPhGD-tZYjphJuaf3GVnsL1wcRp7KRX6Wfd6s1moXlwKqb2Ka9aiUiLWEKqps02zy7muF6y5YZMf0DfPBaypKwGpZpE0aAYQLeAzNgKpBimmsaz_hCNmbV2LolI43Jz3M8Cg15c6K1b-6f5BmZwA-7i1HZfkw4I7BwVck2PnL1EZmFjo4iQBJHyDjmdIag4YpygJd90EeCktoAJdEAzb_fM1JkS-zNnKthXFLuGupxDc5Gzb8CQ0hKrMjDCbOomCoEleGpAwSPMFXEErY-avV6XmkcvLrWnmR7sNhIIsrQJiZzcwWtXz9xclFaIa0EaNomR7xZ7ohw6lvpjJrnDeS7c1dO5t4FqAIHmu7X-sbEMBCfgzG15FADXQ13NMMasZWBOfLq0zGuOqwxF-zVV0tAwMyBFBd9A2OAyIbAn9fqiKs7R2QoizacM20jlzxJVOlHCzI41p8Klsdkam6kGNJ1uuJ1mgwk9PHHFfm8Lc0C_VWjyl6r3HAHbqLfd8zu-qc0sC7zhbHUWjb4NYmJ7X_kUylU-oZ1RPD2G_lMPB7GX0JEbL18lupD_&sai=AMfl-YSqcJaOHr6Aw6Nglfsw0wxySPIpEUJFG_k28nXbVv9GUhnnYuQw_3Zct3B3iXehyDh2jl0NloUZcCnGvnvP57dnZjn8IlZlJGRMKw1O9x8MJqQz4wRYM8oM15OaxnBSjl-po5cRsfB-7EkmtdCaTxn8e4tB9uRHDQWQeizu5Ykj85KFf1HxUJouUKw0yWBZeIWSwaVT18N2eSNiwgBbZ5ZNn5lxK3JI5gKgD89U1zrwO4CKy492U4MJZcUjdtuJlLsixKHeBrhgY5LmyLnhfy6Us5j1aLXW_Eb-y9Gt9C992Vn9W3uaYfPwX6oyxNn0i-DPkjHsIeRgtVMfnqw77rWdsh-7IIUVDkbooKdV7WyGw_p5vRqRRVsmnx-01794uhUHu6CulPFb10PR-ouS8aIEXiU7OLuEMUkDJlsJff-mMiqw5hcxDQ-4yAaReMjiFQnfamN-p_dOWdRrFhSFUR7ooqDwurzMJkjCBN9ogaf0HWBA7MV_haCcZzb2aOMPH8sM4zEdUkv6Ig&sig=Cg0ArKJSzBUErCgNllyOEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly80ZnJhbmtmdXJ0LmRl&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=81&vt=11&dtpt=66&dett=3&cstd=14&cisv=r20240213.67047&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: mphealth.online
URL: https://mphealth.online/verify/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS