urlscan.io logo urlscan.io
SecurityTrails logo

safehaven.com Open in urlscan Pro
54.68.214.87  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://safehaven.com/
Effective URL: https://safehaven.com/
Submission Tags: tranco_l324
Submission: On November 17 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 112 IPs in 14 countries across 99 domains to perform 456 HTTP transactions. The main IP is 54.68.214.87, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is safehaven.com.
TLS certificate: Issued by Amazon on October 6th 2021. Valid for: a year.
This is the only time safehaven.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 54.68.214.87 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
15 143.204.98.66 16509 (AMAZON-02)
5 2606:4700:303... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
11 2600:9000:215... 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 2600:9000:215... 16509 (AMAZON-02)
1 2600:9000:215... 16509 (AMAZON-02)
15 2600:9000:215... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.34 15169 (GOOGLE)
10 142.250.186.98 15169 (GOOGLE)
5 143.204.95.188 16509 (AMAZON-02)
1 23 151.101.2.137 54113 (FASTLY)
3 2a03:2880:f01... 32934 (FACEBOOK)
5 2606:4700:10:... 13335 (CLOUDFLAR...)
2 89.187.169.47 60068 (CDN77 ^_^)
2 2606:4700::68... 13335 (CLOUDFLAR...)
9 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 51.89.7.198 16276 (OVH)
1 143.204.98.38 16509 (AMAZON-02)
1 104.111.219.144 16625 (AKAMAI-AS)
1 46.105.202.126 16276 (OVH)
3 13 185.33.221.89 29990 (ASN-APPNEX)
1 3 147.75.61.140 54825 (PACKET)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
10 18.203.227.77 16509 (AMAZON-02)
1 23 34.98.64.218 15169 (GOOGLE)
2 8 167.172.1.14 14061 (DIGITALOC...)
1 3 72.251.249.13 29791 (VOXEL-DOT...)
5 18.197.116.184 16509 (AMAZON-02)
5 2602:803:c002... 26667 (RUBICONPR...)
5 35.157.246.167 16509 (AMAZON-02)
3 185.64.189.112 62713 (AS-PUBMATIC)
5 13 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
8 18.222.97.191 16509 (AMAZON-02)
4 2a03:2880:f11... 32934 (FACEBOOK)
1 34.102.183.26 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 35.153.9.102 14618 (AMAZON-AES)
3 2a00:1450:400... 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2 2a02:2638::1c 44788 (ASN-CRITE...)
2 178.250.2.146 44788 (ASN-CRITE...)
4 213.19.147.42 3356 (LEVEL3)
1 18.196.20.13 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
32 2a00:1450:400... 15169 (GOOGLE)
20 2a00:1450:400... 15169 (GOOGLE)
2 4 142.250.186.70 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 185.29.134.245 30419 (MEDIAMATH...)
9 143.204.98.49 16509 (AMAZON-02)
1 88.99.165.19 24940 (HETZNER-AS)
1 2.18.233.201 16625 (AKAMAI-AS)
1 34.210.245.148 16509 (AMAZON-02)
3 151.101.193.108 54113 (FASTLY)
6 184.30.20.198 16625 (AKAMAI-AS)
7 7 18.194.17.206 16509 (AMAZON-02)
6 9 18.156.0.31 16509 (AMAZON-02)
14 27 142.250.186.130 15169 (GOOGLE)
5 10 52.223.40.198 16509 (AMAZON-02)
5 5 151.101.66.49 54113 (FASTLY)
1 4 138.201.84.252 24940 (HETZNER-AS)
2 2 2620:112:f002... 6336 (TURN-US-ASN)
1 2001:678:cb4:... 56396 (AMOBEE)
4 5 2620:116:800d... 16509 (AMAZON-02)
4 5 2a00:1288:110... 34010 (YAHOO-IRD)
2 2 81.222.128.216 20597 (ELTEL-AS)
7 7 185.29.132.241 30419 (MEDIAMATH...)
6 7 37.157.6.247 198622 (ADFORM)
1 198.47.127.19 3257 (GTT-BACKB...)
2 2 213.155.156.180 1299 (TWELVE99 ...)
1 4 185.64.190.80 62713 (AS-PUBMATIC)
1 185.64.190.81 62713 (AS-PUBMATIC)
5 5 51.79.83.225 16276 (OVH)
3 3 52.17.84.146 16509 (AMAZON-02)
1 2 2606:4700:10:... 13335 (CLOUDFLAR...)
1 159.122.14.34 36351 (SOFTLAYER)
2 185.64.189.110 62713 (AS-PUBMATIC)
2 85.114.131.234 24961 (MYLOC-AS ...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.49.74.33 16509 (AMAZON-02)
3 3 193.0.160.129 54312 (ROCKETFUEL)
1 1 206.189.254.17 14061 (DIGITALOC...)
1 205.185.216.10 20446 (HIGHWINDS3)
6 23.79.143.124 16625 (AKAMAI-AS)
1 2620:1ec:46::44 8068 (MICROSOFT...)
1 2 35.186.253.211 15169 (GOOGLE)
2 2 18.196.197.61 16509 (AMAZON-02)
7 7 18.197.219.57 16509 (AMAZON-02)
1 1 51.75.146.161 16276 (OVH)
4 4 34.248.204.54 16509 (AMAZON-02)
4 185.86.138.144 201081 (SMARTADSE...)
1 18 34.251.173.19 16509 (AMAZON-02)
2 67.202.105.23 32748 (STEADFAST)
1 51.89.9.251 16276 (OVH)
2 185.86.138.120 201081 (SMARTADSE...)
3 9 184.30.20.241 16625 (AKAMAI-AS)
1 1 72.251.249.14 29791 (VOXEL-DOT...)
6 6 213.19.147.44 26120 (RHYTHMONE)
1 35.153.224.87 14618 (AMAZON-AES)
3 178.162.133.149 60781 (LEASEWEB-...)
4 4 82.145.213.8 39832 (NO-OPERA)
2 2 13.248.245.213 16509 (AMAZON-02)
1 1 192.96.200.41 30633 (LEASEWEB-...)
5 69.173.144.139 26667 (RUBICONPR...)
3 3 69.173.144.165 26667 (RUBICONPR...)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
1 35.244.174.68 15169 (GOOGLE)
1 2 209.54.180.144 16509 (AMAZON-02)
1 1 54.236.185.42 14618 (AMAZON-AES)
2 3 104.111.242.53 16625 (AKAMAI-AS)
2 2 51.178.20.139 16276 (OVH)
1 1 185.33.223.38 29990 (ASN-APPNEX)
2 2 18.192.77.44 16509 (AMAZON-02)
1 1 52.200.181.105 14618 (AMAZON-AES)
2 2 64.74.236.127 22075 (AS-OUTBRAIN)
1 1 104.111.215.191 16625 (AKAMAI-AS)
1 1 198.148.27.139 19189 (PULSEPOINT)
3 4 64.202.112.191 22075 (AS-OUTBRAIN)
2 2 18.196.211.83 16509 (AMAZON-02)
1 1 52.21.104.248 14618 (AMAZON-AES)
1 132.226.41.106 31898 (ORACLE-BM...)
1 169.197.150.7 398989 (DEEPINTENT)
2 2 54.229.48.81 16509 (AMAZON-02)
2 2 23.37.42.132 16625 (AKAMAI-AS)
2 18.195.155.181 16509 (AMAZON-02)
1 1 202.241.208.54 4694 (IDCF IDC ...)
2 2 185.184.8.65 204995 (RTB-HOUSE...)
1 1 178.250.0.163 44788 (ASN-CRITE...)
1 2600:9000:215... 16509 (AMAZON-02)
1 72.34.250.74 27630 (AS-XFERNET)
2 2 54.225.68.204 14618 (AMAZON-AES)
1 2600:1f18:444... 14618 (AMAZON-AES)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
1 1 66.155.71.149 13768 (COGECO-PEER1)
1 52.28.254.122 16509 (AMAZON-02)
2 2 87.98.128.108 16276 (OVH)
1 69.173.151.100 26667 (RUBICONPR...)
1 198.47.127.20 3257 (GTT-BACKB...)
456 112
2    54.68.214.87 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-68-214-87.us-west-2.compute.amazonaws.com
safehaven.com
7    2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
5    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
15    143.204.98.66 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-66.fra50.r.cloudfront.net
tagan.adlightning.com
5    2606:4700:3030::ac43:cf70 (United States)

ASN13335 (CLOUDFLARENET, US)
qd.admetricspro.com
3    2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
11    2600:9000:2156:fe00:c:5250:79c0:21 (United States)

ASN16509 (AMAZON-02, US)
d2p6ty67371ecn.cloudfront.net
2    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    2600:9000:2156:b800:10:4f52:7800:21 (United States)

ASN16509 (AMAZON-02, US)
d1o9e4un86hhpc.cloudfront.net
1    2600:9000:2156:e400:17:eca0:da80:21 (United States)

ASN16509 (AMAZON-02, US)
d32r1sh890xpii.cloudfront.net
15    2600:9000:2156:2000:3:442:6dc0:21 (United States)

ASN16509 (AMAZON-02, US)
d2t794khe5w43b.cloudfront.net
2    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net
www.googleadservices.com
10    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
securepubads.g.doubleclick.net
5    143.204.95.188 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-188.fra50.r.cloudfront.net
c.amazon-adsystem.com
23    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
ins.connatix.com
vid.connatix.com
img.connatix.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
5    2606:4700:10::6814:3677 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.pushcrew.com
2    89.187.169.47 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-89-187-169-47.cdn77.com
a.optmstr.com
a.omappapi.com
2    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
9    2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2606:4700:20::681a:9a9 (United States)

ASN13335 (CLOUDFLARENET, US)
script.4dex.io
2    51.89.7.198 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: p20.id5-sync.com
id5-sync.com
1    143.204.98.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-38.fra50.r.cloudfront.net
api.omappapi.com
1    104.111.219.144 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-219-144.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    46.105.202.126 (France)

ASN16276 (OVH, FR)
cdn.id5-sync.com
13    185.33.221.89 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
3    147.75.61.140 (Ashburn, United States)

ASN54825 (PACKET, US)
prebid.a-mo.net
1    2606:4700::6812:372 (United States)

ASN13335 (CLOUDFLARENET, US)
mp.4dex.io
1    2a02:fa8:8806:16::1460 (Singapore)

ASN41041 (VCLK-EU-SE, US)
web.hb.ad.cpe.dotomi.com
10    18.203.227.77 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
ads.servenobid.com
23    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
us-u.openx.net
gift-connect-d.openx.net
8    167.172.1.14 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
e.serverbid.com
3    72.251.249.13 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
5    18.197.116.184 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
5    2602:803:c002:200::62 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
5    35.157.246.167 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
c2shb.ssp.yahoo.com
3    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
13    2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
8    18.222.97.191 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-222-97-191.us-east-2.compute.amazonaws.com
capi.connatix.com
4    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    34.102.183.26 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 26.183.102.34.bc.googleusercontent.com
pushcrew.com
3    2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
4    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
1    35.153.9.102 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-153-9-102.compute-1.amazonaws.com
1x1.a-mo.net
3    2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
adservice.google.com
11    2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
3    2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
2    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
2    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
4    213.19.147.42 (United Kingdom)

ASN3356 (LEVEL3, US)
tag.1rx.io
1    18.196.20.13 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-20-13.eu-central-1.compute.amazonaws.com
ads.adaptv.advertising.com
2    2a00:1450:4001:801::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
32    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
20    2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cdn.ampproject.org
4    142.250.186.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net
ad.doubleclick.net
8019191.fls.doubleclick.net
3    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
3    185.29.134.245 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
tags.mathtag.com
9    143.204.98.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-49.fra50.r.cloudfront.net
math-aids-tagan.adlightning.com
1    88.99.165.19 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.19.165.99.88.clients.your-server.de
hal9000.redintelligence.net
1    2.18.233.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com
pixel.mathtag.com
1    34.210.245.148 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-245-148.us-west-2.compute.amazonaws.com
id.sharedid.org
3    151.101.193.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
6    184.30.20.198 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-198.deploy.static.akamaitechnologies.com
ads.pubmatic.com
7    18.194.17.206 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-17-206.eu-central-1.compute.amazonaws.com
pixel.advertising.com
9    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
27    142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
cm.g.doubleclick.net
10    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
5    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
4    138.201.84.252 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.252.84.201.138.clients.your-server.de
hal900024.redintelligence.net
2    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
1    2001:678:cb4:bbbb::11 (United Kingdom)

ASN56396 (AMOBEE, GB)
r.turn.com
5    2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)
cms.quantserve.com
pixel.quantserve.com
5    2a00:1288:110:c305::8000 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
pr-bh.ybp.yahoo.com
2    81.222.128.216 (Russian Federation)

ASN20597 (ELTEL-AS, RU)
PTR: ad16.adriver.ru
ssp.adriver.ru
7    185.29.132.241 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
7    37.157.6.247 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
1    198.47.127.19 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
image6.pubmatic.com
2    213.155.156.180 (Uppsala, Sweden)

ASN1299 (TWELVE99 Twelve99, Telia Carrier, SE)
PTR: 213-155-156-180.teliacarrier-cust.com
d5p.de17a.com
4    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
5    51.79.83.225 (Beauharnois, Canada)

ASN16276 (OVH, FR)
PTR: pikafka-5.cloudy.ovh
pixel.onaudience.com
3    52.17.84.146 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-84-146.eu-west-1.compute.amazonaws.com
sync.crwdcntrl.net
2    2606:4700:10::6816:1957 (United States)

ASN13335 (CLOUDFLARENET, US)
spl.zeotap.com
mwzeom.zeotap.com
1    159.122.14.34 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 22.0e.7a9f.ip4.static.sl-reverse.com
um.simpli.fi
2    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
2    85.114.131.234 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: srv21038.dus4.fastwebserver.de
cdn.contentspread.net
2    2606:4700::6812:c05 (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    52.49.74.33 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-74-33.eu-west-1.compute.amazonaws.com
ads.yieldmo.com
3    193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)
a.rfihub.com
p.rfihub.com
1    206.189.254.17 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
sync.serverbid.com
1    205.185.216.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
6    23.79.143.124 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-143-124.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
1    2620:1ec:46::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
public.servenobid.com
2    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
2    18.196.197.61 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-197-61.eu-central-1.compute.amazonaws.com
pm.w55c.net
7    18.197.219.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-219-57.eu-central-1.compute.amazonaws.com
x.bidswitch.net
1    51.75.146.161 (France)

ASN16276 (OVH, FR)
PTR: de04.roqad.pl
ws.rqtrk.eu
4    34.248.204.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-204-54.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
4    185.86.138.144 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
18    34.251.173.19 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
g2.gumgum.com
rtb.gumgum.com
2    67.202.105.23 (United States)

ASN32748 (STEADFAST, US)
PTR: ip23.67-202-105.static.steadfastdns.net
pixel.33across.com
ssc-cms.33across.com
1    51.89.9.251 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip251.ip-51-89-9.eu
onetag-sys.com
2    185.86.138.120 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
9    184.30.20.241 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-241.deploy.static.akamaitechnologies.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
1    72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
6    213.19.147.44 (United Kingdom)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    35.153.224.87 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-153-224-87.compute-1.amazonaws.com
jadserve.postrelease.com
3    178.162.133.149 (Rotterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
4    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
2    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    192.96.200.41 (Bethesda, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
sync.aralego.com
5    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
3    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    2a00:1288:80:800::7000 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)
ads.yahoo.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
2    209.54.180.144 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
1    54.236.185.42 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-185-42.compute-1.amazonaws.com
sync.extend.tv
3    104.111.242.53 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-53.deploy.static.akamaitechnologies.com
px.owneriq.net
2    51.178.20.139 (France)

ASN16276 (OVH, FR)
PTR: ns31193669.ip-51-178-20.eu
gu.dyntrk.com
1    185.33.223.38 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 400.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
2    18.192.77.44 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-77-44.eu-central-1.compute.amazonaws.com
a.sportradarserving.com
1    52.200.181.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-181-105.compute-1.amazonaws.com
sync.srv.stackadapt.com
2    64.74.236.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com
b1sync.zemanta.com
1    104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
4    64.202.112.191 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
sync.outbrain.com
2    18.196.211.83 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-211-83.eu-central-1.compute.amazonaws.com
rtb.mfadsrvr.com
1    52.21.104.248 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-104-248.compute-1.amazonaws.com
sync.ipredictive.com
1    132.226.41.106 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
1    169.197.150.7 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
2    54.229.48.81 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-48-81.eu-west-1.compute.amazonaws.com
ad.360yield.com
2    23.37.42.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
2    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
cs.emxdgt.com
1    202.241.208.54 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
2    185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
1    178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
1    2600:9000:2156:d600:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
1    72.34.250.74 (North Hollywood, United States)

ASN27630 (AS-XFERNET, US)
go.sonobi.com
2    54.225.68.204 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-68-204.compute-1.amazonaws.com
i.liadm.com
1    2600:1f18:444a:4602:2c20:3113:5c28:1366 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
1    2a02:fa8:8806:20::2040 (Singapore)

ASN41041 (VCLK-EU-SE, US)
openx2-match.dotomi.com
1    66.155.71.149 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    52.28.254.122 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-254-122.eu-central-1.compute.amazonaws.com
match.justpremium.com
2    87.98.128.108 (France)

ASN16276 (OVH, FR)
PTR: ip108.ip-87-98-128.eu
green.erne.co
1    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
1    198.47.127.20 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
simage4.pubmatic.com
Apex Domain
Subdomains		 Transfer
51 doubleclick.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
ad.doubleclick.net
cm.g.doubleclick.net
8019191.fls.doubleclick.net
223 KB
46 googlesyndication.com
pagead2.googlesyndication.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
tpc.googlesyndication.com
291 KB
31 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
ins.connatix.com
vid.connatix.com
img.connatix.com
2 MB
30 cloudfront.net
d2p6ty67371ecn.cloudfront.net
d1o9e4un86hhpc.cloudfront.net
d32r1sh890xpii.cloudfront.net
d2t794khe5w43b.cloudfront.net
2 MB
25 openx.net
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
us-u.openx.net
rtb.openx.net
gift-connect-d.openx.net
5 KB
24 adlightning.com
tagan.adlightning.com
math-aids-tagan.adlightning.com
383 KB
22 rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
pixel.rubiconproject.com
token.rubiconproject.com
secure-assets.rubiconproject.com
pixel-us-east.rubiconproject.com
41 KB
20 ampproject.org
cdn.ampproject.org
407 KB
20 yahoo.com
c2shb.ssp.yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
ads.yahoo.com
7 KB
18 gumgum.com
g2.gumgum.com
rtb.gumgum.com
6 KB
18 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
simage2.pubmatic.com
simage4.pubmatic.com
46 KB
17 adnxs.com
ib.adnxs.com
acdn.adnxs.com
secure.adnxs.com
71 KB
15 google.com
www.google.com
adservice.google.com
3 KB
11 mathtag.com
tags.mathtag.com
pixel.mathtag.com
sync.mathtag.com
7 KB
11 servenobid.com
ads.servenobid.com
public.servenobid.com
10 KB
10 adsrvr.org
match.adsrvr.org
4 KB
9 casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
9 KB
9 serverbid.com
e.serverbid.com
sync.serverbid.com
2 KB
9 googleapis.com
fonts.googleapis.com
imasdk.googleapis.com
698 KB
8 advertising.com
ads.adaptv.advertising.com
pixel.advertising.com
3 KB
8 1rx.io
tag.1rx.io
sync.1rx.io
3 KB
7 bidswitch.net
x.bidswitch.net
3 KB
7 adform.net
c1.adform.net
3 KB
7 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
42 KB
7 googletagmanager.com
www.googletagmanager.com
268 KB
6 smartadserver.com
rtb-csync.smartadserver.com
ssbsync.smartadserver.com
3 KB
6 gstatic.com
fonts.gstatic.com
www.gstatic.com
60 KB
6 pushcrew.com
cdn.pushcrew.com
pushcrew.com
128 KB
5 onaudience.com
pixel.onaudience.com
2 KB
5 quantserve.com
cms.quantserve.com
pixel.quantserve.com
2 KB
5 everesttech.net
sync-tm.everesttech.net
1 KB
5 redintelligence.net
hal9000.redintelligence.net
hal900024.redintelligence.net
9 KB
5 criteo.com
gum.criteo.com
mug.criteo.com
dis.criteo.com
2 KB
5 sharethrough.com
btlr.sharethrough.com
556 B
5 admetricspro.com
qd.admetricspro.com
266 KB
4 outbrain.com
sync.outbrain.com
1 KB
4 opera.com
t.adx.opera.com
3 KB
4 sonobi.com
sync.go.sonobi.com
go.sonobi.com
2 KB
4 bidr.io
match.prod.bidr.io
2 KB
4 facebook.com
www.facebook.com
532 B
4 google.de
www.google.de
adservice.google.de
2 KB
4 lijit.com
ap.lijit.com
ce.lijit.com
2 KB
4 a-mo.net
prebid.a-mo.net
1x1.a-mo.net
6 KB
3 liadm.com
i.liadm.com
i6.liadm.com
2 KB
3 owneriq.net
px.owneriq.net
1 KB
3 rfihub.com
a.rfihub.com
p.rfihub.com
3 KB
3 crwdcntrl.net
sync.crwdcntrl.net
1 KB
3 turn.com
ad.turn.com
r.turn.com
1 KB
3 id5-sync.com
id5-sync.com
cdn.id5-sync.com
11 KB
3 4dex.io
script.4dex.io
mp.4dex.io
24 KB
3 facebook.net
connect.facebook.net
200 KB
3 googletagservices.com
www.googletagservices.com
100 KB
2 erne.co
green.erne.co
569 B
2 creativecdn.com
creativecdn.com
695 B
2 emxdgt.com
cs.emxdgt.com
2 360yield.com
ad.360yield.com
618 B
2 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
2 zemanta.com
b1sync.zemanta.com
1 KB
2 sportradarserving.com
a.sportradarserving.com
1 KB
2 dyntrk.com
gu.dyntrk.com
850 B
2 3lift.com
eb2.3lift.com
729 B
2 unrulymedia.com
sync.targeting.unrulymedia.com
942 B
2 33across.com
pixel.33across.com
ssc-cms.33across.com
2 w55c.net
pm.w55c.net
2 KB
2 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
1 KB
2 contentspread.net
cdn.contentspread.net
25 KB
2 zeotap.com
spl.zeotap.com
mwzeom.zeotap.com
902 B
2 de17a.com
d5p.de17a.com
637 B
2 adriver.ru
ssp.adriver.ru
678 B
2 2mdn.net
s0.2mdn.net
17 KB
2 dotomi.com
web.hb.ad.cpe.dotomi.com
openx2-match.dotomi.com
848 B
2 omappapi.com
api.omappapi.com
a.omappapi.com
9 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com
84 KB
2 google-analytics.com
www.google-analytics.com
20 KB
2 cloudflare.com
cdnjs.cloudflare.com
8 KB
2 safehaven.com
safehaven.com
14 KB
1 justpremium.com
match.justpremium.com
324 B
1 sitescout.com
pixel-sync.sitescout.com
280 B
1 smaato.net
s.ad.smaato.net
241 B
1 socdm.com
tg.socdm.com
692 B
1 deepintent.com
match.deepintent.com
44 B
1 technoratimedia.com
sync.technoratimedia.com
293 B
1 ipredictive.com
sync.ipredictive.com
428 B
1 contextweb.com
bh.contextweb.com
383 B
1 bluekai.com
stags.bluekai.com
1 KB
1 stackadapt.com
sync.srv.stackadapt.com
610 B
1 extend.tv
sync.extend.tv
546 B
1 rlcdn.com
id.rlcdn.com
1 aralego.com
sync.aralego.com
412 B
1 postrelease.com
jadserve.postrelease.com
428 B
1 onetag-sys.com
onetag-sys.com
823 B
1 rqtrk.eu
ws.rqtrk.eu
513 B
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
5 KB
1 yieldmo.com
ads.yieldmo.com
35 B
1 simpli.fi
um.simpli.fi
616 B
1 sharedid.org
id.sharedid.org
212 B
1 fastclick.net
secure.cdn.fastclick.net
17 KB
1 optmstr.com
a.optmstr.com
59 KB
1 googleadservices.com
www.googleadservices.com
15 KB
456 99
Domain Requested by
32 tpc.googlesyndication.com tagan.adlightning.com
safehaven.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
cdn.ampproject.org
27 cm.g.doubleclick.net 14 redirects e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
u.openx.net
g2.gumgum.com
20 cdn.ampproject.org safehaven.com
17 rtb.gumgum.com 1 redirects g2.gumgum.com
15 d2t794khe5w43b.cloudfront.net safehaven.com
15 tagan.adlightning.com safehaven.com
tagan.adlightning.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
13 www.google.com 5 redirects safehaven.com
tagan.adlightning.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
13 ib.adnxs.com 3 redirects qd.admetricspro.com
cds.connatix.com
acdn.adnxs.com
11 pagead2.googlesyndication.com securepubads.g.doubleclick.net
srcdoc
tpc.googlesyndication.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
11 d2p6ty67371ecn.cloudfront.net safehaven.com
d2p6ty67371ecn.cloudfront.net
10 us-u.openx.net 1 redirects u.openx.net
eu-u.openx.net
gift-connect-d.openx.net
10 match.adsrvr.org 5 redirects u.openx.net
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
ssum-sec.casalemedia.com
10 ads.servenobid.com qd.admetricspro.com
public.servenobid.com
ssum-sec.casalemedia.com
g2.gumgum.com
ssbsync.smartadserver.com
10 securepubads.g.doubleclick.net www.googletagservices.com
tagan.adlightning.com
securepubads.g.doubleclick.net
safehaven.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
9 ups.analytics.yahoo.com 6 redirects
9 math-aids-tagan.adlightning.com tagan.adlightning.com
9 vid.connatix.com cd.connatix.com
9 googleads.g.doubleclick.net tagan.adlightning.com
safehaven.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
8 capi.connatix.com cd.connatix.com
8 e.serverbid.com 2 redirects qd.admetricspro.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
gift-connect-d.openx.net
7 x.bidswitch.net 7 redirects
7 c1.adform.net 6 redirects ads.pubmatic.com
7 eu-u.openx.net u.openx.net
qd.admetricspro.com
eu-u.openx.net
7 sync.mathtag.com 7 redirects
7 pixel.advertising.com 7 redirects
7 ins.connatix.com cd.connatix.com
7 www.googletagmanager.com safehaven.com
www.googletagmanager.com
6 eus.rubiconproject.com qd.admetricspro.com
eus.rubiconproject.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
6 ads.pubmatic.com cds.connatix.com
ads.pubmatic.com
qd.admetricspro.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
5 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
5 pixel.rubiconproject.com eus.rubiconproject.com
5 pixel.onaudience.com 5 redirects
5 pr-bh.ybp.yahoo.com 4 redirects eu-u.openx.net
5 sync-tm.everesttech.net 5 redirects
5 c2shb.ssp.yahoo.com qd.admetricspro.com
5 fastlane.rubiconproject.com qd.admetricspro.com
5 btlr.sharethrough.com qd.admetricspro.com
5 cdn.pushcrew.com safehaven.com
tagan.adlightning.com
5 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
5 qd.admetricspro.com safehaven.com
qd.admetricspro.com
5 fonts.googleapis.com safehaven.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
4 sync.outbrain.com 3 redirects g2.gumgum.com
4 t.adx.opera.com 4 redirects
4 sync.1rx.io 4 redirects
4 ssum-sec.casalemedia.com 2 redirects public.servenobid.com
ssum-sec.casalemedia.com
4 rtb-csync.smartadserver.com eu-u.openx.net
ssbsync.smartadserver.com
4 match.prod.bidr.io 4 redirects
4 image2.pubmatic.com 1 redirects ads.pubmatic.com
4 pixel.quantserve.com 4 redirects
4 hal900024.redintelligence.net 1 redirects e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
tagan.adlightning.com
hal900024.redintelligence.net
4 tag.1rx.io cds.connatix.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
4 www.facebook.com safehaven.com
3 px.owneriq.net 2 redirects ssum-sec.casalemedia.com
3 token.rubiconproject.com 3 redirects
3 sync.go.sonobi.com public.servenobid.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 sync.crwdcntrl.net 3 redirects
3 acdn.adnxs.com cds.connatix.com
qd.admetricspro.com
3 tags.mathtag.com e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
tagan.adlightning.com
3 www.gstatic.com e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
3 e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com securepubads.g.doubleclick.net
tagan.adlightning.com
3 img.connatix.com
3 fonts.gstatic.com fonts.googleapis.com
3 www.google.de safehaven.com
3 hbopenbid.pubmatic.com qd.admetricspro.com
cds.connatix.com
3 ap.lijit.com 1 redirects qd.admetricspro.com
3 teachingaids-d.openx.net qd.admetricspro.com
cds.connatix.com
3 prebid.a-mo.net 1 redirects qd.admetricspro.com
cds.connatix.com
3 connect.facebook.net safehaven.com
connect.facebook.net
3 cds.connatix.com safehaven.com
tagan.adlightning.com
cd.connatix.com
3 d1o9e4un86hhpc.cloudfront.net safehaven.com
3 www.googletagservices.com safehaven.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
2 green.erne.co 2 redirects
2 i.liadm.com 2 redirects
2 creativecdn.com 2 redirects
2 cs.emxdgt.com g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
2 secure-assets.rubiconproject.com 2 redirects
2 ad.360yield.com 2 redirects
2 rtb.mfadsrvr.com 2 redirects
2 b1sync.zemanta.com 2 redirects
2 a.sportradarserving.com 2 redirects
2 gu.dyntrk.com 2 redirects
2 s.amazon-adsystem.com 1 redirects ssum-sec.casalemedia.com
2 eb2.3lift.com 2 redirects
2 p.rfihub.com 2 redirects
2 sync.targeting.unrulymedia.com 2 redirects
2 ssbsync.smartadserver.com public.servenobid.com
g2.gumgum.com
2 pm.w55c.net 2 redirects
2 rtb.openx.net 1 redirects eu-u.openx.net
2 cdn.contentspread.net hal900024.redintelligence.net
2 simage2.pubmatic.com ads.pubmatic.com
2 d5p.de17a.com 2 redirects
2 8019191.fls.doubleclick.net 1 redirects tagan.adlightning.com
2 ssp.adriver.ru 2 redirects
2 ad.turn.com 2 redirects
2 u.openx.net cds.connatix.com
2 ad.doubleclick.net 1 redirects safehaven.com
2 s0.2mdn.net imasdk.googleapis.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
2 mug.criteo.com
2 gum.criteo.com 1 redirects
2 adservice.google.com tagan.adlightning.com
8019191.fls.doubleclick.net
2 id5-sync.com qd.admetricspro.com
cdn.id5-sync.com
2 script.4dex.io qd.admetricspro.com
script.4dex.io
2 maxcdn.bootstrapcdn.com safehaven.com
maxcdn.bootstrapcdn.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cdnjs.cloudflare.com safehaven.com
2 safehaven.com 1 redirects
1 simage4.pubmatic.com ads.pubmatic.com
1 pixel-us-east.rubiconproject.com eus.rubiconproject.com
1 match.justpremium.com gift-connect-d.openx.net
1 pixel-sync.sitescout.com 1 redirects
1 openx2-match.dotomi.com gift-connect-d.openx.net
1 i6.liadm.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 gift-connect-d.openx.net serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 go.sonobi.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 s.ad.smaato.net ssbsync.smartadserver.com
1 dis.criteo.com 1 redirects
1 tg.socdm.com 1 redirects
1 ssc-cms.33across.com g2.gumgum.com
1 match.deepintent.com g2.gumgum.com
1 sync.technoratimedia.com g2.gumgum.com
1 sync.ipredictive.com 1 redirects
1 bh.contextweb.com 1 redirects
1 stags.bluekai.com 1 redirects
1 sync.srv.stackadapt.com 1 redirects
1 secure.adnxs.com 1 redirects
1 sync.extend.tv 1 redirects
1 id.rlcdn.com
1 ads.yahoo.com
1 sync.aralego.com 1 redirects
1 jadserve.postrelease.com public.servenobid.com
1 ce.lijit.com 1 redirects
1 onetag-sys.com public.servenobid.com
1 pixel.33across.com public.servenobid.com
1 g2.gumgum.com public.servenobid.com
1 ws.rqtrk.eu 1 redirects
1 public.servenobid.com qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 a.rfihub.com 1 redirects
1 ads.yieldmo.com e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
1 s.tribalfusion.com e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
1 a.tribalfusion.com 1 redirects
1 um.simpli.fi ads.pubmatic.com
1 mwzeom.zeotap.com ads.pubmatic.com
1 spl.zeotap.com 1 redirects
1 image4.pubmatic.com ads.pubmatic.com
1 image6.pubmatic.com ads.pubmatic.com
1 cms.quantserve.com e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
1 r.turn.com
1 id.sharedid.org cds.connatix.com
1 pixel.mathtag.com tagan.adlightning.com
1 hal9000.redintelligence.net tagan.adlightning.com
1 ads.adaptv.advertising.com cds.connatix.com
1 adservice.google.de tagan.adlightning.com
1 1x1.a-mo.net
1 pushcrew.com
1 a.omappapi.com tagan.adlightning.com
1 web.hb.ad.cpe.dotomi.com qd.admetricspro.com
1 mp.4dex.io qd.admetricspro.com
1 cdn.id5-sync.com tagan.adlightning.com
1 secure.cdn.fastclick.net tagan.adlightning.com
1 api.omappapi.com a.optmstr.com
1 stats.g.doubleclick.net www.google-analytics.com
1 a.optmstr.com tagan.adlightning.com
1 cd.connatix.com 1 redirects
1 www.googleadservices.com www.googletagmanager.com
1 d32r1sh890xpii.cloudfront.net safehaven.com
456 168

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
plus.google.com
www.adlightning.com
Subject Issuer Validity Valid
safehaven.com
Amazon		 2021-10-06 -
2022-11-03		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-08-11 -
2022-08-10		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.cloudfront.net
Amazon		 2021-03-19 -
2022-03-17		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-08-26 -
2021-11-24		 3 months crt.sh
*.pushcrew.com
Go Daddy Secure Certificate Authority - G2		 2021-07-23 -
2022-08-24		 a year crt.sh
a.optmstr.com
R3		 2021-11-15 -
2022-02-13		 3 months crt.sh
*.id5-sync.com
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
api.opmnstr.com
Amazon		 2021-03-11 -
2022-04-09		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2021-03-11 -
2022-03-15		 a year crt.sh
cdn.id5-sync.com
R3		 2021-09-15 -
2021-12-14		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
*.a-mo.net
R3		 2021-10-21 -
2022-01-19		 3 months crt.sh
ad.cpe.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2021-07-13 -
2022-06-25		 a year crt.sh
ads.servenobid.com
Amazon		 2021-06-28 -
2022-07-27		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
e.serverbid.com
R3		 2021-10-22 -
2022-01-20		 3 months crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-04		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-14 -
2022-04-06		 6 months crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
www.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
a.omappapi.com
R3		 2021-11-15 -
2022-02-13		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.de
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-09 -
2021-12-07		 3 months crt.sh
*.1rx.io
Sectigo RSA Domain Validation Secure Server CA		 2021-06-01 -
2022-07-02		 a year crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-13		 6 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
misc-sni.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.mathtag.com
DigiCert SHA2 Secure Server CA		 2020-04-15 -
2022-04-22		 2 years crt.sh
redintelligence.net
R3		 2021-10-21 -
2022-01-19		 3 months crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA		 2021-06-29 -
2022-07-07		 a year crt.sh
id.sharedid.org
Amazon		 2021-01-08 -
2022-02-06		 a year crt.sh
cdn.adnxs.com
GlobalSign Organization Validated CA - SHA256 - G4		 2021-05-10 -
2022-06-11		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.simpli.fi
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-27 -
2022-11-27		 a year crt.sh
contentspread.net
R3		 2021-10-04 -
2022-01-02		 3 months crt.sh
*.yieldmo.com
Amazon		 2021-05-25 -
2022-06-23		 a year crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-30		 a year crt.sh
public.servenobid.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-22 -
2022-05-22		 a year crt.sh
*.pbp.bf2.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-11-03 -
2022-02-02		 3 months crt.sh
*.gumgum.com
Amazon		 2021-06-05 -
2022-07-04		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
onetag-sys.com
R3		 2021-11-02 -
2022-01-31		 3 months crt.sh
*.smartadserver.com
DigiCert ECC Secure Server CA		 2020-01-30 -
2022-02-03		 2 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.postrelease.com
Amazon		 2021-01-28 -
2022-02-25		 a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2020-12-06 -
2022-01-07		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
*.technoratimedia.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-17 -
2022-10-05		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2021-05-18 -
2022-06-19		 a year crt.sh
s.ad.smaato.net
Amazon		 2021-09-21 -
2022-10-20		 a year crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2021-08-10 -
2022-09-11		 a year crt.sh
tracking.justpremium.com
Amazon		 2021-03-01 -
2022-03-30		 a year crt.sh

This page contains 62 frames:

Primary Page: https://safehaven.com/
Frame ID: DC715445C2DF8D92DD99C67AF12C8601
Requests: 132 HTTP requests in this frame

Frame: https://cds.connatix.com/p/138955/connatix.player.dc.js
Frame ID: 0559E0F45A260799BCF5F3EEA418C8E9
Requests: 24 HTTP requests in this frame

Frame: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Frame ID: 83262196B392DC34F280F245D6BA54AB
Requests: 18 HTTP requests in this frame

Frame: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B9C39F76A3AA394A5BA3F8E2B06018AC
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: B3EFA4C1DD1E58A011A843A6671D07BA
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: 7B20617F55E8AD05B4E19FE9E2AF6227
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: F6437038F85D0911C04523B644EADB3E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: D7CC7658575808BC9F25BF4A877AC978
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 3B36D4D03C83A75F2C1F8991EF57D10B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1FDC18E6D20EFC89E687B53F344C4811
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: EF81FFF9F99E36910E0AD985ACAED1F9
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: EBB81D9288B90C059936EC43D8E7EB9E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 5C84AE7A37C2667E6E46C60183444A67
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2C371531B2BC50B5BFE2020FA88A4C23
Requests: 2 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Frame ID: 7C7A5C21E4B1037004FFA3A36E7714E8
Requests: 18 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Frame ID: 9C90CE05EF3F72D2445522D325859899
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Frame ID: 1397DB9D265C57B76840D6DD5B834606
Requests: 15 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Frame ID: F206C2993EE4A83B5232BCC2A0842633
Requests: 22 HTTP requests in this frame

Frame: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 77F42FF01CE9CDE70D4D4559473B4258
Requests: 25 HTTP requests in this frame

Frame: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A0C9CCA6FBEAC0615893978AE942EDA9
Requests: 7 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 52B9773663645784373D849B735D855A
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: FF8144AD96ED19CACDBB86504A6C7BEF
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7B396B1C6E99432D57AB37CBE30FDB65
Requests: 8 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FC02BF9D9ADDE8EF0B363FFE9107CF96
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 9A78CE32AE369A5611F9ECF9E145E4B6
Requests: 11 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5AC546BD45999C4754F33BD4EA58B839
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 103973CF1D308E89E31DD8CEE70D354B
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: 7DC8B016BD5F42C15972CFBDB24A93DE
Requests: 7 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: 3A2029D5FCDC1C61D338B70C3C1E19A8
Requests: 7 HTTP requests in this frame

Frame: https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443
Frame ID: 8E5E946995EE1709DD766D0380302D98
Requests: 2 HTTP requests in this frame

Frame: https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
Frame ID: CBEDA937AFE4B36B46DD428508C6FEE7
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 545E3BB44582E2B614B91F7783677D5E
Requests: 9 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=B0364E8B-6D29-4844-ADB9-6C1AFA5254A1
Frame ID: D8C933BCB4F81DDE0F60BE1A4DA054C7
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4378616187624166420
Frame ID: 832B3280E9FC89EC04217715BB821964
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 9F09C645A80E301A4A2E4EEEFC6D0B99
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 7890AF774BD4AFAE072E10408D38E8F1
Requests: 8 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 3B31C68D93438AB0342B7929D7877500
Requests: 10 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: BD0CB0D22B7E31FFEE9DE05BFE8BB8D3
Requests: 9 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 03C14349871AF85E3A0B94358DAB7A2A
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: AFD84D94B28DCB7B91B6D76874861CE3
Requests: 3 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437
Frame ID: 8CC70423B977EC8AD561AA2AE643AE8D
Requests: 1 HTTP requests in this frame

Frame: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Frame ID: 301B755E22E52D65F02C38BC7991A363
Requests: 16 HTTP requests in this frame

Frame: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Frame ID: 9FDF9892CC48CA89C40C822188154C36
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Frame ID: 0F00A4CC1D4343F48846BD6C40051C6B
Requests: 1 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Frame ID: 0AE1AF69FF14E91E2DC2B9BFB5A9448E
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Frame ID: 85878582CE5B99B1508332C147FF8A87
Requests: 10 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: F41A8E7C9AD010B26CD9B06215766072
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=2e2d02af-7c4a-4a07-9559-17763045ad0b&t=1639734555
Frame ID: A542297DD46D128D388E824AE4407DE1
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 06F11D6712AE6819131BB8244628E6CD
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Frame ID: EFA83A8F215DE4FD1A1604EE1F29C976
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=atm&i=YZTQGQAFL7inQwAz&gdpr=0&gdpr_consent=
Frame ID: 4BBBFC04C5E4CB7029FF00EE4C6BA149
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jMzU3Yjg0NS1hODVhLTQ5ZGEtYmI1Ni0xYzc1NTU5ZjM4NmE=&gdpr=0&gdpr_consent=
Frame ID: 135AAC91BC5A4BDD9C35EDE0AD07F8EF
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Frame ID: 237EA2A2ABA538A294421B49C0D3A9A6
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Frame ID: 179FBCE69E0FEA6C625DF3B4F219E0ED
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=YZTQG8Co5ugAAEZWn-UAAAAA
Frame ID: 6162D88F9DF7C688BD0796D44BF3E592
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=zet&i=6955244342849360110
Frame ID: 28CAD2A1854684DA8A713A683E6033CD
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=IxK4Am4b0eX031jwlNhe&pi=gumgum&tc=1
Frame ID: 0ABEC1BCFFA7A5390BE859BF877406F6
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Frame ID: DD5A2D8574BF0BF54FB651E953218871
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Frame ID: 7C1389E980776B0BF84BF40A7DA242B0
Requests: 3 HTTP requests in this frame

Frame: https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Frame ID: CB10C89FC4888F804D3605C39E01A05D
Requests: 1 HTTP requests in this frame

Frame: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Frame ID: EA29866C5C0743A547E98DA2E41B3208
Requests: 8 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Frame ID: B9E2B072CE579636ABE2499B7CFA4142
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Safehaven.com | Preservation of Capital

Page URL History Show full URLs

  1. http://safehaven.com/ HTTP 301
    https://safehaven.com/ Page URL

Page Statistics

456
Requests

82 %
HTTPS

29 %
IPv6

99
Domains

168
Subdomains

112
IPs

14
Countries

7393 kB
Transfer

15282 kB
Size

143
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://safehaven.com/ HTTP 301
    https://safehaven.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/138955/connatix.player.dc.js
Request Chain 147
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsafehaven.com%2F&domain=safehaven.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=Wqo99XxWcmU3UG5CNEc1WGxrWHN1Mmd0WThhczRydHQ5ZlN4ZFRWdXFVU3V5YjhGeVoyUUpTRTg5eUp6ZjQ5dW5qMFhBSGxBWWZlbzNuQ0Y5NG1nVFBUYVVGcU9lN3owZm1sVjh3ODhaTWxUWkVDcUZobGJNbGdhRW0yWmFKekwrdFBtbFNtc1UxVnJzM0Z2Qlc0YmFiNGVPOERndVlxQnM1QUtxU2plVXVVSUx4SWIrUjdrRGJaVlh5dUFteDJEa1FoeEh3NG9WdW9jUkF3Y0lvcndyZ0lPWEhNWWZTNlZkSlRySWtQcjl1cXZTZFJzPXw&cppv=2
Request Chain 224
  • https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) HTTP 302
  • https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CLfz76GPn_QCFQ6L3godN9wMOA;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Request Chain 244
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 258
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 261
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 262
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 292
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Request Chain 293
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=2e2d02af-7c4a-4a07-9559-17763045ad0b&_origin=1&gdpr=1&gdpr_consent=
Request Chain 294
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Request Chain 295
  • https://hal900024.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D2762840818695357478%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_cid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fsafehaven.com%2F&ancestorOrigins=https%3A%2F%2Fsafehaven.com&random=6270094745452&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
  • https://hal900024.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D2762840818695357478%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_cid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fsafehaven.com%2F&ancestorOrigins=https%3A%2F%2Fsafehaven.com&random=6270094745452&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Request Chain 296
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1&google_push=AYg5qPKBPGabfxaomBTYj8tM-SeACIGn-gNpxKWvQqXFtKqWBR62Ii8FGPCEuJ1pYUFVu20rDozQ0L7CBmK1bHN2V1BGM7AJJJ4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODk2NzM1Mjk0MjYwMjU3NDc3MQ==&gdpr=&gdpr_consent= HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1
Request Chain 298
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH4-bgbfPnzKb90ktvAuZ0k&google_cver=1&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSyu_w0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSyu_w0&google_hm=Mzk4MzUzOTg0NjkyNzcxMjM5OQ%3D%3D
Request Chain 299
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEHCsDZx6pq_IyeoEd8PZViU&google_cver=1&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBDEhhwbsEgeeMJjb4PhOzA7uYg3LY1l8 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBDEhhwbsEgeeMJjb4PhOzA7uYg3LY1l8&google_hm=QXF2bFhOSUgydGlNZi14cVh1Z2VUZ0E=
Request Chain 300
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377 HTTP 302
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377
Request Chain 303
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 305
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Request Chain 306
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=utzfyejd18Sh3tKcvNTLy73V0JihiYPOvd4SOx60
Request Chain 307
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=641922670622144214
Request Chain 310
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
Request Chain 311
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Request Chain 312
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=D7CtEF2xpR0UsqBFC7W5Rlzl90IU5aJAD7WRSQNT
Request Chain 313
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8704280253743185155
Request Chain 316
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
Request Chain 320
  • https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443 HTTP 302
  • https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443
Request Chain 325
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4378616187624166420
Request Chain 326
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sDZOi20pSEStuWwa-lJUoQ%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 327
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a6ec6194-d017-4d01-ab1b-e983e8443848
Request Chain 328
  • https://pixel.onaudience.com/?partner=214&mapped=B0364E8B-6D29-4844-ADB9-6C1AFA5254A1 HTTP 302
  • https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=bae60edfc89c0247e20dae3ca33bda37 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
  • https://pixel.onaudience.com/?partner=147&mapped=2e2d02af-7c4a-4a07-9559-17763045ad0b&icm HTTP 302
  • https://spl.zeotap.com/?zdid=1332&zcluid=25231d507455e889 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8d5312327e&zcluid=25231d507455e889&zdid=1332 HTTP 302
  • https://mwzeom.zeotap.com/mw?google_gid=CAESEHYmF91_BHbFHFX1G02NiNA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8d5312327e&zcluid=25231d507455e889&zdid=1332
Request Chain 329
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjAzNjRFOEItNkQyOS00ODQ0LUFEQjktNkMxQUZBNTI1NEEx&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 330
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIcEKZ-uajGGl2OuYW2VK9k&google_cver=1
Request Chain 332
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Request Chain 333
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=641922670622144214
Request Chain 341
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESELvCRZsaoTnWbQh4PKoFPAQ&google_cver=1&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMavbjHLl20SeXU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=puxhlNAXTQGrG-mD6EQ4SA&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMavbjHLl20SeXU
Request Chain 342
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 344
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH4-bgbfPnzKb90ktvAuZ0k&google_cver=1&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog&google_hm=OTA0Mzk2MTIwNzk3NDU2ODcwMg%3D%3D
Request Chain 345
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEHCsDZx6pq_IyeoEd8PZViU&google_cver=1&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKqxZILSNMk4vR_hU_r_O2RJ95Eb-4gcw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKqxZILSNMk4vR_hU_r_O2RJ95Eb-4gcw&google_hm=QXc3b0JndDVPZ0dQd2l4dFpLZV9vX1E=
Request Chain 347
  • https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEK7t1ondotFhMQHcyf_oAYk&google_cver=1&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbMkJSQf HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbMkJSQf&google_hm=Njk1NTI0NDM0Mjg0OTM2MDExMA==
Request Chain 361
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Request Chain 367
  • https://rtb.openx.net/sync/dds HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=gbB2WDm6z0cBOkbt-KcZ-g==&ox_sc=1&ox_init=1 HTTP 302
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Request Chain 369
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=7gJRtG971MNhz45
Request Chain 370
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx HTTP 302
  • https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=openx&g=1&gdpr_pd=&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=openx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=77c3e303-d00b-4e39-8e59-33f6f5712372
Request Chain 371
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8449438386211448846
Request Chain 372
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUF3SVQwN0RLYUFBQUNqMWpoNjdsdw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAwIT07DKaAAACj1jh67lw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cox%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAwIT07DKaAAACj1jh67lw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Request Chain 379
  • https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Request Chain 380
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID HTTP 302
  • https://ads.servenobid.com/sync?pid=312&uid=8449438386211448846
Request Chain 381
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D HTTP 302
  • https://ads.servenobid.com/sync?pid=310&uid=1dc50d1b49accb77b5a8cca4
Request Chain 382
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4537590229 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/2e2d02af-7c4a-4a07-9559-17763045ad0b HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003 HTTP 302
  • https://ads.servenobid.com/sync?pid=321&uid=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
Request Chain 384
  • https://p.rfihub.com/cm?pub=44007&in=1 HTTP 302
  • https://ads.servenobid.com/sync?pid=324&uid=6955244342849360110
Request Chain 386
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?pid=327&uid=03f1151a-199e-4b55-b5d2-963a2a707cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
Request Chain 387
  • https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D HTTP 302
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60124%26uid%3D$UID HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60124%26uid%3D%24UID HTTP 302
  • https://t.adx.opera.com/sync?vendor=60124&uid=12193933559667964209 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58484/occ HTTP 302
  • https://t.adx.opera.com/sync?vendor=60112&uid=y-afv8CqJE2uHUwxrffA8o.X4ky8mn.yH9Q9Qu6N4-~A HTTP 302
  • https://sync.aralego.com/idSync?ucf_nid=par-627D96DE43D94E241EAD99688E72B636&ucf_user_id=a2d332019cef2e9c&redirect=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fuid%3DUCFUID%26vendor%3D60114 HTTP 302
  • https://t.adx.opera.com/sync?uid=d8be43cb-3d0f-3e4e-924b-00064c27cebb&vendor=60114 HTTP 302
  • https://ads.servenobid.com/sync?operaUid=053c5325f6bd427fb8718d80aceddde1&pid=335&uid=
Request Chain 388
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIndu79e_Oe2l-p4xMvAPb4&google_cver=1
Request Chain 389
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/iW_CgSdTCI7TVkM5QzwDnMn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=9043961207974568702
Request Chain 391
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1czQ0VKVkctMjYtQ0pNMg==
Request Chain 392
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KW3CEJVG-26-CJM2&sigv=1&esig=2~d647d80a158a9feb4bbf9458a0d9cfed5086deda
Request Chain 393
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=a6ec6194-d017-4d01-ab1b-e983e8443848&expires=28
Request Chain 394
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YZTQGQAFL7inQwAz
Request Chain 397
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YZTQG.bYSobulYyrQPB.aQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMaPnOK0FxAkUYq6vUwDOHw&google_cver=1&gdpr=1&google_hm=2
Request Chain 398
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&dcc=t
Request Chain 399
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEIzktQ-JkLpX36-LvJcSQnE&google_cver=1
Request Chain 400
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=GztJ9Ek6QfkAOUShHz5dokhuE6YAbkakGz6JmH7K
Request Chain 401
  • https://sync.extend.tv/r.gif?exchange=index HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=bfc8fe84-92e8-4e72-a838-dfb6dbca4460
Request Chain 402
  • https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID) HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fdsum-sec.casalemedia.com%2fcrum%3fcm_dsp_id%3d31%26external_user_id%3dQ6904289551340172358&uid=Q6904289551340172358&ref=%2Feucm%2Fp%2Fcc HTTP 302
  • https://px.owneriq.net/noop?ct=image%2Fgif
Request Chain 403
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1 HTTP 302
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Request Chain 405
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=8449438386211448846
Request Chain 406
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_c357b845-a85a-49da-bb56-1c75559f386a&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=02706488-945b-4f0e-a02b-304be83e3758&ssp=gumgum2 HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=77c3e303-d00b-4e39-8e59-33f6f5712372
Request Chain 407
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-70e0900b-6d09-46a0-6dae-0a6bd00455a5$ip$194.36.108.20
Request Chain 408
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_c357b845-a85a-49da-bb56-1c75559f386a&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=6IQ6pfYfKqjS3-k1j6QQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2NSJKE3HAZSZMZFXC2STGMWWWMLKGZIVCJTVONPXA4TJOZQWG6J5GEWS2LI&gdpr=0&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2NSJKE3HAZSZMZFXC2STGMWWWMLKGZIVCJTVONPXA4TJOZQWG6J5GEWS2LI HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6IQ6pfYfKqjS3-k1j6QQ&us_privacy=1---
Request Chain 409
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003&rndcb=3492431408 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=77c3e303-d00b-4e39-8e59-33f6f5712372&google_hm=NzdjM2UzMDMtZDAwYi00ZTM5LThlNTktMzNmNmY1NzEyMzcy HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEPp3p1rSHftQOxSdmaLaWwU&google_cver=1&ssp=adconductor&bsw_param=77c3e303-d00b-4e39-8e59-33f6f5712372 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/77c3e303-d00b-4e39-8e59-33f6f5712372?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
Request Chain 410
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=ZUsQ70DGJKqb&ev=1&pid=558355
Request Chain 411
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28VCJUKekPMziObJhxbaBv5Wbz3J0DkUKoLZUAQezF57PmuJrypuTcOBAuxjeaRm7l%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28VCJUKekPMziObJhxbaBv5Wbz3J0DkUKoLZUAQezF57PmuJrypuTcOBAuxjeaRm7l%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_c357b845-a85a-49da-bb56-1c75559f386a&obuid=ENC(VCJUKekPMziObJhxbaBv5Wbz3J0DkUKoLZUAQezF57PmuJrypuTcOBAuxjeaRm7l) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=$D HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=$D HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=fb1c6933-e24b-40d0-b484-85d0af649749
Request Chain 412
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=a9db5814-b829-4e3f-8035-1ab7e3ee2206
Request Chain 413
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=oth&i=y-AjPNN31E2pd40oRA2L9GZKOq0jZ3G8Gnbi7k~A
Request Chain 414
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=a026b47e-478b-11ec-b40a-db78886add51
Request Chain 417
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=idi&i=857e617a-2dea-44e5-b335-0429974df9cf
Request Chain 421
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=2e2d02af-7c4a-4a07-9559-17763045ad0b&t=1639734555
Request Chain 422
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 423
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Request Chain 424
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=atm&i=YZTQGQAFL7inQwAz&gdpr=0&gdpr_consent=
Request Chain 428
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=YZTQG8Co5ugAAEZWn-UAAAAA
Request Chain 429
  • https://p.rfihub.com/cm?pub=42796&in=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=zet&i=6955244342849360110
Request Chain 430
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=IxK4Am4b0eX031jwlNhe&pi=gumgum&tc=1
Request Chain 432
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=641922670622144214&gdpr=0&gdpr_consent=
Request Chain 433
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=87443bd9-3835-4110-8798-147b496692b2&gdpr=0&gdpr_consent=
Request Chain 435
  • https://pixel.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=rXtUeP96XHW2eVktqX5ALv4uDiq2LlsorX6q7ot2
Request Chain 438
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Request Chain 442
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8449438386211448846
Request Chain 443
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YZTQG.bYSobulYyrQPB.aQAA%261104
Request Chain 444
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID HTTP 307
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=1dc50d1b49accb77b5a8cca4
Request Chain 446
  • https://pixel.advertising.com/ups/56621/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262 HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Request Chain 447
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
Request Chain 448
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D HTTP 302
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c HTTP 303
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c&_li_chk=true&previous_uuid=49805f9161fd46288d03e905d543387b HTTP 303
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
Request Chain 452
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=1 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=no-consent&gdpr=1&gdpr_consent=
Request Chain 454
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YZTQGQAFL7inQwAz
Request Chain 455
  • https://green.erne.co/openx/cm HTTP 302
  • https://pixel.onaudience.com/?mapped=wRK26hLPbSA1H9iSk3UOX1ON&partner=2&redirect=green.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072998%2526rtb%253DwRK26hLPbSA1H9iSk3UOX1ON HTTP 302
  • https://sync.crwdcntrl.net/map/c=14544/tp=BIDB?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fgreen.erne.co%252Fct%252Fcm%253Fred%253Dhttps%25253A%25252F%25252Fus-u.openx.net%25252Fw%25252F1.0%25252Fsd%25253Fid%25253D537072998%252526rtb%25253DwRK26hLPbSA1H9iSk3UOX1ON HTTP 302
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=bae60edfc89c0247e20dae3ca33bda37&redirect=https%3A%2F%2Fgreen.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072998%2526rtb%253DwRK26hLPbSA1H9iSk3UOX1ON HTTP 302
  • https://green.erne.co/ct/cm?red=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072998%26rtb%3DwRK26hLPbSA1H9iSk3UOX1ON HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072998&rtb=wRK26hLPbSA1H9iSk3UOX1ON
Request Chain 456
  • https://ad.turn.com/r/cs?pid=9&gdpr=1 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8967352942602574771&gdpr=1&gdpr_consent=&us_privacy=

456 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
safehaven.com/
Redirect Chain
  • http://safehaven.com/
  • https://safehaven.com/
88 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://safehaven.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.68.214.87 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-68-214-87.us-west-2.compute.amazonaws.com
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash
79b15b95bca31b2109d327202b9c538e9e5dd2ed85db0ad00bff927f6568497c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Wed, 17 Nov 2021 09:49:07 GMT
content-type
text/html; charset=UTF-8
content-length
12882
server
Apache/2.4.41 (Amazon) PHP/5.6.40
x-powered-by
PHP/5.6.40
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
vary
Accept-Encoding,User-Agent
content-encoding
gzip

Redirect headers

Date
Wed, 17 Nov 2021 09:49:07 GMT
Content-Type
text/html; charset=iso-8859-1
Content-Length
230
Connection
keep-alive
Server
Apache/2.4.41 (Amazon) PHP/5.6.40
Location
https://safehaven.com/
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-2249023-27
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4d0f3c00fd4cdd1fe64dfa1a9ece98d1bcf5640d2b704946f702d71d46f6b2ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36182
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-814550776
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
807032880f7f3db70133f4a9d1507882124d2b22c804b138a9313ef4657332f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39535
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
css
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:500&display=swap
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c6f02ea61b580dd0d3d5fd8b473d8584ab32e741a5a969704928df2d2753a44e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 08:44:33 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 17 Nov 2021 09:49:08 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 17 Nov 2021 09:49:08 GMT
op.js
tagan.adlightning.com/math-aids/ 		59 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/op.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7511782a904a1bd83ae7e9b2d676c13f6e311b06c159dda26321ab6b533372b1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id
Sj4vjgH6tCBabc.9o0k_A4dp6M6NsaAn
content-encoding
gzip
etag
"fbb5cfa71ac4d24a9719c43f6e6b1990"
age
2993
x-cache
Hit from cloudfront
content-length
24245
x-amz-meta-git_commit
7b120a5
last-modified
Tue, 16 Nov 2021 22:10:00 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 08:59:25 GMT
content-type
application/javascript
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
zQ7cpGrV6rrRiCRqNcQqkpJGhhDOFjUImqJe6dHYw0UeJsLeCRo0eg==
layout.js
qd.admetricspro.com/js/safehaven/ 		17 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/safehaven/layout.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c7543adb08df72037fa41e361d3477fb3a018efc6da63ce50297d7d6ec6bb79

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Thu, 28 Oct 2021 21:07:56 GMT
server
cloudflare
etag
W/"4409-5cf701aced35b-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tou2%2FrdI8Dh7vlaA%2Fjp7%2Fi7qz59%2BpyqGo%2Fg873fwJ7rm4eeNHpcUQSllsUae25r%2FETGcCUYiVLVGJla4C1gnyXsqOAYmm%2B5bkYAbpatIeq8%2BmwVmgyE2qZHSNkW8ppk4F7ZXIL4WeGGZoYNBfJ8C7p%2Fe"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6af80c1e3b9d0eaf-FRA
expires
Wed, 17 Nov 2021 09:59:08 GMT
gpt.js
www.googletagservices.com/tag/js/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
edefa0e43fe019265a85f3510611b5ac610a960183a56011d082f460534b9c9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1046 / 0 of 1000 / last-modified: 1637142009"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26678
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 17 Nov 2021 09:49:08 GMT
cmp.js
qd.admetricspro.com/js/safehaven/ 		310 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/safehaven/cmp.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Tue, 01 Jun 2021 14:47:10 GMT
server
cloudflare
etag
W/"4d957-5c3b56abf6028-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bfikOA15E9FnLv6tY0E8PKTEbvf5r3BCnXweKCeJ8a1xYnIlZZT9vkv2PMGB9fCsW6DHdEN7lkTYkK%2F%2BDjnvk0Pw5gmGNtLl6LPfSJRNQ16Yb3XxwTugp6gNeICq9p4%2F2ryxpCfrTPPS6o%2Fykopdu8bB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6af80c1e3ba10eaf-FRA
expires
Wed, 17 Nov 2021 09:59:08 GMT
prebid.js
qd.admetricspro.com/js/safehaven/ 		430 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/safehaven/prebid.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Thu, 14 Oct 2021 15:35:01 GMT
server
cloudflare
etag
W/"6b738-5ce51d26ef74c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Ty7jctvyoh%2F%2FPkbFxKrXuT8NfwZk54gGgeYkuEyLwKkTCd0AL6jK53phBhON3fCMZTX8fX9tUGZuQMCCjThWvv0PmTNbc4l6OsFAOKWaMZ9A3gwQ9hg4aAssQWccG2aBM6vnLeYZ0zfaYUJECmOSvTP"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6af80c1e3ba00eaf-FRA
expires
Wed, 17 Nov 2021 09:59:08 GMT
engine.js
qd.admetricspro.com/js/safehaven/ 		35 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/safehaven/engine.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a355508d811ac666d1b61e566f7f1daf5d39b8915c036b271f14a4cfb9247ac3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Fri, 15 Oct 2021 02:14:43 GMT
server
cloudflare
etag
W/"8b7c-5ce5ac22db48b-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AVcouhE%2BchDhP30icbX1KxSLleXf7TzxMzM5Fa8TAoRdKpLHli%2BFseargWW0OUQ3%2F6jy4MiK4i7CK40%2BCsbd68fS%2FEaWHifgA%2Bo2ZXQDmFY4CghHxV1f6o24pus8%2FhIgrON%2FrcYRbttFg9%2BGmWedR8DW"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6af80c1e3ba20eaf-FRA
expires
Wed, 17 Nov 2021 09:59:08 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-820290545
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
272f2c33dfc57d0546a017e4c1332f451296f5d719861e1ddddb1029cc6be048
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39537
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-802310072
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
aa112d3656c8057c4e2c666dd560b14e45801e6ac3e2ca71bb843f49764d051b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39534
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
style.css
d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/ 		72 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash
0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 24 Apr 2021 04:36:33 GMT
content-encoding
gzip
age
17903555
x-powered-by
PHP/5.6.40
x-cache
Hit from cloudfront
content-length
10330
last-modified
Mon, 12 Apr 2021 09:47:04 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
etag
"pub1618220824;gz"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
9WZtS0p_qt-j3nyANQJqmjRIIphPtBkm5qq1oAZSLln47WYJzZHCpg==
expires
Sun, 24 Apr 2022 04:36:33 GMT
jquery-1.12.3.min.js
d2p6ty67371ecn.cloudfront.net/a/js/third_party/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/js/third_party/jquery-1.12.3.min.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 15:59:54 GMT
content-encoding
gzip
last-modified
Wed, 13 Oct 2021 15:01:52 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
64154
etag
"17b9c-5ce3d3e0444df-gzip"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
33794
x-amz-cf-id
FrtrOAu7A2eJ6S7iDZaLt6WyBRPrvbJzENBnlDHwmZc38Js55Sj_uw==
cookieconsent.min.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
4272726
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
948
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-f62"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fx5K7M0u%2B%2BdTkcAke3i%2BJglJ%2FNVqsiBNB1Gr6vDTuAuqA5cO6DJudesi0CTJtb4JoFWUJnXEfN0N9S6vhyO7ZvF%2F4KVTCu4V2aS2ATIsua%2F19v7KyXpUwOQc1KeVhLF2fiJvbXxGo%2FfXGgU7rKH4driN"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6af80c1e584c59a7-MXP
expires
Mon, 07 Nov 2022 09:49:08 GMT
cookieconsent.min.js
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1007841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5676
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-4d5a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AKxheZ5D47UV3Rki1%2BnWQzBz4d%2B00H8fQjYS%2F3Mzrl1R9S0FfmWXu6WaNCHbFS1okF2%2BP5QaPBGeGX2V%2B4ErV4wCRrVrmYasjtOFfE5r3JpJXkK31UJX7wTwFo42kjiFZ2TcNlcVqBWtckhnlsTwQPEO"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6af80c1e585059a7-MXP
expires
Mon, 07 Nov 2022 09:49:08 GMT
logo-no-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/logo-no-light.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 10:22:38 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:54 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
429989
etag
"470b-5ce3d3e291245"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
18187
x-amz-cf-id
VxksD8isYJq2YD6XFsIXYLZ70vVoDacEfpEk5p5c_fCHI-q-m4YeLA==
expires
Fri, 19 Nov 2021 10:22:38 GMT
logo-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/logo-light.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 05:58:32 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:49 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
100236
etag
"3d01-5ce3d3dda9531"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
15617
x-amz-cf-id
WLgMSlaCM6vg8Si3wCEdTOvKRjFjJDblkKHbI5ocbYbeqYfxCBN_ZA==
expires
Tue, 23 Nov 2021 05:58:32 GMT
chart_green.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 		32 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_green.svg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:b800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.46 (Amazon) /
Resource Hash
698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 29 May 2021 09:02:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
14863581
x-cache
Hit from cloudfront
strict-transport-security
max-age=63072000
content-length
4218
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 15 May 2020 20:20:29 GMT
server
Apache/2.4.46 (Amazon)
etag
"80e2-5a5b58b642126-gzip"
vary
Cookie,Accept-Encoding
content-type
image/svg+xml
via
1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
cb59rNOEkauBMd0Q67OzbqvZasjWAHqB7P3aKQQw2E6yMDoCaPgpEQ==
expires
Sun, 29 May 2022 09:02:47 GMT
chart_red_flip.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 		15 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_red_flip.svg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:b800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 () /
Resource Hash
c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 13 Nov 2021 14:59:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
326991
x-cache
Hit from cloudfront
strict-transport-security
max-age=63072000
content-length
1798
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 30 Apr 2021 15:09:17 GMT
server
Apache/2.4.51 ()
etag
"3ca0-5c131fee2b3ee-gzip"
vary
Cookie,Accept-Encoding
content-type
image/svg+xml
via
1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
6wHW8y5adtKh-XfZ8T-3umef4dmWBChF1TamfRUqAwI5zlTWA-hCWw==
expires
Sun, 13 Nov 2022 14:59:17 GMT
chart.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 		27 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart.svg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:b800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 () /
Resource Hash
c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 17:32:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1959402
x-cache
Hit from cloudfront
strict-transport-security
max-age=63072000
content-length
4143
x-xss-protection
1; mode=block
referrer-policy
no-referrer
last-modified
Fri, 30 Apr 2021 15:08:46 GMT
server
Apache/2.4.51 ()
etag
"6c58-5c131fd110228-gzip"
vary
Cookie,Accept-Encoding
content-type
image/svg+xml
via
1.1 d627b75d0c1aedd3691390ac8498d3b0.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
7r3dJxp3ueCWNCJTQY49-J6B8JkeFn4RA2Py3cxSC97tDw0WSSkGhA==
expires
Tue, 25 Oct 2022 17:32:25 GMT
blend_45_2.png
d32r1sh890xpii.cloudfront.net/header_graphs/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d32r1sh890xpii.cloudfront.net/header_graphs/blend_45_2.png?cb=1637142303
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:e400:17:eca0:da80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7853ef14abb631943ddbae7ea2b301e44bf8ffc7b13fed0a8c36bbd09da6370f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id
8bLP60Sg1CNaJR2Z4KJhaD3prysRnymS
via
1.1 a09186728c1bcdf0a561aedd92656804.cloudfront.net (CloudFront)
last-modified
Wed, 17 Nov 2021 09:46:04 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"57ddb3d9bc88c0f84f0ab30ed2073a60"
x-cache
Hit from cloudfront
content-type
image/png
date
Wed, 17 Nov 2021 09:49:08 GMT
accept-ranges
bytes
content-length
7713
x-amz-cf-id
saCI-bcqsgO96-TNrs6ZVne8niIUUwEZ-DqNLloqs0R8Vfai1_EuaA==
24d68d471e6b39c1133b8b2a5d75fa70.jpg
d2t794khe5w43b.cloudfront.net/article/718x300/ 		139 KB
140 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/718x300/24d68d471e6b39c1133b8b2a5d75fa70.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b227b4c931fa403fa96046f4afdda7212df6f0d2d1253e15ca4d60a59f1aad98

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 07:13:20 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Tue, 16 Nov 2021 00:10:32 GMT
server
AmazonS3
age
9348
etag
"a061e8efddb8906b1654658b87871d1f"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
142832
x-amz-cf-id
OwkdDYiW2uwZUqCpYKHbViJaizLz2q2_5wXN1EnEb7HCZVocHDKXmA==
422812b6733241c54684a400c78a593a.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/422812b6733241c54684a400c78a593a.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6aba7347066660c96b92dfb152af283c56d48f747d9d99d0d8af612a3c58fa05

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 17:34:21 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Fri, 12 Nov 2021 16:50:03 GMT
server
AmazonS3
age
58488
etag
"9081b033eb50853d4fd3ff7df05a7290"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
144915
x-amz-cf-id
2OC9hLi7JUwDnkxUDyXAgG2NPhfQfZ4zIceNPMeiy4UGcp300i9TuQ==
317e34e44322455e3f3206628cb96010.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		114 KB
114 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/317e34e44322455e3f3206628cb96010.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9e5d8ecb3c8a58c2e27da6415c2903f5feb9f1e16fb4237b0e8a96acb9a9517e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 00:43:53 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Tue, 09 Nov 2021 23:20:40 GMT
server
AmazonS3
age
32716
etag
"747a0c6a6c86c101e0f3d0f6f91664e9"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
116757
x-amz-cf-id
g_cFfzGd4pYJTIKTwYBkCGhPMVWysuw04F5nVuFZ2McXPmFnkEz3lw==
5875334560c1af5e22a8dcf4765eef71.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		108 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/5875334560c1af5e22a8dcf4765eef71.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1efc74e10db1498e7e53885e69f4fdd2707e4c1590a4997464476b5f8b8fab1d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 17:34:21 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Fri, 12 Nov 2021 16:54:17 GMT
server
AmazonS3
age
58488
etag
"c87b15bcb49f78a76de7166bb3e9ae38"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
110629
x-amz-cf-id
EAslryYFy0TlbQyj5gQLmrqwYezDW1KSQOfakOdU-J05ChNqB8Rt8Q==
e0a7df00aa8c48053ac9e1f66fcafb66.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		70 KB
70 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/e0a7df00aa8c48053ac9e1f66fcafb66.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7ac96b7b4ad3f59ec56a4a3d52de2ca8bd232958da976a390ea4623a698c8025

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Fri, 12 Nov 2021 16:46:55 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"5243f93ed7494ae257427c42748bb63b"
x-cache
Hit from cloudfront
content-type
application/octet-stream
accept-ranges
bytes
content-length
71449
x-amz-cf-id
u9XAqf5kmH6IOPrO1Rkuzy2jBAKdZUoxva9m9lCUAfQ1NeRzgUWtBw==
f0e7eb92f930014a341dbccae104a88a.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		123 KB
124 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/f0e7eb92f930014a341dbccae104a88a.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ab82123bc03074522b22b00cd813f18651b82d035a16769296af893d231e1b58

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 04:05:40 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Mon, 08 Nov 2021 16:08:32 GMT
server
AmazonS3
age
20609
etag
"8c8195705ba1efa6eb04593950e3dec0"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
126241
x-amz-cf-id
3rUcIXFdCe6XOLC2o-uku_YapMXisU-VYPE1Hulr-hxVBtw4L4wyJw==
33e59ad0a1d39b997bd86093804c7fbb.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		183 KB
184 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/33e59ad0a1d39b997bd86093804c7fbb.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3f1912ff02efa15c167d148bf5381d3553ec91c6838e285adc1910ed3a7ea041

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Thu, 04 Nov 2021 17:49:18 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"787d0af49ed5adfbd2abcf60c9098517"
x-cache
RefreshHit from cloudfront
content-type
application/octet-stream
accept-ranges
bytes
content-length
187506
x-amz-cf-id
SGWBYepoOt4cT9hvRqUpojW11XxUXwVNR8hOBSc11Y9-2wWXWF8DoQ==
00ade988cff6c706301b97052282ee2a.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		95 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/00ade988cff6c706301b97052282ee2a.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1e9e614ccaf90d11329d6acab03126c195d911f9eee3513debcdb696cc713f0d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 06:45:12 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Wed, 03 Nov 2021 13:51:09 GMT
server
AmazonS3
age
11037
etag
"ffcc7adcd76e54b390c2496eaa6ddaa3"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
96790
x-amz-cf-id
Lo8ohxn4CiCfD3g5HdACFJ6N4y7VyExwM1zyHJfn8YDIzqZvi4snSg==
57f7059f5c95a97ebf16044737073503.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		91 KB
92 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/57f7059f5c95a97ebf16044737073503.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7887765805505fd68b6855690d81b1533dd991da072c52d9777365a51b2a9ae2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 04:19:12 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Mon, 01 Nov 2021 20:08:49 GMT
server
AmazonS3
age
19797
etag
"e28d799d4b483935e63d3d41b08eeec4"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
93611
x-amz-cf-id
MssDMjLmGScSia7I1AnKTdrqAuo6iXkSijaEizuXUjgNYPKiyYFsSg==
55913f738d6b46fefbcaa535e0a37d37.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		104 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/55913f738d6b46fefbcaa535e0a37d37.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b47100ebc4ff018fe95d6ab97131fedceb1f832528b985862613702f8502f77f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Fri, 29 Oct 2021 15:10:36 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"f0ddb6fa4048647da8c1fd0560b417ed"
x-cache
RefreshHit from cloudfront
content-type
application/octet-stream
accept-ranges
bytes
content-length
106695
x-amz-cf-id
hGS5jxfw0rANnzshZAxKfDnCcfRsUL-KoAEkkWcPWTD3U1sD8pqw2A==
de7ab256e78efedddd3d2e096b714dc8.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		121 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/de7ab256e78efedddd3d2e096b714dc8.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0d1122b9392164ebc5e82b6600f8e579b1c2246b97ec3cf2e8e27886fb2d0ddb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 08:01:47 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Thu, 28 Oct 2021 19:08:51 GMT
server
AmazonS3
age
6442
etag
"49f97e1becb9b2ef0790d4ce488b1ea3"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
123803
x-amz-cf-id
Xu0WgQuIW2igbsW-pH9aFllWE97HrGewMRVUOIeBhkt1MNHJlOzotQ==
0e7240a0a04b87b977e243939263c984.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		86 KB
86 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/0e7240a0a04b87b977e243939263c984.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
caa2dc8bcd978c8252652981e5de0ebccc280c17fbd94690dd95b85bba6e6e16

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 06:45:12 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Wed, 27 Oct 2021 22:07:49 GMT
server
AmazonS3
age
11037
etag
"a68fc4bb3c1ae7a24350cb8ff4c83aa9"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
87734
x-amz-cf-id
aGSosoJdgFEgHjFlglFz8U0XgI-qCeQsS2qvLUOj1OioEWdaIQlsDQ==
f32053d552e5a13580403a04d0fae7af.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		110 KB
111 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/f32053d552e5a13580403a04d0fae7af.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9def9010777d9b94bef87624b66760e86ec040c7889ccb80dcb0c36ab56e2ac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 21:25:43 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Tue, 26 Oct 2021 21:17:45 GMT
server
AmazonS3
age
44606
etag
"dd187bd4f91010446988d7bef25ac8c7"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
112868
x-amz-cf-id
kKPsgrgvrUbOAK2a8CZOx1vbC3Mk32ykpEypchcuNaS1dfP2ULHOKQ==
095ddf63710b1a6c135929184f47fdad.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		168 KB
169 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/095ddf63710b1a6c135929184f47fdad.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
462da5681196228ae4ed1e3496df6075e199c79ad95227f6613462cfd32bea7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Mon, 25 Oct 2021 14:39:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"91791b8758f1cfd2198d14b5a4615ed7"
x-cache
Hit from cloudfront
content-type
application/octet-stream
accept-ranges
bytes
content-length
172294
x-amz-cf-id
gL-3E9p9734ZIjpXkUNrYhREtGFyVG92T_3hdrZKb-8tsIxcEdb3Uw==
24d68d471e6b39c1133b8b2a5d75fa70.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 		99 KB
100 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2t794khe5w43b.cloudfront.net/article/495x320/24d68d471e6b39c1133b8b2a5d75fa70.jpg
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
40c64c974b65ffdb2ab2e74777867f4ac23997321ca18e087f25239b2910a23d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 01:23:25 GMT
via
1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
last-modified
Tue, 16 Nov 2021 00:10:33 GMT
server
AmazonS3
age
30344
etag
"7e0cd71d5a1faf4687d07b4c871bdd08"
x-cache
Hit from cloudfront
content-type
application/octet-stream
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
101780
x-amz-cf-id
q0P9VsyFNw-cMjO7dBThx0J7E6Qv_q8Q7-1KbwDiDJ1dzZwNUDhBBw==
envolope.png
d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/envolope.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 05:58:33 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:51 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
100235
etag
"543c-5ce3d3dfcc308"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
21564
x-amz-cf-id
QRyCvQgXvafUf-I6iBL8VrXx6QQ8-yBgxzMIEctSJDBKlhgzqGATpQ==
expires
Tue, 23 Nov 2021 05:58:33 GMT
twitter.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/common/twitter.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 19:47:52 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:51 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
50476
etag
"3bd9-5ce3d3defd297"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
15321
x-amz-cf-id
Zpey4sBVLj_occYER2XAY6svN-japMEClScZDRPl9uvadG97TVDjWg==
expires
Tue, 23 Nov 2021 19:47:52 GMT
facebook.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/common/facebook.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 10:22:38 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:51 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
429989
etag
"3b58-5ce3d3df262d4"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
15192
x-amz-cf-id
VJqYLus5cl5q-6wjk29aRki6SVaSGH-c30pD-HHC0p4e2gDWPK2eVQ==
expires
Fri, 19 Nov 2021 10:22:38 GMT
google-plus.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/common/google-plus.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 14 Nov 2021 15:22:26 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:49 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
239202
etag
"3c67-5ce3d3dd62096"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
15463
x-amz-cf-id
CEhvrl4lH-5G2RuzNy7FQJbDKsN32ZNfw7XoUKlhKv7mA8lYyOkkqg==
expires
Sun, 21 Nov 2021 15:22:26 GMT
rss.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/common/rss.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 05:58:32 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:51 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
100235
etag
"3c51-5ce3d3df87d4d"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
15441
x-amz-cf-id
L1KBb27DTVmZWrbDPhwEhx2ZYcsFma2ceP2LGIpkvJz_8o00AW1S_w==
expires
Tue, 23 Nov 2021 05:58:32 GMT
script.js
d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/script.js?v=27
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash
b5ff995a266d426a876a1d9cb5a1bdc9b3926969758255253ef5a46a419fa501

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 05:22:24 GMT
content-encoding
gzip
age
24812804
x-powered-by
PHP/5.6.40
x-cache
Hit from cloudfront
content-length
4427
last-modified
Mon, 25 Jan 2021 12:07:27 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
etag
"pub1611576447;gz"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
Ji-o3Y37oWQYaVuFZ6_zho1fe2tZBCbOtpVVhXQBLWATgXOSXRzvGg==
expires
Thu, 03 Feb 2022 05:22:24 GMT
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023157
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
sansqCL3656qtPYb4mo5iKfRekyBrYHkLmz54sgVkJbkjTwt22_WhA==
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39005
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
yqlEBh76_yQZJNUUTKWbDbkrT2Xs5r-zsPJBPBtSCFE70wsa2qKLjQ==
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
2881
date
Wed, 17 Nov 2021 09:01:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 17 Nov 2021 11:01:07 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-814550776&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f9e3ddba5ad2bb502390e53180c9c20c1c3ebbb7e5068ea09c9a37aaaf5b138e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39555
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		37 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-814550776
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
cafe /
Resource Hash
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14378
x-xss-protection
0
server
cafe
etag
684346926396516684
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 17 Nov 2021 09:49:08 GMT
pubads_impl_2021111101.js
securepubads.g.doubleclick.net/gpt/ 		343 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
sffe /
Resource Hash
604496ee6acca620cd59265c2302f6a03fe02d65bc5306d952f0fa94d92fa5c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
117937
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 09:34:48 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 17 Nov 2021 09:49:08 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		177 B
752 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=safehaven.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
dbf2e1b1d010d35327ee2a592e7a407416b108523b17c170e71e251fb5cefcef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
116
x-xss-protection
0
expires
Wed, 17 Nov 2021 09:49:08 GMT
vendor-list.json
qd.admetricspro.com/js/cmp2/ 		256 KB
38 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/cmp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 31 May 2021 16:54:38 GMT
server
cloudflare
etag
W/"3ffae-5c3a314b5dcb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qaaRGajqno4qH%2F%2FJcP264BLL%2BMu%2BpfeN2LT%2Fm%2Fo5hSQX79F%2F8%2FTWS9hSqt7EPQT3iFjZUx70KlZn9xCkMOyyIfZFZvtbZu9FVeBofPyTYYomJ7Bm3jgd11iLE7zCbgwpDhj9%2FTguO9X%2BfdDfzeEfoNxa"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
6af80c205c0e5c56-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Wed, 17 Nov 2021 09:59:08 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
973fe12f5130be123a73261e3956030b8a1c380f8cd8234e319b51bda6892898

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id
okBBdl4mniljyIhAB_yWlERThSsUPvbQ
content-encoding
gzip
etag
fc2e1be4d234471752ea2ebee7e63d1e
age
548
x-cache
Hit from cloudfront
server
Server
x-amz-rid
1GCXG6HKMS9R2360MSYP
date
Wed, 17 Nov 2021 09:40:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
Rav4H9KrgpE0fs7NfK8s2TMnu96CwANaH3MSCNkyaCoJbCKqvp0Ddg==
connatix.player.dc.js
cds.connatix.com/p/138955/ Frame 0559
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/138955/connatix.player.dc.js
1 MB
228 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/138955/connatix.player.dc.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
322548c867692bf85ca69b600eb86352b3398a82776acfe231dc31a855f1aa04

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
last-modified
Wed, 17 Nov 2021 09:10:57 GMT
age
2147
etag
"d58bdd722578a26cdf1607e2c55e38f4"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
233516

Redirect headers

location
https://cds.connatix.com/p/138955/connatix.player.dc.js
date
Wed, 17 Nov 2021 09:49:08 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
fbevents.js
connect.facebook.net/en_US/ 		98 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
25965
x-xss-protection
0
pragma
public
x-fb-debug
/gXWuQYb5Se5d5bXsmHnG2DwHF0uYkIxxT9Rdj1pBFcavD/xPRajpQ2SBIxRzJkFRC5fk+vrAGb108ZlLswfCA==
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Wed, 17 Nov 2021 09:49:08 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-820290545&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8acbc8c200acac076a24c08c6c095af3402dec73c1ed98eb48d8f6a2a54f3e5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39555
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-802310072&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3f1babe7568891c073e5fc1e24a9caa4eeda5d276eb3eb3c9a0dccbe598a1bf6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39553
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 17 Nov 2021 09:49:08 GMT
ee70c0a7d2f14ec08939692fc7857b11.js
cdn.pushcrew.com/js/ 		242 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pushcrew.com/js/ee70c0a7d2f14ec08939692fc7857b11.js
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5e492d4926219990952d0609ebce118aa3eb6d487a475be75c4090c71df220a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1729
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
access-control-allow-origin
*
last-modified
Fri, 29 Jan 2021 11:50:36 GMT
server
cloudflare
etag
W/"6013f68c-3c83a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 google
cache-control
max-age=43200
cf-ray
6af80c212e1459c5-MXP
expires
Wed, 17 Nov 2021 09:50:19 GMT
search.png
d2p6ty67371ecn.cloudfront.net/a/img/ 		770 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d2p6ty67371ecn.cloudfront.net/a/img/search.png
Requested by
Host: d2p6ty67371ecn.cloudfront.net
URL: https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:fe00:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash
2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 13 Nov 2021 00:04:01 GMT
via
1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
last-modified
Wed, 13 Oct 2021 15:01:50 GMT
server
Apache/2.4.41 (Amazon) PHP/5.6.40
age
380707
etag
"302-5ce3d3deb003d"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
770
x-amz-cf-id
i2O1HAOkkx4oQJ459Ji9I94fr7G847qGLg3D3A6uW-ZGrEY4xNzw9w==
expires
Sat, 20 Nov 2021 00:04:01 GMT
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/webp
api.min.js
a.optmstr.com/app/js/ 		208 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.optmstr.com/app/js/api.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
unn-89-187-169-47.cdn77.com
Software
BunnyCDN-DE1-756 /
Resource Hash
71ebaa7b30e6256d69d1da136962215a233d0535e2dc67ce3315e59852e5f576

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
cdn-edgestorageid
756
perma-cache
MISS
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-cachedat
11/03/2021 22:08:18
cdn-pullzone
293267
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
x-amz-request-id
SF6KJ7NQ0FMB3JCE
x-amz-id-2
T2kZ1IAD0fDKz9eq5mwYMVSdzKS2OuNDcZEpNCUzIvih50ZiWPT67iJsWPfN3HfAy/6shpzeHUg=
server
BunnyCDN-DE1-756
access-control-allow-origin
*
last-modified
Wed, 03 Nov 2021 21:08:11 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cache-control
public, max-age=31919000
cdn-requestid
3e1824cbfd15af9be12fc7f5ce4b4516
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723, 617
age
3516548
cdn-cachedat
2021-07-24 08:09:23
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
1b00e9671224b437bf3914cf33baf521
cf-ray
6af80c22bf175b5c-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
collect
www.google-analytics.com/j/ 		2 B
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=673986894&t=pageview&_s=1&dl=https%3A%2F%2Fsafehaven.com%2F&ul=en-us&de=UTF-8&dt=Safehaven.com%20%7C%20Preservation%20of%20Capital&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1804955262&gjid=1683636815&cid=1902631498.1637142549&tid=UA-2249023-27&_gid=2121295973.1637142549&_r=1&gtm=2ouba1&z=1411085573
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:08 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://safehaven.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
247445556002302
connect.facebook.net/signals/config/ 		305 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/247445556002302?v=2.9.48&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
490c5de7a437b5992344d7aab01009ce5416d1d5b868b627d7e4211754feaa1b
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
4FCuietpQpaSzUGH7wZsw+oqF2Xf2/nTy6xearjb3gXET1HKqkXDZJL6GwD2I2zP/JfoNLA0oeG8u9NoY1QADg==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 17 Nov 2021 09:49:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
config
c.amazon-adsystem.com/cdn/prod/ 		662 B
1010 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsafehaven.com%2F&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:07 GMT
via
1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://safehaven.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
662
x-amz-cf-id
zS8LhtvnpUF8-NkkipEJ6rq3W5DrdTCK5gHpwz2evwQTWry5bDxznA==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 05:07:57 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
16872
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Tue, 09 Nov 2021 22:55:20 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
gYbY2ORQY5Qmsyt0ob0SiGH6tjIhuo4B
via
1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
HnwJy3TeV3P1O6WzYtTfwXxUIf3u3U90jQu6HGCTICC1wVXllefyBQ==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/?random=1637142548922&cv=9&fst=1637142548922&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eda2aee5525646e369b66c1cad37ef06ae16de16c01ce66770174ff8d60f54a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1036
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/?random=1637142548924&cv=9&fst=1637142548924&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f95ada7af6f826b6e26557a190aeb4edc50680f6cc0f40b69e12be03aff38471
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1035
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/?random=1637142548925&cv=9&fst=1637142548925&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef519d2e2741df82a3253cd4ce21f46948002e3802e4a7e289f9d6af927061fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1036
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
437 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2249023-27&cid=1902631498.1637142549&jid=1804955262&gjid=1683636815&_gid=2121295973.1637142549&_u=YEBAAUAAAAAAAC~&z=2102471908
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 17 Nov 2021 09:49:09 GMT
content-type
text/plain
access-control-allow-origin
https://safehaven.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
localstore.js
script.4dex.io/ 		483 B
977 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/localstore.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
29818
content-type
application/javascript
x-amz-request-id
txfb885b5eaead480dbfa2f-00617b9d6a
x-amz-id-2
txfb885b5eaead480dbfa2f-00617b9d6a
last-modified
Tue, 26 Oct 2021 12:44:38 GMT
server
cloudflare
etag
W/"922cffdd75f7192f75231d92684885aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=34isssjqZt4ruoD1mliOfneU8%2B8gBFH07uVpXhlqQ2jr0WZoMv%2B0DsPW7QX28BXmLe1wdYCh3mVpa9tmLRR6RL%2F8YrbhaYos1Om7QZfFrv%2FXMb%2BqjlYRbQTgSQrb9nStUBqHDmRRtR1FrRP8"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
1635252278092292
cache-control
public, max-age=1800
cf-ray
6af80c23a82e68ef-FRA
expires
Wed, 17 Nov 2021 10:19:09 GMT
724.json
id5-sync.com/g/v2/ 		213 B
531 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.89.7.198 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
p20.id5-sync.com
Software
/
Resource Hash
562106d01b6ad300bc1650fdf39073de8e2750ee330454c0ecf9c4bcc66287b6
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://safehaven.com
Date
Wed, 17 Nov 2021 09:48:59 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
bid
c.amazon-adsystem.com/e/dtb/ 		64 B
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsafehaven.com%2F&pid=OUW9SXstW241z&cb=0&ws=1600x1200&v=7.70.0&t=1200&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-1553475674669-0%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22404337467%2C36736787%2Fsafehaven-300x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1553475817787-0%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22404337467%2C36736787%2Fsafehaven-300x250-BTF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1553475909622-0%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F22404337467%2C36736787%2Fsafehaven-300x250-BTF2%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1553475988342-0%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F22404337467%2C36736787%2Fsafehaven-728x90-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1553476044183-0%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F22404337467%2C36736787%2Fsafehaven-728x90-BTF%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-amz-rid
107V53SY6ZWPTGG1EAXV
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
64
x-amz-cf-id
Mon1eY4V1AJPoUjcDYDxlxrGXaw2geesQOby36_wfiLjDmOUdd_zUA==
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://safehaven.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 718
age
1672104
cdn-cachedat
2021-08-02 20:43:32
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
77160
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
604b27522b6ee15449b6a1298b2e235f
accept-ranges
bytes
cf-ray
6af80c23a99c5c26-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
20987
api.omappapi.com/v2/embed/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.omappapi.com/v2/embed/20987?d=safehaven.com
Requested by
Host: a.optmstr.com
URL: https://a.optmstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-38.fra50.r.cloudfront.net
Software
Pagely Gateway/1.5.1 /
Resource Hash
0fe506ebd2fdcccc4422de7d15b2137dbb73ff4aa74f02c74db27403b3481e9f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-cache-config
0 0
x-amz-cf-pop
FRA50-C1
x-cache-status
HIT
x-cache
Miss from cloudfront
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
1720
x-user-agent
standard--
last-modified
Wed, 27 Oct 2021 22:08:37 GMT
server
Pagely Gateway/1.5.1
etag
W/"b3a6d243e2d96731080b07dbdaea17f3"
vary
Accept-Encoding, User-Agent
content-type
application/json
via
1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)
access-control-expose-headers
X-OptinMonster-Account, X-User-Agent
cache-control
public, max-age=30, stale-while-revalidate=1800
access-control-allow-origin
*
x-amz-cf-id
9VblKbBy2fFJLRSB47EX1Gz0luk6lF5D-rdhfSRmbTARsIOx3hG9Ow==
expires
Wed, 17 Nov 2021 09:29:01 GMT
player.css
cds.connatix.com/p/138955/ 		53 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/138955/player.css
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
284da3d2b11c82b2f5624dd0fad62bdcbe3b67a2a8687b00ff04e30deb17fd30

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
last-modified
Wed, 17 Nov 2021 09:10:58 GMT
age
2148
etag
"e8ad8269886e013999d07e283560f314"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
8279
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.219.144 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-219-144.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Wed, 17 Nov 2021 10:04:09 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		35 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.202.126 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.120.0/27
date
Wed, 17 Nov 2021 09:00:23 GMT
content-type
text/javascript;charset=utf-8
cache-control
max-age=3600
x-cdn-pop
sbg
content-disposition
attachment;filename="id5-api.js"
accept-ranges
bytes
content-length
10053
x-request-id
1055293673
prebid
ib.adnxs.com/ut/v3/ 		16 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
079918885aba0d53fc91779b668295721d87d08b0244b06710c064f247e2e5b6
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Date
Wed, 17 Nov 2021 09:49:09 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
01e500f0-05bb-44e3-b458-d59854bdfc9e
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
c
prebid.a-mo.net/a/ 		11 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.61.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
d2cc0f3e4ea2ee9d228c72c169c055a37137fdcdb0746508d3debd1f62997159

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
server
envoy
vary
origin, accept-encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://safehaven.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
235
content-length
5527
prebid
mp.4dex.io/ 		99 B
511 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.4dex.io/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80ef7b6efb5000c4b08bf102a339cf202d9ff1f070d7f260a845a846b339c081
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://safehaven.com
expires
0
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
strict-transport-security
max-age=63072000
cf-ray
6af80c247e090f66-MXP
x-err
Validating the Prebid Request adunits. Sampled or No valid non-debug AdUnits
25
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 		561 B
744 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:fa8:8806:16::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
f3dfe594f4ecc5815c63bb8a09a5bb89316f2670b5cb02cfa641b57aad0cf11f

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
server
nginx
content-type
application/json
access-control-allow-origin
https://safehaven.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
561
expires
0
adreq
ads.servenobid.com/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.servenobid.com/adreq?cb=7077
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
48477fe19edb433f71fc3fa4a11b04aebfb8559550008da524a92d1ad94fb7fa

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://safehaven.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
arj
teachingaids-d.openx.net/w/1.0/ 		173 B
592 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsafehaven.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=39af31b1-2664-4794-873c-490a712467bb%2Ce50e8084-8753-4a6e-b014-95c00f1aba8a%2C07626f94-bdcc-40ec-8015-b01d149e7d9a%2C1516362d-726c-47dc-8bce-727f92d7f370%2C61d52764-0d52-44a7-970f-26d7b90862e1&nocache=1637142549118&gdpr=0&x_gdpr_f=1&pubcid=8d4ac33d-39bb-499e-bd98-c2b24f9910bd&schain=1.0%2C1!admetricspro.com%2C102%2C1%2C%2C%2C&aus=300x250%7C300x250%7C300x250%7C728x90%7C728x90&divids=div-gpt-ad-1553475674669-0%2Cdiv-gpt-ad-1553475817787-0%2Cdiv-gpt-ad-1553475909622-0%2Cdiv-gpt-ad-1553475988342-0%2Cdiv-gpt-ad-1553476044183-0&aucs=%252F22404337467%252C36736787%252Fsafehaven-300x250-ATF%2C%252F22404337467%252C36736787%252Fsafehaven-300x250-BTF%2C%252F22404337467%252C36736787%252Fsafehaven-300x250-BTF2%2C%252F22404337467%252C36736787%252Fsafehaven-728x90-ATF%2C%252F22404337467%252C36736787%252Fsafehaven-728x90-BTF&auid=540800705%2C540800706%2C540800707%2C540800708%2C540800709
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
fcf499df09369ff1e215f83bd5504683e1a2a472f8ab1365d7c663e63bc9603f

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
server
OXGW/16.218.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://safehaven.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
v2
e.serverbid.com/api/ 		711 B
983 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:08 GMT
access-control-allow-credentials
true
content-length
711
vary
Origin
content-type
application/json
bid
ap.lijit.com/rtb/ 		94 B
741 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.17.0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
8d62b3ddb334d9db94dcbf6a6711a817daf96895573155b159d5d37d7a893cd8

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Date
Wed, 17 Nov 2021 09:49:09 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap2ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
99
prebid
ib.adnxs.com/ut/v3/ 		583 B
978 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
f703558ba0775d2e086b87476601a8c133c12fbb46b7833efb9571f3afedfae0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Date
Wed, 17 Nov 2021 09:49:09 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
55a81233-092b-480b-a537-76d5a3de14f1
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.116.184 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
111 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.116.184 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
111 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.116.184 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
111 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.116.184 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
111 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.197.116.184 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-116-184.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-allow-credentials
true
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ 		456 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=15&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tg_i.ref=https%3A%2F%2Fsafehaven.com%2F&tg_i.page=https%3A%2F%2Fsafehaven.com%2F&tg_i.domain=safehaven.com&tg_i.dfp_ad_unit_code=22404337467%2C36736787%2Fsafehaven-300x250-ATF&tg_i.pbadslot=22404337467%2C36736787%2Fsafehaven-300x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=39af31b1-2664-4794-873c-490a712467bb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.72284176464978
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
b64fe9b742eecd866f22a4b4b2fb4083b1ccaa39dac51c17a19f7db1fee5245c

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
456
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		456 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=15&p_pos=btf&gdpr=0&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tg_i.ref=https%3A%2F%2Fsafehaven.com%2F&tg_i.page=https%3A%2F%2Fsafehaven.com%2F&tg_i.domain=safehaven.com&tg_i.dfp_ad_unit_code=22404337467%2C36736787%2Fsafehaven-300x250-BTF&tg_i.pbadslot=22404337467%2C36736787%2Fsafehaven-300x250-BTF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=e50e8084-8753-4a6e-b014-95c00f1aba8a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4379694317592082
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
3bfbb9ba774709a772a1304039f22e68a6868de1d408c84162454109121a1d21

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
456
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		458 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244366&size_id=15&p_pos=btf&gdpr=0&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tg_i.ref=https%3A%2F%2Fsafehaven.com%2F&tg_i.page=https%3A%2F%2Fsafehaven.com%2F&tg_i.domain=safehaven.com&tg_i.dfp_ad_unit_code=22404337467%2C36736787%2Fsafehaven-300x250-BTF2&tg_i.pbadslot=22404337467%2C36736787%2Fsafehaven-300x250-BTF2&tk_flint=pbjs_lite_v5.17.0&x_source.tid=07626f94-bdcc-40ec-8015-b01d149e7d9a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9010509474788462
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
0e267c1c08f41394bcb01ce851cc0a6a834741576f2c37e07eba58729b1ebfba

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
458
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		453 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=2&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tg_i.ref=https%3A%2F%2Fsafehaven.com%2F&tg_i.page=https%3A%2F%2Fsafehaven.com%2F&tg_i.domain=safehaven.com&tg_i.dfp_ad_unit_code=22404337467%2C36736787%2Fsafehaven-728x90-ATF&tg_i.pbadslot=22404337467%2C36736787%2Fsafehaven-728x90-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=1516362d-726c-47dc-8bce-727f92d7f370&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3845258898900785
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
cf09dbb7d0ce6a73b4e49f9981dc5fc5654ecaee41e1818700e1c03c5bb90e8a

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
453
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		453 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=2&p_pos=btf&gdpr=0&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tg_i.ref=https%3A%2F%2Fsafehaven.com%2F&tg_i.page=https%3A%2F%2Fsafehaven.com%2F&tg_i.domain=safehaven.com&tg_i.dfp_ad_unit_code=22404337467%2C36736787%2Fsafehaven-728x90-BTF&tg_i.pbadslot=22404337467%2C36736787%2Fsafehaven-728x90-BTF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=61d52764-0d52-44a7-970f-26d7b90862e1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7246281194283577
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
5462f2faffc0c97db3583d706890dcd7a45bf1d0b50d8728b784d03abd0f1270

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
453
Expires
Wed, 17 Sep 1975 21:32:10 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6ad8570093&pos=safehaven.com_desktop_300x250-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
2974eb585cd805e63aac6982805c5ba28698efb09613699c03049df527bd8a84

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6ad8570093&pos=safehaven.com_desktop_300x250-btf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
4bc10602380ab8fefcaeaa51557f6809595821df8469fe39c2d8e438d1dce77a

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6ad8570093&pos=safehaven.com_desktop_300x250-btf2&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
ae1a453845c84c98108ca80bb5ea461210500d404db9d0906d78bc99aa5bffba

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6ad8570093&pos=safehaven.com_desktop_728x90-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
3aab1d4681b3582c0eb091a210603be3cd50b8123631c802be06852b90a03e9e

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
290 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6ad8570093&pos=safehaven.com_desktop_728x90-btf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
015b60e1b1ba7a981695787808ccf4ddd3f5d0111e57bf539ba95a35b4c59af7

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
content-length
62
translator
hbopenbid.pubmatic.com/ 		0
114 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:07 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
www.google.com/pagead/1p-user-list/814550776/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/814550776/?random=1637142548924&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=568151164&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/814550776/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/814550776/?random=1637142548924&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=568151164&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/820290545/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/820290545/?random=1637142548922&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=3255526180&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/820290545/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/820290545/?random=1637142548922&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=3255526180&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/802310072/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/802310072/?random=1637142548925&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=2504098048&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/802310072/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/802310072/?random=1637142548925&cv=9&fst=1637139600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=2504098048&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pls
capi.connatix.com/core/ Frame 0559 		7 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/pls?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
057dc6ee7532fb79e0642045112929f0dd827c70e6ee90e7eeda7d4de99c7c18

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:09 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
transfer-encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
adagio.js
script.4dex.io/ 		71 KB
22 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/adagio.js
Requested by
Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
071ae33974e54b0b7586b5ecc94a40ab118f7df9a387f351231095b51aafe93e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2596740
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-request-id
tx3373669572444622ba60a-00616d2caf
x-amz-id-2
tx3373669572444622ba60a-00616d2caf
last-modified
Mon, 18 Oct 2021 08:01:50 GMT
server
cloudflare
etag
W/"cae476c264f28e37aca638d685ba55b4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lG7C3jYpCiQ%2Ba2juHzffLPtbgWcEQdxovw%2B0faWloepC1DGxf1IzcVfp%2B6X4pii8tJTiJ%2FlrD6oyGzkp%2BhA9wEu2Fi2C1zKeykeDAHSPlVWubzDQNJtXwZY2bLNo%2FFcbi72ugHsxKA9osq%2Ft"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=1800
access-control-allow-credentials
true
x-amz-version-id
1634544110326910
cf-ray
6af80c2479135b80-FRA
access-control-allow-headers
Authorization
724.json
id5-sync.com/g/v2/ 		213 B
531 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.89.7.198 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
p20.id5-sync.com
Software
/
Resource Hash
3ebb37e8d84ad18d5076273ca7c1f6fcd24b6f7aa522c9d0d2438441b82b6e82
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://safehaven.com
Date
Wed, 17 Nov 2021 09:48:59 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
webfont.js
a.omappapi.com/app/js/webfont/1.5.18/ 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
unn-89-187-169-47.cdn77.com
Software
BunnyCDN-DE1-756 /
Resource Hash
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
cdn-edgestorageid
756
perma-cache
HIT
cdn-storageserver
DE-51
cdn-cachedat
08/11/2021 05:08:04
cdn-pullzone
293267
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
server
BunnyCDN-DE1-756
access-control-allow-origin
*
last-modified
Thu, 27 May 2021 17:38:16 GMT
cdn-proxyver
1.0
cdn-fileserver
162
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid
acda202a94e793276965fa05e4d7f986
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
651529765710614
connect.facebook.net/signals/config/ 		305 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/651529765710614?v=2.9.48&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ab3a9a2021b209f2ae112593fdac147baca1e5beca4b28f8d188c8f83d2e870e
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
Ekam0l8AfJP+jJucd8ztfm8ouZemajsZsQvk8sDpR43HALmQ8IInN7WzRm+POu38CtpdtAjOuOB6290F+hbizw==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 17 Nov 2021 09:49:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=247445556002302&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1637142549349&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1637142549348.1713290992&it=1637142548909&coo=false&exp=p1&rqm=GET
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Wed, 17 Nov 2021 09:49:09 GMT
/
www.facebook.com/tr/ 		44 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=651529765710614&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1637142549442&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1637142549348.1713290992&it=1637142548909&coo=false&exp=p1&rqm=GET
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Wed, 17 Nov 2021 09:49:09 GMT
https-v4.css
cdn.pushcrew.com/css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.pushcrew.com/css/https-v4.css
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89a812c4e8107b708f59734c3467e56f57a002316cd730d82a06a02a8beaf8f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
cf-cache-status
HIT
age
769
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
access-control-allow-origin
*
last-modified
Tue, 21 Jan 2020 14:31:38 GMT
server
cloudflare
etag
W/"5e270b4a-2112"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
via
1.1 google
cache-control
max-age=43200
cf-ray
6af80c262e7959c5-MXP
expires
Wed, 17 Nov 2021 10:06:20 GMT
vwo-white-new.png
pushcrew.com/assets/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pushcrew.com/assets/images/vwo-white-new.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.183.26 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
26.183.102.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
454cdb72d14efa43c2718af7420d281caf5bff5bb58778ad7d48341eceb3adf5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 google
last-modified
Fri, 10 Jan 2020 04:44:18 GMT
server
nginx
etag
"5e180122-4d3"
content-type
image/png
cache-control
max-age=1209600
accept-ranges
bytes
alt-svc
clear
content-length
1235
a57d126b-bd66-44f3-917b-51b848d01463.png
cdn.pushcrew.com/img/logos/ee70c0a7d2f14ec08939692fc7857b11/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.pushcrew.com/img/logos/ee70c0a7d2f14ec08939692fc7857b11/a57d126b-bd66-44f3-917b-51b848d01463.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6766fcdfc44dbd8ca5c90eb5ac51e11ea5fffde9c723698f7c30f199db457a3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 google
cf-cache-status
MISS
last-modified
Tue, 08 May 2018 08:32:53 GMT
server
cloudflare
etag
"5af160b5-76b8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
6af80c262e7f59c5-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
30392
httpFront-v4.css
cdn.pushcrew.com/css/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.pushcrew.com/css/httpFront-v4.css
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
594604c48df08a8fb7ee88f0971442f3bd2136b71aeccfabcc3cdca8c97880e5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
cf-cache-status
HIT
age
263
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
access-control-allow-origin
*
last-modified
Wed, 29 Apr 2020 04:28:27 GMT
server
cloudflare
etag
W/"5ea9026b-4b38"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
via
1.1 google
cache-control
max-age=43200
cf-ray
6af80c265ed459c5-MXP
expires
Wed, 17 Nov 2021 10:14:46 GMT
insights.bin
ins.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/2/ Frame 0559 		2 B
86 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Mon, 18 Oct 2021 08:36:56 GMT
age
1383149
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/bfe0523e-ecbd-410f-b1c9-6c418d30ad0b/2/ Frame 0559 		2 B
86 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/bfe0523e-ecbd-410f-b1c9-6c418d30ad0b/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Fri, 15 Oct 2021 13:40:06 GMT
age
1383148
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/f5df1d82-9239-4489-a56c-6b8c5c26ee2a/2/ Frame 0559 		2 B
180 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/f5df1d82-9239-4489-a56c-6b8c5c26ee2a/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Fri, 15 Oct 2021 13:25:48 GMT
age
597584
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/16e13777-432a-4ed5-922d-625833bf98c4/2/ Frame 0559 		2 B
86 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/16e13777-432a-4ed5-922d-625833bf98c4/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Mon, 18 Oct 2021 08:48:36 GMT
age
405174
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/ca3c81fb-7db9-459f-9024-1e9498ed780b/2/ Frame 0559 		2 B
80 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/ca3c81fb-7db9-459f-9024-1e9498ed780b/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Mon, 18 Oct 2021 08:45:18 GMT
age
1789176
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/893dab0a-9681-4f0f-87df-9a57b3ca63b6/2/ Frame 0559 		2 B
258 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/893dab0a-9681-4f0f-87df-9a57b3ca63b6/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Mon, 18 Oct 2021 08:41:12 GMT
age
1084387
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
insights.bin
ins.connatix.com/3e3ce607-4a31-4729-89c9-9731ed26d7ec/2/ Frame 0559 		2 B
86 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/3e3ce607-4a31-4729-89c9-9731ed26d7ec/2/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Fri, 15 Oct 2021 14:29:11 GMT
age
1789176
etag
"5a68de997d60afa9083b17fe00f7cdf2"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
22
sr
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sr?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:09 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
sffe /
Resource Hash
2d16b7dd1dd51de053865b8efbaa6362956026a068c2e8786740d8486dd7a9be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1046 / 891 of 1000 / last-modified: 1637103958"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26684
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 17 Nov 2021 09:49:09 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://safehaven.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 14:02:00 GMT
x-content-type-options
nosniff
age
71229
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 16 Nov 2022 14:02:00 GMT
2_media.bin
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		259 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/2_media.bin?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c4203636462bb1fb653e6291e7ddc1bcd65d40334e5a6a6f92c90d01f1edc51d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Thu, 10 Sep 2020 23:14:06 GMT
age
1016005
etag
"119cb2c65d8ecc94a8e5fc6fe1ff091d"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
231
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 0559 		368 KB
123 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
014f2fb8d253cee4da7966e085bf836310d85793e5ab4291489a6add2b123e6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
125138
x-xss-protection
0
expires
Wed, 17 Nov 2021 09:49:09 GMT
1.png
img.connatix.com/5a5b3df9-07b0-444f-8112-3195d5a89d94/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/5a5b3df9-07b0-444f-8112-3195d5a89d94/1.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
age
678461
etag
"CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
access-control-max-age
86400
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
6487
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
489 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsafehaven.com%2F&pid=OUW9SXstW241z&cb=1&ws=1600x1200&v=7.70.0&t=2000&slots=%5B%7B%22id%22%3A%22Amazon_400x225%22%2C%22mt%22%3A%22v%22%7D%5D&cfgv=1&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-amz-rid
7FXK1T465M6Y0TD1QVX5
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
SfpVCnC-EE5cvv0FTuJnTjGTFfRpw9Pgoi_iwCZ8tdy4aoZgF1Vfrg==
1_th.jpg
img.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2c048e8f59e18d3c16cd93bd66cf1b946f0a3c2ea7d8a40c78bd198c65217522

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
age
1737736
etag
"0pEiJlQQ09uzQ6/BNXFEVFk6bV374b7GSPBoqzfFChk"
access-control-max-age
86400
fastly-io-info
ifsz=116072 idim=2560x1440 ifmt=jpeg ofsz=11548 odim=400x225 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
11144
1_th.jpg
img.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/1_th.jpg?crop=396:222,smart&width=396&height=222&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
26d46b02656710d59021fddf76d7c4f851efb15c693e6f4ec072645207a47141

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
age
1737736
etag
"gaPvfSycJq6OqXk2edOEbU/G5QlSqYB1vmxLZZHaw6g"
access-control-max-age
86400
fastly-io-info
ifsz=116072 idim=2560x1440 ifmt=jpeg ofsz=11226 odim=396x222 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
10836
prebid4.43.0-2.js
cds.connatix.com/p/plugins/ Frame 8326 		376 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6c9a29d5877620bf729f6920b50466df6e2635d6cf6a7b3dd7bc7ec4f361bda4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
br
last-modified
Thu, 07 Oct 2021 08:28:44 GMT
age
2511909
etag
"d670a030e44b22136be6fe4a4f92f047"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
105730
playlist.m3u8
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		309 B
249 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/playlist.m3u8?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Thu, 10 Sep 2020 23:14:06 GMT
age
1431280
etag
"8a966507b13615ecdc1330a4bc9dcfe1"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
164
g_pbst
1x1.a-mo.net/hbx/ 		0
89 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=728&h=90&bid=82a5fa9414ea11f&c1=banner&np=0.037888123783783825&aud=122f855fefe7753&a=div-gpt-ad-1553476044183-0&c2=hb_bidder%3Damx%26hb_adid%3D82a5fa9414ea11f%26dyn_bids%3D0.03&ts=1637142549817&eid=83132975aac268c
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.153.9.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-153-9-102.compute-1.amazonaws.com
Software
MonetEngine /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
cache-control
max-age=0, private, must-revalidate
server
MonetEngine
integrator.js
adservice.google.de/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=safehaven.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=safehaven.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		328 KB
58 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1340515114046747&correlator=3070685845650652&output=ldjh&impl=fifs&eid=31060838%2C44752541%2C44754276%2C31060545%2C31063244&vrg=2021111101&ptt=17&gdpr=0&tfua=0&tfcd=0&sc=1&sfv=1-0-38&ecs=20211117&iu_parts=22404337467%3A36736787%2Csafehaven-300x250-ATF%2Csafehaven-300x250-BTF%2Csafehaven-300x250-BTF2%2Csafehaven-728x90-ATF%2Csafehaven-728x90-BTF%2Csafehaven-AdX-Interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6&prev_iu_szs=300x250%2C300x250%2C300x250%2C728x90%2C728x90%2C1x1&ists=1&fas=0%2C0%2C0%2C0%2C0%2C8&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D8163b2b6d017b8e%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.02%26hb_adid%3D8163b2b6d017b8e%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2%26hb_adid_oftmedia%3D80fb63c8fdc23bd%26hb_bidder_oftmedia%3Doftmedia%26dyn_bids%3D0.00%26hb_adid%3D80fb63c8fdc23bd%26hb_bidder%3Doftmedia%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_amx%3D82a5fa9414ea11f%26hb_bidder_amx%3Damx%26dyn_bids%3D0.03%26hb_adid%3D82a5fa9414ea11f%26hb_bidder%3Damx%7C&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1637142549&dt=1637142549832&dlt=1637142548144&idt=324&frm=20&biw=1600&bih=1200&oid=2&adxs=1075%2C1075%2C248%2C248%2C436%2C-9&adys=661%2C693%2C2172%2C1207%2C2490%2C-9&adks=596600067%2C547341003%2C4061679776%2C1924246122%2C3273975302%2C709688471&ucis=1%7C2%7C3%7C4%7C5%7C6&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsafehaven.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x32%7C320x32%7C395x0%7C824x0%7C1600x0%7C0x-1&msz=320x0%7C320x0%7C395x0%7C824x0%7C1600x0%7C0x-1&ga_vid=1902631498.1637142549&ga_sid=1637142550&ga_hid=673986894&ga_fc=true&fws=0%2C0%2C0%2C0%2C0%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0&btvi=0%7C0%7C1%7C2%7C3%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
04439b4ea020c9b215b8c466b0ff5a2bff5c752c8450dd956b811b09f0f7137e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59545
x-xss-protection
0
google-lineitem-id
-1,-1,-1,-1,-1,-1
pragma
no-cache
server
cafe
google-creative-id
-1,-1,-1,-1,-1,-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://safehaven.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		12 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021111101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
943d885541626ba4f42af73f1766356a3e3368d4588ea6f92d00cca05839572e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9248
x-xss-protection
0
container.html
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B9C3 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Wed, 17 Nov 2021 09:49:09 GMT
expires
Thu, 17 Nov 2022 09:49:09 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pubads_impl_page_level_ads_2021111101.js
securepubads.g.doubleclick.net/gpt/ 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021111101.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
sffe /
Resource Hash
da913c5532c512206c7eab6fd77ce0027e07e533dd3c66db8a1d9486c531f5a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13484
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 09:34:48 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 17 Nov 2021 09:49:09 GMT
0.m3u8
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		603 B
355 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.m3u8?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6d0dbaafdbbf1d3f9334bffc7cf32213e7eeac013648dbbf947144d32b22993c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
last-modified
Thu, 10 Sep 2020 23:14:05 GMT
age
1431280
etag
"b8df64d4a938b783215cea913a0a5d46"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
269
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://safehaven.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Wed, 17 Nov 2021 09:49:09 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dd12df38bb6d5e83053655d3a5d81a7166743b7e3bdb1f8cd38b3b556b515801

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Range
bytes=0-1330

Response headers

date
Wed, 17 Nov 2021 09:49:09 GMT
last-modified
Thu, 10 Sep 2020 23:14:05 GMT
age
348658
etag
"c94e208e997a4aedfe6a341fdad01a19"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET, HEAD
content-type
video/mp4
Content-Range
bytes 0-1330/5579212
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
1331
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsafehaven.com%2F&domain=safehaven.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://safehaven.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://safehaven.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1634
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
vary
Accept-Encoding
sid
mug.criteo.com/ Frame 8326
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsafehaven.com%2F&domain=safehaven.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=Wqo99XxWcmU3UG5CNEc1WGxrWHN1Mmd0WThhczRydHQ5ZlN4ZFRWdXFVU3V5YjhGeVoyUUpTRTg5eUp6ZjQ5dW5qMFhBSGxBWWZlbzNuQ0Y5NG1nVFBUYVVGcU9lN3owZm1sVjh3ODhaTWxUWkVDcUZobGJNbGdhRW0yWm...
350 B
608 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=Wqo99XxWcmU3UG5CNEc1WGxrWHN1Mmd0WThhczRydHQ5ZlN4ZFRWdXFVU3V5YjhGeVoyUUpTRTg5eUp6ZjQ5dW5qMFhBSGxBWWZlbzNuQ0Y5NG1nVFBUYVVGcU9lN3owZm1sVjh3ODhaTWxUWkVDcUZobGJNbGdhRW0yWmFKekwrdFBtbFNtc1UxVnJzM0Z2Qlc0YmFiNGVPOERndVlxQnM1QUtxU2plVXVVSUx4SWIrUjdrRGJaVlh5dUFteDJEa1FoeEh3NG9WdW9jUkF3Y0lvcndyZ0lPWEhNWWZTNlZkSlRySWtQcjl1cXZTZFJzPXw&cppv=2
Protocol
H2
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
b1d61643441ce36e671005211e1abc289354a0afb6170f84fcd5f2e7a7626f83
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Wed, 17 Nov 2021 09:49:09 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2120
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Wed, 17 Nov 2021 09:49:09 GMT
location
https://mug.criteo.com/sid?cpp=Wqo99XxWcmU3UG5CNEc1WGxrWHN1Mmd0WThhczRydHQ5ZlN4ZFRWdXFVU3V5YjhGeVoyUUpTRTg5eUp6ZjQ5dW5qMFhBSGxBWWZlbzNuQ0Y5NG1nVFBUYVVGcU9lN3owZm1sVjh3ODhaTWxUWkVDcUZobGJNbGdhRW0yWmFKekwrdFBtbFNtc1UxVnJzM0Z2Qlc0YmFiNGVPOERndVlxQnM1QUtxU2plVXVVSUx4SWIrUjdrRGJaVlh5dUFteDJEa1FoeEh3NG9WdW9jUkF3Y0lvcndyZ0lPWEhNWWZTNlZkSlRySWtQcjl1cXZTZFJzPXw&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://safehaven.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1792
content-length
482
expires
0
avjp
teachingaids-d.openx.net/v/1.0/ Frame 8326 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fsafehaven.com%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=3b5878ac-9152-4fc8-b09f-7d4c5d14e698&nocache=1637142549909&gdpr=0&pubcid=5ce3ca89-b55d-4e62-aa8f-d03135a7df0c&schain=1.0%2C1!admetricspro.com%2C102%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540849651&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 google
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://safehaven.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame 8326 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fsafehaven.com%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=cf62b4db-1a8b-4300-a6b5-147b4d48b238&nocache=1637142549910&gdpr=0&pubcid=5ce3ca89-b55d-4e62-aa8f-d03135a7df0c&schain=1.0%2C1!admetricspro.com%2C102%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540849652&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
via
1.1 google
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://safehaven.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
mvo
tag.1rx.io/rmp/83738/0/ Frame 8326 		0
169 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/83738/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
prebid
ib.adnxs.com/ut/v3/ Frame 8326 		142 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
898340526854f0b2e4dc972e311c312d3e68346fbb5477f0dea423c2c68ee28c
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
1a0c0414-042b-414d-9654-5381a452aabf
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
142
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 8326 		139 B
971 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
6f13443056f1ee2b4a7d5b865aa59fc1c4172cc9e08704203b2898a7954e6994
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:09 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
cc92a5d9-2f59-4ef2-93ca-33a32bccac0b
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://safehaven.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 8326 		0
58 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:08 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 8326 		0
58 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:08 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
mvo
tag.1rx.io/rmp/233128/0/ Frame 8326 		0
169 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233128/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
openrtb
ads.adaptv.advertising.com/rtb/ Frame 8326 		0
214 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.20.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-20-13.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
mvo
tag.1rx.io/rmp/233078/0/ Frame 8326 		0
169 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233078/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
c
prebid.a-mo.net/a/ Frame 8326 		0
136 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.61.140 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
date
Wed, 17 Nov 2021 09:49:09 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
84
vary
origin, Accept-Encoding
mvo
tag.1rx.io/rmp/83770/0/ Frame 8326 		0
169 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/83770/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:09 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame B3EF 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 16 Nov 2021 04:10:30 GMT
expires
Wed, 16 Nov 2022 04:10:30 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
106720
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame 0559 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 17 Nov 2021 09:49:10 GMT
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame 7B20 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 16 Nov 2021 04:10:30 GMT
expires
Wed, 16 Nov 2022 04:10:30 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
106720
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame F643 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 16 Nov 2021 04:10:30 GMT
expires
Wed, 16 Nov 2022 04:10:30 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
106720
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
www.facebook.com/tr/ Frame D7CC 		0
105 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
Origin
https://safehaven.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
date
Wed, 17 Nov 2021 09:49:10 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Wed, 17 Nov 2021 09:49:10 GMT
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		774 KB
775 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ea96defa8284ab6fb47873d08324707fce48164694963421492e0c91573dbda6

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Range
bytes=1331-794062

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
last-modified
Thu, 10 Sep 2020 23:14:05 GMT
age
348658
etag
"c94e208e997a4aedfe6a341fdad01a19"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET, HEAD
content-type
video/mp4
Content-Range
bytes 1331-794062/5579212
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
792732
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://safehaven.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Wed, 17 Nov 2021 09:49:10 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=Wqo99XxWcmU3UG5CNEc1WGxrWHN1Mmd0WThhczRydHQ5ZlN4ZFRWdXFVU3V5YjhGeVoyUUpTRTg5eUp6ZjQ5dW5qMFhBSGxBWWZlbzNuQ0Y5NG1nVFBUYVVGcU9lN3owZm1sVjh3ODhaTWxUWkVDcUZobGJNbGdhRW0yWmFKekwrdFBtbFNtc1UxVnJzM0Z2Qlc0YmFiNGVPOERndVlxQnM1QUtxU2plVXVVSUx4SWIrUjdrRGJaVlh5dUFteDJEa1FoeEh3NG9WdW9jUkF3Y0lvcndyZ0lPWEhNWWZTNlZkSlRySWtQcjl1cXZTZFJzPXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1156
date
Wed, 17 Nov 2021 09:49:09 GMT
content-encoding
gzip
vary
Accept-Encoding
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 3B36 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:07:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2501
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Wed, 17 Nov 2021 10:07:29 GMT
/
www.facebook.com/tr/ Frame 1FDC 		0
31 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
Origin
https://safehaven.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://safehaven.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
date
Wed, 17 Nov 2021 09:49:10 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame EF81 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:07:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2501
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Wed, 17 Nov 2021 10:07:29 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame EBB8 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:07:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2501
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Wed, 17 Nov 2021 10:07:29 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 5C84 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5029
date
Wed, 17 Nov 2021 09:43:50 GMT
expires
Thu, 17 Nov 2022 09:43:50 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
320
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 2C37 		783 B
952 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
e06757b0c9c78ec82a13a503d1f6a636d3a43081127fa0c6d5191350f3ae193c
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Ioss/jcXN6hUV6MuDDszvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Wed, 17 Nov 2021 09:49:10 GMT
date
Wed, 17 Nov 2021 09:49:10 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-Ioss/jcXN6hUV6MuDDszvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
512
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/pagead/ Frame 2C37 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021111101&jk=1340515114046747&rc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://safehaven.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Wed, 17 Nov 2021 09:49:10 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
0.mp4
vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/ Frame 0559 		706 KB
707 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/176bfae2-7ad6-46c1-b575-cabf1a7717c8/0.mp4?playerId=5a5b3df9-07b0-444f-8112-3195d5a89d94
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b11734511d68c3bcccae0646b415fff85a898d192a6130021bf1547b3d68bd26

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Range
bytes=794063-1517090

Response headers

date
Wed, 17 Nov 2021 09:49:10 GMT
last-modified
Thu, 10 Sep 2020 23:14:05 GMT
age
348658
etag
"c94e208e997a4aedfe6a341fdad01a19"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET, HEAD
content-type
video/mp4
Content-Range
bytes 794063-1517090/5579212
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
723028
mq
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/mq?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:10 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
ps
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ps?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:10 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame 7C7A 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39007
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Y1x3FKY_WdoXyhnEfg9jr5d4s1HG2dNkJEJuS6X_h6zkB9XKkTcZxQ==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame 7C7A 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023159
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
RZceH7Gpnr0j4yeVFdkcvMg-nCXPJOliq0D1pYIY7bAvSYCzNit-AA==
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame 9C90 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39007
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
gOUgZBeVQYmjsx9FdOJsl4LPwOoBOy72PEjZmuC1tnhIGyFE1bvYow==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame 9C90 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023159
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
MSRLjke0WE6f4cvPJXfYjjILBZFFuRmtdpEKpeRbizNVmYGpW5mxtg==
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame 1397 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39007
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
V_RDucZsypCgWAQ7C1Y-wAxzMn_Q4MxNfCBh9rGU4BJNwb3v8wUwgg==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame 1397 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023159
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Xirgn-DmAXXmX_WInK8vVvNeFdrDb4KwCBuBXjE7HrHTuUpaOepeQg==
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame F206 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39007
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
I7MWUg60jZSbvgTn_PGdkdBVKifXkzesfwqUbDWEkbgGJY4JPdg31Q==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame F206 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023159
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
k2Ysy-avrWlhIXu6QVDyOmXSU4efbr5VHkI0mDi_1INS_Fy-JrG5bQ==
container.html
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 77F4 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Wed, 17 Nov 2021 09:49:09 GMT
expires
Thu, 17 Nov 2022 09:49:09 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
container.html
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A0C9 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Wed, 17 Nov 2021 09:49:09 GMT
expires
Thu, 17 Nov 2022 09:49:09 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012110042008000/ Frame 7C7A 		190 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be32eb2045a4d0a5eeb1fbe7a87ec822ba313b1f8c5f3faf2f31ee8235dd3486
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
48904
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55667
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 20:14:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11904075b70ba1a0"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 20:14:07 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 7C7A 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ddd0010a6f9f8edd8b545aa47b63a3ace7f81621e62c8b2b9e5453e326946576
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4996
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:01:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"01e91d40c144b6bf"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:01:50 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 7C7A 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-analytics-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
77c0d53ad7a44dadf518e9960ec49dd00fa3859ecbaf646bb215d33e0b5f4658
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38947
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28494
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:00:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a5e24beaf7c9a504"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:00:04 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 7C7A 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-fit-text-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b18e90729452c8796f604d2f022f8b1e259a28e648c8ce9b7e06dbab25ad3eb8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
150107
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1635
x-xss-protection
0
server
sffe
date
Mon, 15 Nov 2021 16:07:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"dff2522b082c9ee5"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 15 Nov 2022 16:07:24 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 7C7A 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-form-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
06c0b9cd46f53c57c3ebc3531be56f50ca25c2bd7bb672eaa8b033c134957c6e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
81950
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12816
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 11:03:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"6a05f1a8ea5ea134"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 11:03:21 GMT
4075256526487530010
tpc.googlesyndication.com/simgad/ Frame 7C7A 		33 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/4075256526487530010?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qk5KAK5dh17OBylqx1eOqPL9VqazQ
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0df7d9b36f573c68a2a18f201d4a1cbc60aa538f6213f7ddee6bb90e135a8a4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 04:30:36 GMT
x-content-type-options
nosniff
age
451115
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34039
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 22:38:01 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 12 Nov 2022 04:30:36 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C7A 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C7A 		295 B
399 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
l
www.google.com/ads/measurement/ Frame 7C7A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQL-ICoJcbF92PiAeI8E8DKsPS0pXvkt1oGIBR-pWG84NCQeu5jQ-9kjVb5--7_LTWSmMwN-SGPYr7nxHK1VoMIAJ7qzQ
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame 7C7A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=ChkCCFdCUYfn1Nu-wx_APz-mzkA73ucusZpuBktXUDr_hHhABIPmb8YQBYJX68IGMB6ABm4jRnwPIAQKpAgwoJmue9bI-4AIAqAMByAMIqgSKAk_QQ46epL55rFihU10FLiGZ5y60fUmiK-kDof2wMRzEhAY_ydc1k2eBmTBDk_Hgu5xotfdXl__2q8wW7YWfJORmq2Z3PKIwAxPz-0YCyIN-3Elbur3CpZgdSIbahUIpK5tqHKxkavQDjN6k2S-e7GNXFnjvPE6oG2inN2kwi-IslVJIMV86nowyxMbo0sBga_m7SZ6rNQ0-CPV-OrW5-L4WLhciOQnEJuXgGFTJ5gw5ZMOf8pGywwgmOE0MOkSQDKP5FnDS1dOPw2PhcsQtmRtQZKuRaQ1krRCT29K4QuX2IUbTdXJrpHppmclSCLprbqy9vgRVAqK66-p7WMqVvScIL5l_uaMmuvfowATcksGr2APgBAGSBQQIBBgBkgUECAUYBKAGAoAHzfeuYKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEENGHVdIIBwiAYRABGB2ACgPICwHYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItNDExMzY4MTg4MjMxMTQ1NRiE23s&sigh=5-AXTIJiQEk&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
truncated
/ Frame 7C7A 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f3efe7c9d1b4d0b24972d468f207b5740736aebc4bb8261b1eea596b061d28cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
ao
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ao?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:11 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
pagead2.googlesyndication.com/bg/ Frame 5C84 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 20:21:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
48454
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13508
x-xss-protection
0
last-modified
Mon, 08 Nov 2021 11:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 16 Nov 2022 20:21:37 GMT
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012110042008000/ Frame 9C90 		190 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be32eb2045a4d0a5eeb1fbe7a87ec822ba313b1f8c5f3faf2f31ee8235dd3486
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
48904
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55667
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 20:14:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11904075b70ba1a0"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 20:14:07 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 9C90 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ddd0010a6f9f8edd8b545aa47b63a3ace7f81621e62c8b2b9e5453e326946576
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4996
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:01:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"01e91d40c144b6bf"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:01:50 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 9C90 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-analytics-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
77c0d53ad7a44dadf518e9960ec49dd00fa3859ecbaf646bb215d33e0b5f4658
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38947
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28494
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:00:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a5e24beaf7c9a504"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:00:04 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 9C90 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-fit-text-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b18e90729452c8796f604d2f022f8b1e259a28e648c8ce9b7e06dbab25ad3eb8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
150107
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1635
x-xss-protection
0
server
sffe
date
Mon, 15 Nov 2021 16:07:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"dff2522b082c9ee5"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 15 Nov 2022 16:07:24 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 9C90 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-form-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
06c0b9cd46f53c57c3ebc3531be56f50ca25c2bd7bb672eaa8b033c134957c6e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
81950
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12816
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 11:03:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"6a05f1a8ea5ea134"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 11:03:21 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C90 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C90 		295 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
5438588717187984762
tpc.googlesyndication.com/daca_images/simgad/ Frame 9C90 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/5438588717187984762
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5f1d309077fe6ff1c8ca5e01d4d77080584b7587a6edcd9c17cf1358c79b9cac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 04:50:56 GMT
x-content-type-options
nosniff
age
449895
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22794
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 22:36:08 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 12 Nov 2022 04:50:56 GMT
l
www.google.com/ads/measurement/ Frame 9C90 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSGMAhmhMRA-Dyx3QLXbxm14wwa1Tyj96fAtWBP9iLofeglyu9LJylpGVLb6SE-lXeZDr6c74uggsYSxQOfkiD7-TMm5w
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame 9C90 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CyxMRFdCUYfr1Nu-wx_APz-mzkA73ucusZuOCktXUDr_hHhABIPmb8YQBYJX68IGMB6ABm4jRnwPIAQKpAgwoJmue9bI-4AIAqAMByAMIqgSNAk_QY7J9yYF537FQzo_jMOJqS1ru7RjqftSsWFiNaYhJAv8tYLs_A5uUlsMEHx9WQjhjefjuHg95LIn8KWrWYjp0MtSYl1I_1ZySbJ3InRZZmOXzWzosjpGQn3h3Sm0D9PpIae9x6vIsN7c4C4fLB2oHMEbnxXvHQJtx85YEJMA-2mqJcoAgCUeJm9UCnuWblMcydL0oS3qert1VyHNLjyjD-xtNMn2omtNFgX6BgOJ4gIxUdXz5U27vyeoNUfHQNpwgwoCAunqfmwOSyxiZrFGzdEfq8j5n134OyYxC7PHMns06q3lcWl33xmnVPuKfzRtbyJ8jPikxvjD9o2ETAKS4HhCZM6gVhSh6UeHVwATcksGr2APgBAGSBQQIBBgBkgUECAUYBKAGAoAHzfeuYKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPajNtIIBwiAYRABGB2ACgPICwHYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItNDExMzY4MTg4MjMxMTQ1NRiE23s&sigh=OFBogM0xJzk&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
truncated
/ Frame 9C90 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43b631b711986dee34a566a7fd715b0345eea13e69771e4622b51a4181a69cb2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012110042008000/ Frame F206 		190 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be32eb2045a4d0a5eeb1fbe7a87ec822ba313b1f8c5f3faf2f31ee8235dd3486
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
48904
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55667
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 20:14:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11904075b70ba1a0"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 20:14:07 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame F206 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ddd0010a6f9f8edd8b545aa47b63a3ace7f81621e62c8b2b9e5453e326946576
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4996
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:01:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"01e91d40c144b6bf"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:01:50 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame F206 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-analytics-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
77c0d53ad7a44dadf518e9960ec49dd00fa3859ecbaf646bb215d33e0b5f4658
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38947
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28494
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:00:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a5e24beaf7c9a504"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:00:04 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame F206 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-fit-text-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b18e90729452c8796f604d2f022f8b1e259a28e648c8ce9b7e06dbab25ad3eb8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
150107
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1635
x-xss-protection
0
server
sffe
date
Mon, 15 Nov 2021 16:07:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"dff2522b082c9ee5"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 15 Nov 2022 16:07:24 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame F206 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-form-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
06c0b9cd46f53c57c3ebc3531be56f50ca25c2bd7bb672eaa8b033c134957c6e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
81950
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12816
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 11:03:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"6a05f1a8ea5ea134"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 11:03:21 GMT
css
fonts.googleapis.com/ Frame F206 		4 KB
714 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 08:05:06 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 17 Nov 2021 09:49:11 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 17 Nov 2021 09:49:11 GMT
css
fonts.googleapis.com/ Frame F206 		4 KB
691 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500&text=
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 08:03:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 17 Nov 2021 09:49:11 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 17 Nov 2021 09:49:11 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/18075784848221836828/ Frame F206 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/18075784848221836828/downsize_200k_v1?sqp=4sqPyQSUAUKRAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhgIpwEQVxgBIAEtAAAAPzCoAThXRQAAgD8&rs=AOga4qmVQmIscdbL9oJLwMP7PnGHPHOiPA
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ecd43d3f9c7f276c7cf3d90585d619704354539e0a36603507ac18580c08f2d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 14:39:32 GMT
x-content-type-options
nosniff
age
414579
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5137
x-xss-protection
0
last-modified
Tue, 18 Aug 2020 18:57:11 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 12 Nov 2022 14:39:32 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/13949630039595074571/ Frame F206 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/13949630039595074571/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qlf-6jtzwhaZxieQ0uMYB8pZ6n_Ww
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d395f1d7b9526373af1bd107d3d973b17eb1be00fc9c67e5e6237aeabf4e60c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 07:00:39 GMT
x-content-type-options
nosniff
age
10112
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16879
x-xss-protection
0
last-modified
Fri, 06 Sep 2019 19:31:22 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 17 Nov 2022 07:00:39 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame F206 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Cs9yRFdCUYfz1Nu-wx_APz-mzkA6p2J3EZvnkpZbYDL_hHhABIPmb8YQBYJX68IGMB6ABlNbu1QPIAQbgAgCoAwHIAwqqBIkCT9DYJ6RKupGkUFYvQLzWPZLTN5UHmzqvqczI36I6RHkE6uCA7ftQSJTW1bGrGXJhul1HDuYPXLDnd7KogJ6qNrjaHOUTqtv7tUjYhBpLcUVEOJTGE6DkhncSbXERlti-Om5d_OFMWGCCDE_Suzcg5UCSibw8FdnH9nomFvwoKOBrLzdiysnyEYErgOpWv5yCDkD8NNVefVcryeDlD8f0pxDY6qTt07D2JLQAgQO0xJY-BFKqENspmzizdiuCbirjy_T6qgomAOerrapa8Q9G0r2ENmGyeP7SkXV7kIDA1j5-9kNPuF-PScSp6iSnY0FTAlkVcj0alKgIO_-XqCfkp0ezKZqLSs95T8AElJ_gu7oD4AQBkgUECAQYAZIFBAgFGASgBjeAB9SpkSqoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCdtQ3SCAcIgGEQARgdgAoDyAsB2BMMiBQB0BUBmBYBgBcBshceChwIABIUcHViLTQxMTM2ODE4ODIzMTE0NTUYhNt7&sigh=jZ9UmamzJ9Q&uach_m=[UACH]&template_id=492&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
B25164142.293110099;dc_pre=CLfz76GPn_QCFQ6L3godN9wMOA;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=
ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame F206
Redirect Chain
  • https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen...
  • https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CLfz76GPn_QCFQ6L3godN9wMOA;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdi...
42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CLfz76GPn_QCFQ6L3godN9wMOA;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H3
Server
142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f6.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:11 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:11 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
location
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CLfz76GPn_QCFQ6L3godN9wMOA;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=3363721160;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
follow-only-when-prerender-shown
1
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F206 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F206 		295 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
l
www.google.com/ads/measurement/ Frame F206 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4k68aYpgjt9z3_6Fqdg4nON6WIJGFGdpAJQ0fn9RjCbz-WPFv7QE2P6OzY1wrbfB6isjk9fN_sZn0yls6lQ77zExJhA
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012110042008000/ Frame 1397 		190 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be32eb2045a4d0a5eeb1fbe7a87ec822ba313b1f8c5f3faf2f31ee8235dd3486
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
48904
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55667
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 20:14:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11904075b70ba1a0"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 20:14:07 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 1397 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ddd0010a6f9f8edd8b545aa47b63a3ace7f81621e62c8b2b9e5453e326946576
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4996
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:01:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"01e91d40c144b6bf"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:01:50 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 1397 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-analytics-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
77c0d53ad7a44dadf518e9960ec49dd00fa3859ecbaf646bb215d33e0b5f4658
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
38947
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28494
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 23:00:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a5e24beaf7c9a504"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 23:00:04 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 1397 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-fit-text-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b18e90729452c8796f604d2f022f8b1e259a28e648c8ce9b7e06dbab25ad3eb8
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
150107
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1635
x-xss-protection
0
server
sffe
date
Mon, 15 Nov 2021 16:07:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"dff2522b082c9ee5"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 15 Nov 2022 16:07:24 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012110042008000/v0/ Frame 1397 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012110042008000/v0/amp-form-0.1.mjs
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
06c0b9cd46f53c57c3ebc3531be56f50ca25c2bd7bb672eaa8b033c134957c6e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
81950
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12816
x-xss-protection
0
server
sffe
date
Tue, 16 Nov 2021 11:03:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"6a05f1a8ea5ea134"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Wed, 16 Nov 2022 11:03:21 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1397 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1397 		295 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
17807503165872806088
tpc.googlesyndication.com/simgad/ Frame 1397 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/17807503165872806088?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnJ3135TSyjsR_TvkZA1pyEfLFzRQ
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9ecc12da9fc6548f1c3e5e6c5ce43feafd0e8181d7bdb1160f17a2b625077093
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 17:13:14 GMT
x-content-type-options
nosniff
age
59757
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33043
x-xss-protection
0
last-modified
Tue, 09 Nov 2021 18:55:49 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 16 Nov 2022 17:13:14 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 1397 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C2wH8FdCUYfv1Nu-wx_APz-mzkA73ucusZpCrm-aQD7_hHhABIPmb8YQBYJX68IGMB6ABm4jRnwPIAQKpAgwoJmue9bI-4AIAqAMByAMIqgSNAk_Q6R7zHpSMY1cKCGvyBP3wUkCSykj7_QiIotn5s-JHtGWE8cirBA9a-JAC-f6CfYw8VZYnymt8hW1a0R_LTUSmmphrvQKFiTKzwdrAfFpmGd9xFhjrBRKTyCLe4KY_XuCkK2lxOItGMKj6R6IIkdTwCEHAgFoGG0tc6_-ocbPnzsp9RqIt-MidZ6OquYwl_s_WunbSFpHTxLTJ8iG6TveWe4YMZCourCgCUgeOhdGuqgEdQGKoea-hIjuFc76LaEOxBKHqE3a7Yj_kNGkZF3yS3e0RdaRgR0PjYThtJC8eQQMjH03GExQR35oaVvxlqzLGK8WaU_NtjOWlFDR0gihdqPizrf3xU0z_wFn9wATcksGr2APgBAGSBQQIBBgBkgUECAUYBKAGAoAHzfeuYKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEL_0HtIIBwiAYRABGB2ACgPICwHYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItNDExMzY4MTg4MjMxMTQ1NRiE23s&sigh=gp_FcNY1mgI&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
truncated
/ Frame 1397 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed3294322cb245eb7ee81b1cd441720860432d52c4d5309e8fa8fad356a51b84

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame A0C9 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39008
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
cIyVJ3gM2z74RgXGDRIyZ9wxeA-Uxv7IwwCvAECDfowfat6IF7uCOA==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame A0C9 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023160
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
PMzAdk3bojYd7sj1EvuWu22Sio1wEJs5sez9XhwHZpa4pyL7ZzTMoA==
css2
fonts.googleapis.com/ Frame A0C9 		4 KB
707 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 08:05:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 17 Nov 2021 09:49:11 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 17 Nov 2021 09:49:11 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame A0C9 		205 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 03:18:30 GMT
x-content-type-options
nosniff
age
23442
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 17 Nov 2022 03:18:30 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame A0C9 		604 B
695 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 14:21:19 GMT
x-content-type-options
nosniff
age
70073
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Wed, 16 Nov 2022 14:21:19 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame A0C9 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:05:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2597
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8141
x-xss-protection
0
server
cafe
etag
15959965552278146708
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:05:55 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 7C7A
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol
H2
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Redirect headers

date
Wed, 17 Nov 2021 09:49:11 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
bl-f821a95-96c00759.js
tagan.adlightning.com/math-aids/ Frame 77F4 		53 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/bl-f821a95-96c00759.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 22:59:04 GMT
content-encoding
gzip
age
39008
x-cache
Hit from cloudfront
content-length
22391
x-amz-meta-git_commit
f821a95
last-modified
Tue, 16 Nov 2021 22:09:06 GMT
server
AmazonS3
etag
"3dc7d7ac32ac042c63dc1501867c4217"
x-amz-version-id
D5A2Ow3MN5ogwR.0h8Dv5RtPKAGPoMtC
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
GBwv3sNNeWs83mBzAjqnc3yUqKYoag4qemTqbura4VJxXzTYNhcUQg==
b-7b120a5-fe15cb4e.js
tagan.adlightning.com/math-aids/ Frame 77F4 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-66.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 02:56:32 GMT
content-encoding
gzip
age
7023160
x-cache
Hit from cloudfront
content-length
28577
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:33 GMT
server
AmazonS3
etag
"77d747fe24b19bc4a0832935a464378e"
x-amz-version-id
lMPLRd_3tygJ1_pE5DwRd3uGvAscYIob
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
7XRxqgzm-YtFSrpnYTkixTDbMmPit8CGPmnGej-3gzKEz0bUDtPhog==
js
tags.mathtag.com/notify/ Frame 77F4 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTldWak9USTBOR0V0TnpCaE5DMWpaR1JpTFRBd01EQXRNREF3TURBd01EQXdNREF3LzI3NjI4NDA4MTg2OTUzNTc0NzgvNjYyMjMzMi80NTYyMzA2LzQvVk5HUC1tNkRnUUNLVVAyci1zajItYXVKc2phQXVCbkc5TDRmMzFid3I2SS8xLzQvMC8wLzk1NjgwMy8zMjU3MTY2ODQ4LzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC8yNzYyODQwODE4Njk1MzU3NDc4L3pyaC8wLzM5NC80NS85OTkvMzIyLzE5NC4zNi4xMDguMC8wLjAwMC8xNjM3MTQyNTUwLzE2MzcxNTUxNTAvNC9wdWItNDExMzY4MTg4MjMxMTQ1NS8/7dJW7fZaqEUYpOHHswt71THFfAk&nodeid=2634&group=zrh&auctionid=2762840818695357478&shardkey=2762840818695357478&sid=4562306&cid=6622332&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.173&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%26client%3Dca-pub-4113681882311455%26adurl%3D
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.208.4 /
Resource Hash
026b66ba8fc2d845d86f280d24b2158e5184b14f3b484dec1e4fa7ee33e8022b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:11 GMT
Content-Encoding
gzip
x-mm-bid-request-time
1637142550
Last-Modified
Wed, 17 Nov 2021 09:49:10 GMT
Server
MMBD/3.208.4
x-mm-latency
16 (0)
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg
Count
Cache-Control
no-cache
x-mm-host
cdg-router-x100, zrh-bidder-x148
Connection
close
Content-Type
application/x-javascript; charset=UTF-8
Expires
Wed, 17 Nov 2021 09:49:10 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 77F4 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:47:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
85
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:47:47 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 77F4 		119 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 17 Nov 2021 09:49:12 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 77F4 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:48:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
55
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:48:16 GMT
l
www.google.com/ads/measurement/ Frame 77F4 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQluEnc1eHGyt11aMKS6FjUHIKFuYxkbg1SISGV1G9KouyF3_JpY2cxY5u9h2vmpKtvFgv2KLPFO99Ip5JO92doPvk2pw
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
ext.js
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 77F4 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 14:13:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
70567
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7022
x-xss-protection
0
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 16 Nov 2022 14:13:05 GMT
4075256526487530010
tpc.googlesyndication.com/simgad/ Frame 7C7A 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/4075256526487530010?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qk5KAK5dh17OBylqx1eOqPL9VqazQ
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0df7d9b36f573c68a2a18f201d4a1cbc60aa538f6213f7ddee6bb90e135a8a4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 04:30:36 GMT
x-content-type-options
nosniff
age
451115
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34039
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 22:38:01 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 12 Nov 2022 04:30:36 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C7A 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7C7A 		295 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
truncated
/ Frame F206 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1a7c32d8db742e1480f98057ec3486f455f6c4c5bc8cae79427d8bc35cf6d755

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
sv
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sv?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:11 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
si
googleads.g.doubleclick.net/pagead/drt/ Frame 9C90
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Redirect headers

date
Wed, 17 Nov 2021 09:49:11 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C90 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
452
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C90 		295 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24691
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame F206
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Redirect headers

date
Wed, 17 Nov 2021 09:49:12 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame 1397
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: safehaven.com
URL: https://safehaven.com/
Protocol
H2
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Redirect headers

date
Wed, 17 Nov 2021 09:49:12 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1397 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
453
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1397 		295 B
359 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24692
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F206 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 09:41:39 GMT
x-content-type-options
nosniff
server
cafe
age
453
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 18 Nov 2021 09:41:39 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F206 		295 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012110042008000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 17 Nov 2021 02:57:40 GMT
x-content-type-options
nosniff
server
cafe
age
24692
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 18 Nov 2021 02:57:40 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F206 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://safehaven.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 13:39:48 GMT
x-content-type-options
nosniff
age
418164
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 12 Nov 2022 13:39:48 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F206 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://safehaven.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 14:02:00 GMT
x-content-type-options
nosniff
age
71232
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 16 Nov 2022 14:02:00 GMT
css
fonts.googleapis.com/ Frame 52B9 		3 KB
675 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 17 Nov 2021 08:00:29 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 17 Nov 2021 09:49:12 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 17 Nov 2021 09:49:12 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 52B9 		1 KB
962 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:41:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
445
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:41:47 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 52B9 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:45:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
193
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7840
x-xss-protection
0
server
cafe
etag
9525834815172239946
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:45:59 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 52B9 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:47:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
85
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:47:47 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 52B9 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 17 Nov 2021 09:49:12 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 52B9 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:48:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
56
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Dec 2021 09:48:16 GMT
163b3e9c260ab6fd774ac5b5c6fd1d76.js
www.gstatic.com/mysidia/ Frame 52B9 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 04:40:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
450506
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11360
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 03:03:10 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Thu, 10 Feb 2022 04:40:46 GMT
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMiLCJ1cmwiOiJodHRwczovL3NhZmVoYXZlbi5jb20vIiwiYWRVbml0IjoiLzIyNDA0MzM3NDY3LDM2NzM2Nzg3L3NhZmVoYXZlbi03Mjh4OTAtQlRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNTAyNDU2OTM3NCIsImNhbXBhaWduSWQiOiIyOTEwOTAwODYyIiwiY3JlYXRpdmVJZCI6IjEzODM2NTE3OTU3MyIsImxpbmVpdGVtSWQiOiI1Nzk1NTc3NDg3IiwiYWRTZXJ2ZXIiOiJkZnAiLCJ5aWVsZEdyb3VwSWRzIjpbMjg1ODM3XX0sIndpZHRoIjo3MjgsImhlaWdodCI6OTAsInd2IjoiMS4wLjArN2IxMjBhNSIsImJ2IjoiMS4wLjArN2IxMjBhNSIsInRhZ01hcmt1cCI6IjxodG1sPjxoZWFkPlxuICAgIDxtZXRhIGNoYXJzZXQ9XCJVVEYtOFwiPlxuICAgIDx0aXRsZT5TYWZlRnJhbWUgQ29udGFpbmVyPC90aXRsZT5cbiAgICA8c2NyaXB0PlxuKGZ1bmN0aW9uKCl7LypcblxuIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuXG4gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG52YXIgbT10aGlzfHxzZWxmLHc9ZnVuY3Rpb24oYSl7cmV0dXJuIGF9O3ZhciB4O3ZhciB6PWZ1bmN0aW9uKGEsYixjKXt0aGlzLmc9Yz09PXk%2FYTpcIlwifTt6LnByb3RvdHlwZS50b1N0cmluZz1mdW5jdGlvbigpe3JldHVybiB0aGlzLmcudG9TdHJpbmcoKX07dmFyIHk9e307dmFyIEM9ZnVuY3Rpb24oYSxiKXt2YXIgYz12b2lkIDA9PT1jP3t9OmM7dGhpcy5lcnJvcj1hO3RoaXMuY29udGV4dD1iLmNvbnRleHQ7dGhpcy5tc2c9Yi5tZXNzYWdlfHxcIlwiO3RoaXMuaWQ9Yi5pZHx8XCJqc2Vycm9yXCI7dGhpcy5tZXRhPWN9O3ZhciBEPWZ1bmN0aW9uKGEpe0RbXCIgXCJdKGEpO3JldHVybiBhfTtEW1wiIFwiXT1mdW5jdGlvbigpe307dmFyIEU9L14oPzooW146Lz8jLl0rKTopPyg%2FOlxcL1xcLyg%2FOihbXlxcXFwvPyNdKilAKT8oW15cXFxcLz8jXSo%2FKSg%2FOjooWzAtOV0rKSk%2FKD89W1xcXFwvPyNdfCQpKT8oW14%2FI10rKT8oPzpcXD8oW14jXSopKT8oPzojKFtcXHNcXFNdKikpPyQvO3ZhciBJPWZ1bmN0aW9uKGEsYil7aWYoYSlmb3IodmFyIGMgaW4gYSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoYSxjKSYmYi5jYWxsKHZvaWQgMCxhW2NdLGMsYSl9O3ZhciBKPS9eaHR0cHM%2FOlxcL1xcLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98XFwvfCQpLyxLPWZ1bmN0aW9uKGEsYil7dGhpcy5nPWE7dGhpcy5oPWJ9LEw9ZnVuY3Rpb24oYSxiKXt0aGlzLnVybD1hO3RoaXMuaj0hIWI7dGhpcy5kZXB0aD1udWxsfTt2YXIgTT1mdW5jdGlvbihhKXttLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KG0uZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgYj1tLmRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoXCJpbWdcIik7Yi5zcmM9YTttLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cy5wdXNoKGIpfTt2YXIgTj1mdW5jdGlvbigpe3RoaXMuaT1cIiZcIjt0aGlzLmg9e307dGhpcy5vPTA7dGhpcy5nPVtdfSxPPWZ1bmN0aW9uKGEsYil7dmFyIGM9e307Y1thXT1iO3JldHVybltjXX0sVT1mdW5jdGlvbihhLGIsYyxkLGcpe3ZhciBlPVtdO0koYSxmdW5jdGlvbihmLGspeyhmPVQoZixiLGMsZCxnKSkmJmUucHVzaChrK1wiPVwiK2YpfSk7cmV0dXJuIGUuam9pbihiKX0sVD1mdW5jdGlvbihhLGIsYyxkLGcpe2lmKG51bGw9PWEpcmV0dXJuXCJcIjtiPWJ8fFwiJlwiO2M9Y3x8XCIsJFwiO1wic3RyaW5nXCI9PXR5cGVvZiBjJiYoYz1jLnNwbGl0KFwiXCIpKTtpZihhIGluc3RhbmNlb2YgQXJyYXkpe2lmKGQ9ZHx8MCxkPGMubGVuZ3RoKXtmb3IodmFyIGU9W10sZj0wO2Y8YS5sZW5ndGg7ZisrKWUucHVzaChUKGFbZl0sYixjLGQrMSxnKSk7cmV0dXJuIGUuam9pbihjW2RdKX19ZWxzZSBpZihcIm9iamVjdFwiPT10eXBlb2YgYSlyZXR1cm4gZz1nfHwwLDI%2BZz9lbmNvZGVVUklDb21wb25lbnQoVShhLGIsYyxkLGcrMSkpOlwiLi4uXCI7cmV0dXJuIGVuY29kZVVSSUNvbXBvbmVudChTdHJpbmcoYSkpfSxXPWZ1bmN0aW9uKGEpe3ZhciBiPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1qc2Vycm9yJlwiLGM9VihhKS0yNztpZigwPmMpcmV0dXJuXCJcIjthLmcuc29ydChmdW5jdGlvbihuLEEpe3JldHVybiBuLUF9KTtmb3IodmFyIGQ9bnVsbCxnPVwiXCIsZT0wO2U8YS5nLmxlbmd0aDtlKyspZm9yKHZhciBmPWEuZ1tlXSxrPWEuaFtmXSxsPTA7bDxrLmxlbmd0aDtsKyspe2lmKCFjKXtkPW51bGw9PWQ%2FZjpkO2JyZWFrfXZhciBoPVUoa1tsXSxhLmksXCIsJFwiKTtpZihoKXtoPWcraDtpZihjPj1oLmxlbmd0aCl7Yy09aC5sZW5ndGg7Yis9aDtnPWEuaTticmVha31kPW51bGw9PWQ%2FZjpkfX1hPVwiXCI7bnVsbCE9ZCYmKGE9ZytcInRybj1cIitkKTtyZXR1cm4gYithK1wiXCJ9LFY9ZnVuY3Rpb24oYSl7dmFyIGI9MSxjO2ZvcihjIGluIGEuaCliPWMubGVuZ3RoPmI%2FYy5sZW5ndGg6YjtyZXR1cm4gMzk5Ny1iLWEuaS5sZW5ndGgtMX07dmFyIFg9ZnVuY3Rpb24oYSl7aWYoLjAxPk1hdGgucmFuZG9tKCkpdHJ5e2lmKGEgaW5zdGFuY2VvZiBOKXZhciBiPWE7ZWxzZSBiPW5ldyBOLEkoYSxmdW5jdGlvbihkLGcpe3ZhciBlPWIsZj1lLm8rKztkPU8oZyxkKTtlLmcucHVzaChmKTtlLmhbZl09ZH0pO3ZhciBjPVcoYik7YyYmTShjKX1jYXRjaChkKXt9fTt2YXIgWT1mdW5jdGlvbihhKXt2YXIgYj1hLnRvU3RyaW5nKCk7YS5uYW1lJiYtMT09Yi5pbmRleE9mKGEubmFtZSkmJihiKz1cIjogXCIrYS5uYW1lKTthLm1lc3NhZ2UmJi0xPT1iLmluZGV4T2YoYS5tZXNzYWdlKSYmKGIrPVwiOiBcIithLm1lc3NhZ2UpO2lmKGEuc3RhY2spe2E9YS5zdGFjazt2YXIgYz1iO3RyeXstMT09YS5pbmRleE9mKGMpJiYoYT1jK1wiXFxuXCIrYSk7Zm9yKHZhciBkO2EhPWQ7KWQ9YSxhPWEucmVwbGFjZSgvKChodHRwcz86XFwvLi4qXFwvKVteXFwvOl0qOlxcZCsoPzoufFxcbikqKVxcMi8sXCIkMVwiKTtiPWEucmVwbGFjZSgvXFxuICovZyxcIlxcblwiKX1jYXRjaChnKXtiPWN9fXJldHVybiBifTt2YXIgYWE9L14oW147XSspOyhcXGQrKTsoW1xcc1xcU10qKSQvLGJhPWZ1bmN0aW9uKCl7dmFyIGE9d2luZG93Lm5hbWUsYj1hYS5leGVjKGEpO2lmKG51bGw9PT1iKXRocm93IEVycm9yKFwiQ2Fubm90IHBhcnNlIHNlcmlhbGl6ZWQgZGF0YS4gXCIrYS5zdWJzdHJpbmcoMCw1MCkpO2E9K2JbMl07dmFyIGM9YlszXTtpZihhPmMubGVuZ3RoKXRocm93IEVycm9yKFwiUGFyc2VkIGNvbnRlbnQgc2l6ZSBkb2Vzbid0IG1hdGNoLiBcIithK1wiOlwiK2MubGVuZ3RoKTtyZXR1cm57bTpiWzFdLGNvbnRlbnQ6Yy5zdWJzdHIoMCxhKSxsOmMuc3Vic3RyKGEpfX07dmFyIFo9bnVsbCxkYT1mdW5jdGlvbihhKXt2YXIgYj1hLmxlbmd0aCxjPTMqYi80O2MlMz9jPU1hdGguZmxvb3IoYyk6LTEhPVwiPS5cIi5pbmRleE9mKGFbYi0xXSkmJihjPS0xIT1cIj0uXCIuaW5kZXhPZihhW2ItMl0pP2MtMjpjLTEpO3ZhciBkPW5ldyBVaW50OEFycmF5KGMpLGc9MDtjYShhLGZ1bmN0aW9uKGUpe2RbZysrXT1lfSk7cmV0dXJuIGQuc3ViYXJyYXkoMCxnKX0sY2E9ZnVuY3Rpb24oYSxiKXtmdW5jdGlvbiBjKGwpe2Zvcig7ZDxhLmxlbmd0aDspe3ZhciBoPWEuY2hhckF0KGQrKyksbj1aW2hdO2lmKG51bGwhPW4pcmV0dXJuIG47aWYoIS9eW1xcc1xceGEwXSokLy50ZXN0KGgpKXRocm93IEVycm9yKFwiVW5rbm93biBiYXNlNjQgZW5jb2RpbmcgYXQgY2hhcjogXCIraCk7fXJldHVybiBsfWVhKCk7Zm9yKHZhciBkPTA7Oyl7dmFyIGc9YygtMSksZT1jKDApLGY9Yyg2NCksaz1jKDY0KTtpZig2ND09PWsmJi0xPT09ZylicmVhaztiKGc8PDJ8ZT4%2BNCk7NjQhPWYmJihiKGU8PDQmMjQwfGY%2BPjIpLDY0IT1rJiZiKGY8PDYmMTkyfGspKX19LGVhPWZ1bmN0aW9uKCl7aWYoIVope1o9e307Zm9yKHZhciBhPVwiQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODlcIi5zcGxpdChcIlwiKSxiPVtcIisvPVwiLFwiKy9cIixcIi1fPVwiLFwiLV8uXCIsXCItX1wiXSxjPTA7NT5jO2MrKylmb3IodmFyIGQ9YS5jb25jYXQoYltjXS5zcGxpdChcIlwiKSksZz0wO2c8ZC5sZW5ndGg7ZysrKXt2YXIgZT1kW2ddO3ZvaWQgMD09PVpbZV0mJihaW2VdPWcpfX19OyhmdW5jdGlvbihhKXtpZih3aW5kb3cubmFtZSl7dmFyIGI9ZnVuY3Rpb24oZSl7dHJ5e3ZhciBmPW5ldyBOO2YuZy5wdXNoKDEpO2YuaFsxXT1PKFwiY29udGV4dFwiLDUwNyk7ZS5lcnJvciYmZS5tZXRhJiZlLmlkfHwoZT1uZXcgQyhlLHttZXNzYWdlOlkoZSl9KSk7aWYoZS5tc2cpe3ZhciBrPWUubXNnLnN1YnN0cmluZygwLDUxMik7Zi5nLnB1c2goMik7Zi5oWzJdPU8oXCJtc2dcIixrKX12YXIgbD1bZS5tZXRhfHx7fV07Zi5nLnB1c2goMyk7Zi5oWzNdPWw7bD1tO2s9W107ZT1udWxsO2Rve3ZhciBoPWw7dHJ5e3ZhciBuO2lmKG49ISFoJiZudWxsIT1oLmxvY2F0aW9uLmhyZWYpYjp7dHJ5e0QoaC5mb28pO249ITA7YnJlYWsgYn1jYXRjaChCKXt9bj0hMX12YXIgQT1ufWNhdGNoKEIpe0E9ITF9aWYoQSl7dmFyIHI9aC5sb2NhdGlvbi5ocmVmO2U9aC5kb2N1bWVudCYmaC5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIHI9ZSxlPW51bGw7ay5wdXNoKG5ldyBMKHJ8fFwiXCIpKTt0cnl7bD1oLnBhcmVudH1jYXRjaChCKXtsPW51bGx9fXdoaWxlKGwmJmghPWwpO3I9MDtmb3IodmFyIHQ9ay5sZW5ndGgtMTtyPD10OysrcilrW3JdLmRlcHRoPXQtcjtoPW07aWYoaC5sb2NhdGlvbiYmaC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmgubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09ay5sZW5ndGgtMSlmb3IodD0xO3Q8ay5sZW5ndGg7Kyt0KXt2YXIgdT1rW3RdO3UudXJsfHwodS51cmw9aC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbdC0xXXx8XCJcIix1Lmo9ITApfXZhciBwPW5ldyBMKG0ubG9jYXRpb24uaHJlZiwhMSk7aD1udWxsO3ZhciBGPWsubGVuZ3RoLTE7Zm9yKHU9RjswPD11Oy0tdSl7dmFyIHE9a1t1XTshaCYmSi50ZXN0KHEudXJsKSYmKGg9cSk7aWYocS51cmwmJiFxLmope3A9cTticmVha319cT1udWxsO3ZhciBmYT1rLmxlbmd0aCYma1tGXS51cmw7MCE9cC5kZXB0aCYmZmEmJihxPWtbRl0pO3ZhciB2PW5ldyBLKHAscSk7aWYodi5oKXt2YXIgaGE9di5oLnVybHx8XCJcIjtmLmcucHVzaCg0KTtmLmhbNF09TyhcInRvcFwiLGhhKX12YXIgRz17dXJsOnYuZy51cmx8fFwiXCJ9O2lmKHYuZy51cmwpe3ZhciBIPXYuZy51cmwubWF0Y2goRSksUD1IWzFdLFE9SFszXSxSPUhbNF07cD1cIlwiO1AmJihwKz1QK1wiOlwiKTtRJiYocCs9XCIvL1wiLHArPVEsUiYmKHArPVwiOlwiK1IpKTt2YXIgUz1wfWVsc2UgUz1cIlwiO0c9W0cse3VybDpTfV07Zi5nLnB1c2goNSk7Zi5oWzVdPUc7WChmKX1jYXRjaChCKXt0cnl7WCh7Y29udGV4dDpcImVjbXNlcnJcIixyY3R4OjUwNyxtc2c6WShCKSx1cmw6diYmdi5nLnVybH0pfWNhdGNoKGlhKXt9fX07dHJ5e3ZhciBjPWJhKCksZD1KU09OLnBhcnNlKGMubCksZz12b2lkIDA9PT1kLmVuY3J5cHRpb25Nb2RlP251bGw6ZC5lbmNyeXB0aW9uTW9kZTt3aW5kb3cubmFtZT1cIlwiO2EoYy5jb250ZW50LGcsZnVuY3Rpb24oZSl7ZC5nb29nX3NhZmVmcmFtZV9obHQmJihtLmdvb2dfc2FmZWZyYW1lX2hsdD1kLmdvb2dfc2FmZWZyYW1lX2hsdCk7ZC5fY29udGV4dCYmKG0uQU1QX0NPTlRFWFRfREFUQT1kLl9jb250ZXh0KTttLnNmXz17djpjLm0sY2ZnOmR9O2RvY3VtZW50Lm9wZW4oXCJ0ZXh0L2h0bWxcIixcInJlcGxhY2VcIik7aWYodm9pZCAwPT09eCl7dmFyIGY9bnVsbDt2YXIgaz1tLnRydXN0ZWRUeXBlcztpZihrJiZrLmNyZWF0ZVBvbGljeSl7dHJ5e2Y9ay5jcmVhdGVQb2xpY3koXCJnb29nI2h0bWxcIix7Y3JlYXRlSFRNTDp3&i=1-2&t=adltag_kw3cekyn_p4zc090KSQB&r=dc5418a9c66db2ab926a4b9d4fdd944&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29662
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 03:04:31 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
3k3VJD5BQX8cwrqg_lAmNyWV6dimFXlJprwq2wCDRll7wTsL3oA87A==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
428 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=0&d=LGNyZWF0ZVNjcmlwdDp3LGNyZWF0ZVNjcmlwdFVSTDp3fSl9Y2F0Y2gobCl7bS5jb25zb2xlJiZtLmNvbnNvbGUuZXJyb3IobC5tZXNzYWdlKX14PWZ9ZWxzZSB4PWZ9ZT0oZj14KT9mLmNyZWF0ZUhUTUwoZSk6ZTtlPW5ldyB6KGUsbnVsbCx5KTtkb2N1bWVudC53cml0ZShlIGluc3RhbmNlb2YgeiYmZS5jb25zdHJ1Y3Rvcj09PXo%2FZS5nOlwidHlwZV9lcnJvcjpTYWZlSHRtbFwiKTtkb2N1bWVudC5jbG9zZSgpO20uc2ZfJiYod2luZG93Lm5hbWU9XCJcIil9LGIpfWNhdGNoKGUpe2IoZSl9fX0pKGZ1bmN0aW9uKGEsYixjKXtpZigyPT09Yil7Yj1uZXcgVGV4dERlY29kZXI7dmFyIGQ9LzxzdGFydGd1YXJkPiguKik8ZW5kZ3VhcmQ%2BL2cuZXhlYyhhKTtpZihhPWIuZGVjb2RlLmNhbGwoYixkYShkJiZkWzFdP2RbMV06YSkpKWI9YS50b0xvd2VyQ2FzZSgpLGE9LTE8Yi5pbmRleE9mKFwiPCFkb2N0eXBlXCIpfHwtMTxiLmluZGV4T2YoXCI8aHRtbFwiKT9hOlwiPCFkb2N0eXBlIGh0bWw%2BPGh0bWw%2BPGhlYWQ%2BPC9oZWFkPjxib2R5PlwiK2ErXCI8L2JvZHk%2BPC9odG1sPlwifWMoYSl9KTt9KS5jYWxsKHRoaXMpO1xuICAgIDwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzL2JsLWY4MjFhOTUtOTZjMDA3NTkuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMvYi03YjEyMGE1LWZlMTVjYjRlLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGQ9ZGVjb2RlVVJJQ29tcG9uZW50KFwiJTdCJTIyc2l0ZUlkJTIyJTNBJTIybWF0aC1haWRzJTIyJTJDJTIyd3YlMjIlM0ElMjIxLjAuMCUyQjdiMTIwYTUlMjIlMkMlMjJ0b3BEb21haW4lMjIlM0ElMjJodHRwcyUzQSUyRiUyRnNhZmVoYXZlbi5jb20lMkYlMjIlMkMlMjJjdXJyZW50VGFnSWQlMjIlM0ElMjJhZGx0YWdfa3czY2VreW5fcDR6YzA5MEtTUUIlMjIlMkMlMjJhdSUyMiUzQSUyMiUyRjIyNDA0MzM3NDY3JTJDMzY3MzY3ODclMkZzYWZlaGF2ZW4tNzI4eDkwLUJURl8wJTIyJTJDJTIyc2xvdEVsZW1lbnRJZCUyMiUzQSUyMmRpdi1ncHQtYWQtMTU1MzQ3NjA0NDE4My0wJTIyJTJDJTIyYWRTZXJ2ZXJEZXRhaWxzJTIyJTNBJTdCJTIyYWR2ZXJ0aXNlcklkJTIyJTNBJTIyNTAyNDU2OTM3NCUyMiUyQyUyMmNhbXBhaWduSWQlMjIlM0ElMjIyOTEwOTAwODYyJTIyJTJDJTIyY3JlYXRpdmVJZCUyMiUzQSUyMjEzODM2NTE3OTU3MyUyMiUyQyUyMmxpbmVpdGVtSWQlMjIlM0ElMjI1Nzk1NTc3NDg3JTIyJTJDJTIyYWRTZXJ2ZXIlMjIlM0ElMjJkZnAlMjIlMkMlMjJ5aWVsZEdyb3VwSWRzJTIyJTNBJTVCMjg1ODM3JTVEJTdEJTJDJTIydyUyMiUzQTcyOCUyQyUyMmglMjIlM0E5MCUyQyUyMnNhZmVGcmFtZUtleSUyMiUzQSUyMjYxNzUyMjkyJTIyJTdEXCIpO3dpbmRvd1tcIjI1Mjg3MjE1X21hdGgtYWlkc1wiXT17fTt3aW5kb3dbXCIyNTI4NzIxNV9tYXRoLWFpZHNcIl0udGFnRGV0YWlscz1KU09OLnBhcnNlKGQpO3dpbmRvdy5ibG9ja2VyICYmIGJsb2NrZXIoXCIyNTI4NzIxNV9tYXRoLWFpZHNcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge30pOzwvc2NyaXB0PjwvaGVhZD48L2h0bWw%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJtZXRhIjp7InBsUmF0aW8iOjAuMDEsImJsYWNrbGlzdFN0YXR1cyI6eyJsb2FkZWQiOnRydWUsInJlbW92ZWQiOmZhbHNlLCJjb3VudCI6ODM4fX19&i=2-2&t=adltag_kw3cekyn_p4zc090KSQB&r=dc5418a9c66db2ab926a4b9d4fdd944&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29662
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 03:04:31 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
4_LdFOL3ueXBbCJyOTtBNmjbYKw3jSuC_EIOVzPK6U0InpGAC_2E6w==
adview
securepubads.g.doubleclick.net/pagead/ Frame 77F4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CBia2FdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSMAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsu6YMeQeRWSlRQogxlBu1PKxcxx7E-nHhkt_elaMmO_1u9mfHb1NngBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAGACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItNDExMzY4MTg4MjMxMTQ1NRiE23s&sigh=Td7RRR8unLA&uach_m=[UACH]&cid=CAQSPACNIrLMd7T65jGtcTbGTHqqOTjuREl6xrHMftVh938ya-Q9AfcK3M90mUMs48eL59j7BkjHMgHdpYxfFhgB&tpd=AGWhJmtsiWdrtrDQDO5llpZ4uu-HzaD497dpVhsSLfdVmawXwILdwo_m-A9v4p3iJfsNBC6TaYUZyijB0KhhlKRHtp-dSLtBZWthUhrE7xNw1BHWCPJFhVTvdmCZI0msiNpe1kdhVohbz5oLfVrVY6rkvHD9SXlP1eqwi7akTcixPQ8quxTTdr9uOZ-4hff2zYSVxDuIjWXNbI8ZFEKkwgY9EuvCk6umF-loahGQ3tn6FkYBNP2SgxrUHBU1rQVKcetu2HIKpsrT9egnEzwvTIoYlf7DyERIsoqASPm8ggPSSDSJrjHZK3N05QzWaXAb4mOFOfOaoZ6fHcTvwL9L4CQpwUTlp4jYg12r5gdZg2PKnKcAsSzkQo5OIQigjcLHN2bDWDrI8fZsiD4ReN0sz-GrNxTD4zCUKdiDGiHzPyYq87TQHTD9pXc-Hbs3AcfTnHsxNbXOGd-zeCJ9aAvJM_jsQ57gsSVljbyo1uNXESLhCvFiWy80AuqHl0SxUio1XNFW1520k_1dsSuGxc9kAlMs_z940Ut-RsEgCtJuiR2E0AQfbleVnd_hh7obSOZX9I_C5B76Yc61yF2gANYR_IffykC2b2Zwp-5IORwZDgEt01MVcnG56gQy5ij_UwgsG0i9VYzE6h3lwlo0J-NxJlkf1VLD_qlz2NvSQVszt01XNl0P5SEeE6rfGY83JuOph76jkW_tuVjgkAo4rFvg0z9BngtNYWVrE1GN0g8XnnNS2ujcbLDohMxo2v5cC_in3HhUxyoDb6NtUmONgmQfHIIIk8tBurNirlXxvCXy0c3qpTRSNDADWx1jm3UtIMOzHngj_zE6Odf2ri93OV7DoeOyz2EF_DtD55e-1nwElomr8ygibUu-rHIIDnCAA45dqiTttFBlVVYrSfNmW_n3hxGqJwLUlZEZY0mXf-sSaMGk8nAtrpyDf6W6O4JSlvpOX-Z8qH3vjJG0Gqh1qqNBEl4opU87EG0w0dW17OjT6X7u12vVncCHEos6WiT50F0wdRjNDQwty4NvMXUU9kUfqInK2JRgcr88Odz3bybOJvKJmKZA4u8PiellGPIC_RMft4Yt7AVMlu1JWmiaoUnCPeY
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
ajk4xlebn4mw
hal9000.redintelligence.net/zone/ Frame 77F4 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=0&gdpr_consent=&rnd=2762840818695357478&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D2762840818695357478%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_cid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.19.165.99.88.clients.your-server.de
Software
Apache /
Resource Hash
eac86e17b35bae1ea30e105d8e49043932b115fb3a1f788e39e52b281c7514b7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
3491
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
ck-confirm
tags.mathtag.com/ Frame 77F4 		49 B
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/ck-confirm?bid_id=2762840818695357478&node_id=2634&exch_id=4
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.208.4 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:12 GMT
Server
MMBD/3.208.4
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x82, zrh-bidder-x148
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Wed, 17 Nov 2021 09:49:11 GMT
img
pixel.mathtag.com/event/ Frame 77F4 		43 B
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=2762840818695357478&v3=651871&v4=4562306&v5=6622332&mt_nsync=1&no_attr=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-201.deploy.static.akamaitechnologies.com
Software
MT3 4103 f8fad19 master zrh-pixel-x8 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x8 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:12 GMT
img
tags.mathtag.com/event/ Frame 77F4 		49 B
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=2762840818695357478&st=4562306&time=1637142551&nodeid=2634
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.208.4 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:12 GMT
Server
MMBD/3.208.4
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x40, zrh-bidder-x148
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Wed, 17 Nov 2021 09:49:11 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame FF81 		143 B
222 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Wed, 17 Nov 2021 09:02:14 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2819
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 7B39 		1 KB
846 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Wed, 17 Nov 2021 05:53:44 GMT
expires
Thu, 18 Nov 2021 05:53:44 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
cache-control
public, max-age=86400
age
14129
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
id
id.sharedid.org/ Frame 8326 		0
212 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id.sharedid.org/id
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.245.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-245-148.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://safehaven.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://safehaven.com
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
expires
0
async_usersync.html
acdn.adnxs.com/dmp/ Frame FC02 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Wed, 17 Nov 2021 04:21:31 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Wed, 17 Nov 2021 09:49:13 GMT
Age
19661
X-Served-By
cache-lga21942-LGA, cache-hhn4047-HHN
X-Cache
HIT, HIT
X-Cache-Hits
1, 363073
X-Timer
S1637142553.207095,VS0,VE0
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9A78 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=87042
expires
Thu, 18 Nov 2021 09:59:55 GMT
date
Wed, 17 Nov 2021 09:49:13 GMT
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5AC5 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Wed, 17 Nov 2021 04:21:31 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Wed, 17 Nov 2021 09:49:13 GMT
Age
19662
X-Served-By
cache-lga21974-LGA, cache-cdg20762-CDG
X-Cache
HIT, HIT
X-Cache-Hits
1, 145089
X-Timer
S1637142553.221476,VS0,VE0
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1039 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=87042
expires
Thu, 18 Nov 2021 09:59:55 GMT
date
Wed, 17 Nov 2021 09:49:13 GMT
vary
Accept-Encoding
pd
u.openx.net/w/1.0/ Frame 7DC8 		668 B
715 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
ee5dca1e672f0b7ba2efe4e74d840b0e952e112dbff5dc4f618d68bf784c5f63

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 17 Nov 2021 09:49:13 GMT
content-type
text/html
content-length
414
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pd
u.openx.net/w/1.0/ Frame 3A20 		668 B
727 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
ee5dca1e672f0b7ba2efe4e74d840b0e952e112dbff5dc4f618d68bf784c5f63

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 17 Nov 2021 09:49:13 GMT
content-type
text/html
content-length
414
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
sync
ups.analytics.yahoo.com/ups/57304/ Frame 8326
Redirect Chain
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262&verify=true
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
0
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEM_ra7ssaL8G4DImDUB5Ch8&google_cver=1&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
date
Wed, 17 Nov 2021 09:49:13 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/55953/ Frame 8326
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=2e2d02af-7c4a-4a07-9559-17763045ad0b&_origin=1&gdpr=1&gdpr_consent=
0
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55953/sync?uid=2e2d02af-7c4a-4a07-9559-17763045ad0b&_origin=1&gdpr=1&gdpr_consent=
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ups.analytics.yahoo.com/ups/55953/sync?uid=2e2d02af-7c4a-4a07-9559-17763045ad0b&_origin=1&gdpr=1&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
sync
ups.analytics.yahoo.com/ups/55986/ Frame 8326
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
  • https://pixel.advertising.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
0
692 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YZTQGQAFL7inQwAz&_origin=0&gdpr=0&gdpr_consent=&_test=YZTQGQAFL7inQwAz&apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
date
Wed, 17 Nov 2021 09:49:13 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
request.php
hal900024.redintelligence.net/ Frame 77F4
Redirect Chain
  • https://hal900024.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
  • https://hal900024.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900024.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D2762840818695357478%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_cid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fsafehaven.com%2F&ancestorOrigins=https%3A%2F%2Fsafehaven.com&random=6270094745452&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Server
138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.252.84.201.138.clients.your-server.de
Software
Apache /
Resource Hash
a9043e96494c98c79f94ffcfb0fd22cc86023845637a621cff2beb0637320594

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:13 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId
11021600049051800951389011781024
Connection
close
Content-Type
application/x-javascript; charset=utf-8
Content-Length
894
Expires
Wed, 17 Nov 2021 09:49:13 +0100

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
Apache
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location
request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=035461c487&subid=&uid=80d0de698f619332&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D2762840818695357478%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_cid%3Da6ec6194-d017-4d01-ab1b-e983e8443848%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCxQ8vFdCUYf31Nu-wx_APz-mzkA7Ph46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSPAk_QYmv9FmQAuxtkIEfRBKF7SrWuGh4e6Pyax23qRpbrazQ408W-cvR4FGsLJ24sdVmYyxKLAH9aVqz4mawiPP5NPR5WBRG72_tUxZWOCtquUoIWde09vGp89T3CfxXVfvs4Lvi4AL9Ri5I6tDwbImAIFykzohP_3_aBrnDc4h50lRvqCdwYhYO7JkrDDkYrPqgeyKoQfkPkXBan5oC1OgGS-Kk4VbXEsDHpxOuuVk7hCf4bvLCMpCXS-efaxgPxADGFZtiAuiDyHls4wq4iXMwxfHttsc7vGOFMTlAdJiseGluK_Hsuq4E_00jq7lPdBkTO3q3g2wolzQ00smCFCjflxzMv4XelN2hn01TIzzzgBAGABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggFCIBhEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1zM_UY1oOyp-NmG7gBCzCw-Ag_kw%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fsafehaven.com%2F&ancestorOrigins=https%3A%2F%2Fsafehaven.com&random=6270094745452&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Type
text/html; charset=UTF-8
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:13 +0100
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 7B39
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1&google_push=AYg5qPKBPGabfxaomBTYj8tM-SeACIGn-gNpxKWvQqXFtKqWBR62Ii8FGPCEuJ1pYUFVu20rDozQ0L7CBmK1bHN2V1BGM7AJJJ4
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODk2NzM1Mjk0MjYwMjU3NDc3MQ==&gdpr=&gdpr_consent=
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1
43 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1
Protocol
H2
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEABO1PFdaw7gAaKTyFzqs8E&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
329
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dpixel
cms.quantserve.com/ Frame 7B39 		35 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED9SsAIx3IrB_3vbFeV3060&google_cver=1&google_push=AYg5qPJbLteie1Z26IA3CKmJdvufRyFJmNselYFJYJIqBQVtgVqGw2IP43B_18oT7MCq4mCEKxixXwG9h_Q6GONDfFfpO7R4V5o
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 7B39
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH4-bgbfPnzKb90ktvAuZ0k&google_cver=1&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSy...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSyu_w0&google_hm=Mzk4MzUzOTg0NjkyNzcxMjM...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSyu_w0&google_hm=Mzk4MzUzOTg0NjkyNzcxMjM5OQ%3D%3D
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Wed, 17 Nov 2021 09:49:13 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJwKDJ-jQZKWDEiJeSvhsK53KRdFzLnNb2Ve_niSYNIjDy-ndYWOgfIdbwXuZQMk1THXZtHFBKQmTTDpqw_KRCEgSyu_w0&google_hm=Mzk4MzUzOTg0NjkyNzcxMjM5OQ%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 7B39
Redirect Chain
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEHCsDZx6pq_IyeoEd8PZViU&google_cver=1&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBD...
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBDEhhwbsEgeeMJjb4PhOzA7uYg3LY1l8&google_hm=QXF2bFhOSUgydGlNZi14cVh1Z...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBDEhhwbsEgeeMJjb4PhOzA7uYg3LY1l8&google_hm=QXF2bFhOSUgydGlNZi14cVh1Z2VUZ0E=
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPJ2qmHTHZe883UBFd29ZU0cteyb7fZFW9qu0z6eCn_KpEOE72p8VYI4enzmdJgBDEhhwbsEgeeMJjb4PhOzA7uYg3LY1l8&google_hm=QXF2bFhOSUgydGlNZi14cVh1Z2VUZ0E=
Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
pixel
cm.g.doubleclick.net/ Frame 7B39
Redirect Chain
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ...
  • https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ...
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4...
  • https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEDEXb4rsYvFv8rKn3Yyj_BQ&google_cver=1&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA5ZWQ0ZTA1MS00NzhiLTExZWMtYmNiOS0wMjg0OGJjZGUyNjI%3D&google_push=AYg5qPLgdjgMqzWL4uuYsmmDhi-1ouXzNfs8Y-hoQ8KwOnV-CeDBL4pJ5FuNtSB9vw8rnrRqmHcsRzLkZ6T0EmvRq4Fpz_loh377
date
Wed, 17 Nov 2021 09:49:13 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
dot.gif
s0.2mdn.net/ Frame 7B39 		43 B
186 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEGn_BJRJRP-yWqaT7If6_Po&google_cver=1&google_push=AYg5qPJWX7XSQALusGdhdLa0KMO-nDpzQr_CK7cbuNE__35NKO_uYroFG-QPOCUDnJwC3WAk3rlLLrHWd6hZG8dKn0selFJgKWg
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 18 Nov 2021 09:49:13 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 7B39 		0
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LqjgelixtcJqyRHxGrcs5DR_G0EDHPvDv7EFwzzlaxk-cnujaPvhWcrzgwxcs27JBW
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
si
googleads.g.doubleclick.net/pagead/drt/ Frame FF81
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
167 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 17 Nov 2021 09:49:13 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Wed, 17 Nov 2021 09:49:13 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ 		0
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021111101&jk=1340515114046747&bg=!SUqlSg7NAAZQLpa_UC47ACkAdvg8WkerweYW7n7np2aFY2CZZ2oRbragImta1nxW6TA4yTcUMYFAMwIAAAVHUgAAAAxoAQcKAEpbMuWRAz4wADcIC--Pwo2n6gkfxUynW6TTYrDTTLexDEnNTprGcDS5amUW1mCMKmQDyBkvkQG05xsqtVjb5ysZgpf9Iz9V7VYwYpkCvRaYojhXVkflxp2eahUR6qZaTDRIPppOM9fkzLkr5qZgE60nIqgj0a7Ku7NJsPnxONcbvHVs7uyNg9ONCWlkknND6UWhNBQ9rK6L9piNn_rUvmOrpHsfoBCis494ngoiktj09MGRGlwhT9ASbCiKjYR71xLLo_XhgD-97lMERUoV6Wd-OvUHpAAAR_dHJNpYO42_RF7xVtJlRJVVuCs7Z773eemQeWzd2MBqxe-YrECJgVKp4fM-FtdRP2o6aAOHLI5P3T02KcBVQw7f4bdr7GFsl8-aSnuZ4o2uxxV7WPqzDP4MAMzKpBUjKbYzEMLSnW5QWAjykX2SkD5ActMNERGdrVjSav0c0F9BKktsYR25-4YR935ZSQwT42cq0oBV67PlgirJgC4kdIB1sYPrpiILPb_iWmgSlD11cz7nt_-6mRwsTtFCMbUJ4lrK8awl6ozRghWqePsOhwLRuJqztn5_Ujc03m56QvKR6onaGcxTPVbjYzuejWA5OGNym9QxHB1jkDsQEnrmkiBVZMaiLLQxXGxHpJOh3UzW_nlFj75cAddYqIo4TUGj13TeczfOe3oq2FScQ9eWNNDqEVmnnFOzfe3m7Eu-87if7Ljx3YM_x35j82i5ovX7Ge6dD_fJvf7VYkexeIlgbeTgELiCzaQ0dhfVbRoBG1RWHuf5JNsHI9V_CKhnynyUno3gt8YCoudd6FW4nty89ERTGjkdxAlYD0sgR_8I7lEiC-OOo8Dcd_qBwUPk48ilnOqgOTwP8q0qEWuW_BWvWxG_-GWpQ5j1q2p-CAuL0nwh_fp-MaK2jJJWvx3liI38KKYjoLRw7r3QU6NG_bycVY5Mj4XhFh8cfS_hSNzCGYNcLXK2l4xwgNN3XJ8GXe31uw6uA8m8SYSdVyuzySNyumcypdlmiP1gyB4in1PRy6g6LNEX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3A20
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x24 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:12 GMT
sd
us-u.openx.net/w/1.0/ Frame 3A20
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=utzfyejd18Sh3tKcvNTLy73V0JihiYPOvd4SOx60
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=utzfyejd18Sh3tKcvNTLy73V0JihiYPOvd4SOx60
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=utzfyejd18Sh3tKcvNTLy73V0JihiYPOvd4SOx60
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3A20
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=641922670622144214
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=641922670622144214
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=641922670622144214
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 3A20 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=5ee6fc64-903c-7669-e74e-0a5a2bbe2340&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 3A20 		170 B
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzI4OTJmYWUtNTk0Yi0yOGNkLWYyYWUtNTBlM2UxNWNlZDIw
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 3A20
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 7DC8
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x27 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=a6ec6194-d017-4d01-ab1b-e983e8443848
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:12 GMT
sd
us-u.openx.net/w/1.0/ Frame 7DC8
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=D7CtEF2xpR0UsqBFC7W5Rlzl90IU5aJAD7WRSQNT
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=D7CtEF2xpR0UsqBFC7W5Rlzl90IU5aJAD7WRSQNT
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=D7CtEF2xpR0UsqBFC7W5Rlzl90IU5aJAD7WRSQNT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 7DC8
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8704280253743185155
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8704280253743185155
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8704280253743185155
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 7DC8 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=5ee6fc64-903c-7669-e74e-0a5a2bbe2340&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 7DC8 		170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzI4OTJmYWUtNTk0Yi0yOGNkLWYyYWUtNTBlM2UxNWNlZDIw
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 7DC8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
43 B
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEDbezMp1H5U6vaxtpAxVaCw&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame FC02 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:13 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
b65bf639-a8d1-41a6-83eb-4c29c5717910
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 9A78 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=27757601&p=156858&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
875e2b6d2299842e7907dfbd11e834f1b62bb3c1adf5eec1a411b6c2cd932aff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
1811
content-type
text/html; charset=UTF-8
async_usersync
ib.adnxs.com/ Frame 5AC5 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:13 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
6e2a34f4-8759-47c4-8296-5af172fb4913
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443
8019191.fls.doubleclick.net/ Frame 8E5E
Redirect Chain
  • https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443?
  • https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443?
391 B
346 B 		Document
General
Check archive.org
Download Go to
Full URL
https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443?
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f6.1e100.net
Software
cafe /
Resource Hash
f1cd7af19bcd11c1f6bb50fc983f4be9243d8c3b8824cc5c343d5bd6763da513
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Wed, 17 Nov 2021 09:49:13 GMT
expires
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
323
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Wed, 17 Nov 2021 09:49:13 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
request_content.php
hal900024.redintelligence.net/ Frame CBED 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.252.84.201.138.clients.your-server.de
Software
Apache /
Resource Hash
f9e4c4b88023cda76eef99379a6ba0a289294528f488859685258d60b46770b8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
Apache
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Expires
Wed, 17 Nov 2021 09:49:13 +0100
Pragma
no-cache
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1500
Connection
close
Content-Type
text/html; charset=utf-8
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 545E 		1 KB
783 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Wed, 17 Nov 2021 05:53:44 GMT
expires
Thu, 18 Nov 2021 05:53:44 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
cache-control
public, max-age=86400
age
14129
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 77F4 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52848570158d15712ef6e6c60c4aff269b85a737fa57336759e1015aa928b198

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
match
c1.adform.net/serving/cookie/ Frame D8C9 		35 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?party=14&cid=B0364E8B-6D29-4844-ADB9-6C1AFA5254A1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Wed, 17 Nov 2021 09:49:13 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
image2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4378616187624166420
42 B
210 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4378616187624166420
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Wed, 17 Nov 2021 09:49:13 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
lhrpug003:0:623
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4378616187624166420
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9A78
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sDZOi20pSEStuWwa-lJUoQ%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=87042
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Thu, 18 Nov 2021 09:59:55 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 9A78
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a6ec6194-d017-4d01-ab1b-e983e8443848
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a6ec6194-d017-4d01-ab1b-e983e8443848
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:12 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x3 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a6ec6194-d017-4d01-ab1b-e983e8443848
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:12 GMT
mw
mwzeom.zeotap.com/ Frame 9A78
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=B0364E8B-6D29-4844-ADB9-6C1AFA5254A1
  • https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
  • https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=bae60edfc89c0247e20dae3ca33bda37
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
  • https://pixel.onaudience.com/?partner=147&mapped=2e2d02af-7c4a-4a07-9559-17763045ad0b&icm
  • https://spl.zeotap.com/?zdid=1332&zcluid=25231d507455e889
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8d5312327e&zclui...
  • https://mwzeom.zeotap.com/mw?google_gid=CAESEHYmF91_BHbFHFX1G02NiNA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8...
95 B
165 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mwzeom.zeotap.com/mw?google_gid=CAESEHYmF91_BHbFHFX1G02NiNA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8d5312327e&zcluid=25231d507455e889&zdid=1332
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6af80c45596959b3-MXP
access-control-allow-headers
*
content-length
95

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://mwzeom.zeotap.com/mw?google_gid=CAESEHYmF91_BHbFHFX1G02NiNA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=629f74fe-6bbd-4ec8-6238-9688d5f2471f&reqId=d4a8e7af-273a-42c3-4289-cb8d5312327e&zcluid=25231d507455e889&zdid=1332
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9A78
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjAzNjRFOEItNkQyOS00ODQ0LUFEQjktNkMxQUZBNTI1NEEx&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug002:0:353
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9A78
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIcEKZ-uajGGl2OuYW2VK9k&google_cver=1
42 B
592 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIcEKZ-uajGGl2OuYW2VK9k&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug011:0:473
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIcEKZ-uajGGl2OuYW2VK9k&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame 9A78 		43 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.122.14.34 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
22.0e.7a9f.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Tue, 16 Nov 2021 09:49:13 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9A78
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
42 B
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:12 GMT
cache-control
no-store, no-cache, private
x-lat
amspug010:0:564
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x12 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:12 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9A78
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=641922670622144214
42 B
541 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=641922670622144214
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:12 GMT
cache-control
no-store, no-cache, private
x-lat
amspug008:0:420
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=641922670622144214
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
a57d126b-bd66-44f3-917b-51b848d01463.png
cdn.pushcrew.com/img/logos/ee70c0a7d2f14ec08939692fc7857b11/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.pushcrew.com/img/logos/ee70c0a7d2f14ec08939692fc7857b11/a57d126b-bd66-44f3-917b-51b848d01463.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab71592cd90f248b86e7d1d717b1aa927ccaec516314322bd20fe1f13f5fc969

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
via
1.1 google
cf-cache-status
HIT
age
4
cf-polished
origFmt=png, origSize=30392
content-disposition
inline; filename="a57d126b-bd66-44f3-917b-51b848d01463.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
22074
last-modified
Tue, 08 May 2018 08:32:53 GMT
server
cloudflare
etag
"5af160b5-76b8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
6af80c400a6059c5-MXP
cf-bgj
imgq:85,h2pri
activeview
pagead2.googlesyndication.com/pcs/ Frame 7C7A 		42 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuoAt29C5-XnuLu6RFFU7mQU2k6x6K2MvMMr2MtH9vRKmK_K29fqZKmU3i1TfQuImV8ql-AMpcwRW8j8hge1pmQRyjsYUergetpP7sM3ot9kK-dNts&sai=AMfl-YQM1m_5P5NKs8z0P3e0rmC8Erbuk0M15xKaE8zGduBeuJe476S9G9lJ5XgimWeGCOkwPUG7ATVYIi2YrQkeN02u_AlIkhTIeD66lle54IAUVnNco1VQ11jgUCZO&sig=Cg0ArKJSzO6G3teuBhYAEAE&cid=CAASFeRo66UYJHfT7wUGoAco-glvQKwS3g&id=ampim&o=1075,661&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1018&mtos=0,0,1018,1018,1018&tos=0,0,1018,0,0&tfs=897&tls=1915&g=100&h=100&tt=1915&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=596600067
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
S-728x90.gif
cdn.contentspread.net/24i/content/soberfb/DE/ Frame CBED 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.contentspread.net/24i/content/soberfb/DE/S-728x90.gif
Requested by
Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
85.114.131.234 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv21038.dus4.fastwebserver.de
Software
nginx /
Resource Hash
7c67dc1e9ecce0d3757d97792fd606effaa6fe799ebe7423aff81e26e07900a1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900024.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Last-Modified
Mon, 23 Jul 2018 15:19:29 GMT
Server
nginx
ETag
"5b55f201-5f90"
Content-Type
image/gif
Connection
close
Accept-Ranges
bytes
Content-Length
24464
dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443
adservice.google.com/ddm/fls/z/ Frame 8E5E 		42 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443
Requested by
Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CMTp5aKPn_QCFQgfBgAd948AHA;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=556291102141.2443?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://8019191.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
viewability
hal900024.redintelligence.net/ Frame CBED 		0
150 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900024.redintelligence.net/viewability?s=11021600049051800951389011781024&a=fb4b901b&vb=m
Requested by
Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.252.84.201.138.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
truncated
/ Frame CBED 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/gif
addDoubleBorder.js
cdn.contentspread.net/24i/tools/js/ Frame CBED 		851 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.contentspread.net/24i/tools/js/addDoubleBorder.js
Requested by
Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=11021600049051800951389011781024&a=80e6954d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
85.114.131.234 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv21038.dus4.fastwebserver.de
Software
nginx /
Resource Hash
abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900024.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Last-Modified
Tue, 03 May 2016 20:54:50 GMT
Server
nginx
ETag
"5729101a-353"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
851
pixel
cm.g.doubleclick.net/ Frame 545E
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESELvCRZsaoTnWbQh4PKoFPAQ&google_cver=1&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMav...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=puxhlNAXTQGrG-mD6EQ4SA&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMavbjHLl20SeXU
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=puxhlNAXTQGrG-mD6EQ4SA&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMavbjHLl20SeXU
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x29 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=puxhlNAXTQGrG-mD6EQ4SA&google_push=AYg5qPIkUtqyjVORZJcvw3jIWP6vS7ReLIBP-jVEHfGkOozPCklFEiSzlTfqhautPn0tbcphasgEWsSasUtfzMavbjHLl20SeXU
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:12 GMT
i.match
s.tribalfusion.com/z/ Frame 545E
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk&r...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk...
43 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Server
2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6af80c420b620e2a-MXP
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
124
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6af80c40b97a0e2a-MXP
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE_wLp5EdYpsbzjV3S8XCaA&google_cver=1&google_push=AYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxOZGwDX0p0sp2kI2QM9RQ-pdHV_J_s4lENEr-dWS0Rh92RLT6YoOfnt-DrCUdYNDhLzx1mYUupQaLjlS-wGIxpWILLuk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
google
match.adsrvr.org/track/cmf/ Frame 545E 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBs63MNCCmH2shL6mXlcbcg&google_cver=1&google_push=AYg5qPKjyn3Zq6ewNrgJdZfc3sVYmE7aAfrZtaCOX_xHBvDcofWWkUKQbXSLAQbOSyKILd2QKWk4lkTNuBoRlaoUUxLqO_jyXmY
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 545E
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEH4-bgbfPnzKb90ktvAuZ0k&google_cver=1&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog&google_hm=OTA0Mzk2MTIwNzk3NDU2ODcw...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog&google_hm=OTA0Mzk2MTIwNzk3NDU2ODcwMg%3D%3D
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Wed, 17 Nov 2021 09:49:13 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKkd3uX86vi2IMIXIiewqjef8oXUNlVtE4NqSzv_8DlykDewhVfoteKB4zAp7QHn5gRoA2g2J_pyG_pnE6A9-t3os1gog&google_hm=OTA0Mzk2MTIwNzk3NDU2ODcwMg%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 545E
Redirect Chain
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEHCsDZx6pq_IyeoEd8PZViU&google_cver=1&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKq...
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKqxZILSNMk4vR_hU_r_O2RJ95Eb-4gcw&google_hm=QXc3b0JndDVPZ0dQd2l4dFpLZ...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKqxZILSNMk4vR_hU_r_O2RJ95Eb-4gcw&google_hm=QXc3b0JndDVPZ0dQd2l4dFpLZV9vX1E=
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPIMNNNlRtWybAW8r8qnjuHT9Xuvr13vM-uBUtacORvUVfO91YcUW2AB7yQX7LaKqxZILSNMk4vR_hU_r_O2RJ95Eb-4gcw&google_hm=QXc3b0JndDVPZ0dQd2l4dFpLZV9vX1E=
Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
exptsync
ads.yieldmo.com/ Frame 545E 		0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/exptsync?google_gid=CAESEFdsuOobpKq2_LGCwTy8gpA&google_cver=1&google_push=AYg5qPKZ5hniVWz6ATmujYQq_Et2Z9ltf2k5za4KcvHi35UdxJ_CcKzYwKnhO7sX0tAVaJ652ki1wexFGkAZ7J6XssdDV7jCgdM
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.74.33 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-74-33.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
pixel
cm.g.doubleclick.net/ Frame 545E
Redirect Chain
  • https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEK7t1ondotFhMQHcyf_oAYk&google_cver=1&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbM...
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbMkJSQf&google_hm=Njk1NTI0NDM...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbMkJSQf&google_hm=Njk1NTI0NDM0Mjg0OTM2MDExMA==
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPKR4fNuShtWrkGX4_v2akHvHNtS5Ce1cheE-hJ7RJ7b66qttk0TJmTZdOwKr9lCw79tAR9qktwdPXNs_OFJkiEkTbMkJSQf&google_hm=Njk1NTI0NDM0Mjg0OTM2MDExMA==
Date
Wed, 17 Nov 2021 09:49:13 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
attr
cm.g.doubleclick.net/pixel/ Frame 545E 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L-hLowuN2EXgc7T3Rkhash3erMoLU_XNpdiheamvReUblthJi5jESo_bxB94B-K6rqJtqkPA
Requested by
Host: e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
URL: https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:13 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
activeview
pagead2.googlesyndication.com/pcs/ Frame 9C90 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstFIo6Ur8MZs0cAGYivNjTXyI9GG2uJgnkqhbQ41KIoNEuvye2NRwy6TwndMrOysrQnsdrZm8cr_QQp_2B1ZHQWWjWKDbCSRhPaQ1c_p25U4_ERXwU&sai=AMfl-YQUg1w8-9-qlcLrRckT2oadM8wLCQaGdmfTzrhAZPr7wdHROfN9E9rRaV53YsHtrUhhyPnrQtuCjjOD0SoREWKhuiOYEIHhAt1901WlwJ0AjlJ4QbdE5TGHOgXZ&sig=Cg0ArKJSzIKOZ3kEsAb0EAE&cid=CAASFeRoYJlnkGn_mPfkYc5GeO-eYH_jcQ&id=ampim&o=1075,943&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=1149&tls=2149&g=100&h=100&tt=2149&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=547341003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:13 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMiLCJ1cmwiOiJodHRwczovL3NhZmVoYXZlbi5jb20vIiwiYWRVbml0IjoiLzIyNDA0MzM3NDY3LDM2NzM2Nzg3L3NhZmVoYXZlbi03Mjh4OTAtQlRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNTAyNDU2OTM3NCIsImNhbXBhaWduSWQiOiIyOTEwOTAwODYyIiwiY3JlYXRpdmVJZCI6IjEzODM2NTE3OTU3MyIsImxpbmVpdGVtSWQiOiI1Nzk1NTc3NDg3IiwiYWRTZXJ2ZXIiOiJkZnAiLCJ5aWVsZEdyb3VwSWRzIjpbMjg1ODM3XX0sIndpZHRoIjo3MjgsImhlaWdodCI6OTAsInd2IjoiMS4wLjArN2IxMjBhNSIsImJ2IjoiMS4wLjArN2IxMjBhNSIsInRhZ01hcmt1cCI6IjxodG1sPjxoZWFkPlxuICAgIDxtZXRhIGNoYXJzZXQ9XCJVVEYtOFwiPlxuICAgIDx0aXRsZT5TYWZlRnJhbWUgQ29udGFpbmVyPC90aXRsZT5cbiAgICA8c2NyaXB0PlxuKGZ1bmN0aW9uKCl7LypcblxuIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuXG4gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiovXG52YXIgbT10aGlzfHxzZWxmLHc9ZnVuY3Rpb24oYSl7cmV0dXJuIGF9O3ZhciB4O3ZhciB6PWZ1bmN0aW9uKGEsYixjKXt0aGlzLmc9Yz09PXk%2FYTpcIlwifTt6LnByb3RvdHlwZS50b1N0cmluZz1mdW5jdGlvbigpe3JldHVybiB0aGlzLmcudG9TdHJpbmcoKX07dmFyIHk9e307dmFyIEM9ZnVuY3Rpb24oYSxiKXt2YXIgYz12b2lkIDA9PT1jP3t9OmM7dGhpcy5lcnJvcj1hO3RoaXMuY29udGV4dD1iLmNvbnRleHQ7dGhpcy5tc2c9Yi5tZXNzYWdlfHxcIlwiO3RoaXMuaWQ9Yi5pZHx8XCJqc2Vycm9yXCI7dGhpcy5tZXRhPWN9O3ZhciBEPWZ1bmN0aW9uKGEpe0RbXCIgXCJdKGEpO3JldHVybiBhfTtEW1wiIFwiXT1mdW5jdGlvbigpe307dmFyIEU9L14oPzooW146Lz8jLl0rKTopPyg%2FOlxcL1xcLyg%2FOihbXlxcXFwvPyNdKilAKT8oW15cXFxcLz8jXSo%2FKSg%2FOjooWzAtOV0rKSk%2FKD89W1xcXFwvPyNdfCQpKT8oW14%2FI10rKT8oPzpcXD8oW14jXSopKT8oPzojKFtcXHNcXFNdKikpPyQvO3ZhciBJPWZ1bmN0aW9uKGEsYil7aWYoYSlmb3IodmFyIGMgaW4gYSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoYSxjKSYmYi5jYWxsKHZvaWQgMCxhW2NdLGMsYSl9O3ZhciBKPS9eaHR0cHM%2FOlxcL1xcLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98XFwvfCQpLyxLPWZ1bmN0aW9uKGEsYil7dGhpcy5nPWE7dGhpcy5oPWJ9LEw9ZnVuY3Rpb24oYSxiKXt0aGlzLnVybD1hO3RoaXMuaj0hIWI7dGhpcy5kZXB0aD1udWxsfTt2YXIgTT1mdW5jdGlvbihhKXttLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KG0uZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgYj1tLmRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoXCJpbWdcIik7Yi5zcmM9YTttLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cy5wdXNoKGIpfTt2YXIgTj1mdW5jdGlvbigpe3RoaXMuaT1cIiZcIjt0aGlzLmg9e307dGhpcy5vPTA7dGhpcy5nPVtdfSxPPWZ1bmN0aW9uKGEsYil7dmFyIGM9e307Y1thXT1iO3JldHVybltjXX0sVT1mdW5jdGlvbihhLGIsYyxkLGcpe3ZhciBlPVtdO0koYSxmdW5jdGlvbihmLGspeyhmPVQoZixiLGMsZCxnKSkmJmUucHVzaChrK1wiPVwiK2YpfSk7cmV0dXJuIGUuam9pbihiKX0sVD1mdW5jdGlvbihhLGIsYyxkLGcpe2lmKG51bGw9PWEpcmV0dXJuXCJcIjtiPWJ8fFwiJlwiO2M9Y3x8XCIsJFwiO1wic3RyaW5nXCI9PXR5cGVvZiBjJiYoYz1jLnNwbGl0KFwiXCIpKTtpZihhIGluc3RhbmNlb2YgQXJyYXkpe2lmKGQ9ZHx8MCxkPGMubGVuZ3RoKXtmb3IodmFyIGU9W10sZj0wO2Y8YS5sZW5ndGg7ZisrKWUucHVzaChUKGFbZl0sYixjLGQrMSxnKSk7cmV0dXJuIGUuam9pbihjW2RdKX19ZWxzZSBpZihcIm9iamVjdFwiPT10eXBlb2YgYSlyZXR1cm4gZz1nfHwwLDI%2BZz9lbmNvZGVVUklDb21wb25lbnQoVShhLGIsYyxkLGcrMSkpOlwiLi4uXCI7cmV0dXJuIGVuY29kZVVSSUNvbXBvbmVudChTdHJpbmcoYSkpfSxXPWZ1bmN0aW9uKGEpe3ZhciBiPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1qc2Vycm9yJlwiLGM9VihhKS0yNztpZigwPmMpcmV0dXJuXCJcIjthLmcuc29ydChmdW5jdGlvbihuLEEpe3JldHVybiBuLUF9KTtmb3IodmFyIGQ9bnVsbCxnPVwiXCIsZT0wO2U8YS5nLmxlbmd0aDtlKyspZm9yKHZhciBmPWEuZ1tlXSxrPWEuaFtmXSxsPTA7bDxrLmxlbmd0aDtsKyspe2lmKCFjKXtkPW51bGw9PWQ%2FZjpkO2JyZWFrfXZhciBoPVUoa1tsXSxhLmksXCIsJFwiKTtpZihoKXtoPWcraDtpZihjPj1oLmxlbmd0aCl7Yy09aC5sZW5ndGg7Yis9aDtnPWEuaTticmVha31kPW51bGw9PWQ%2FZjpkfX1hPVwiXCI7bnVsbCE9ZCYmKGE9ZytcInRybj1cIitkKTtyZXR1cm4gYithK1wiXCJ9LFY9ZnVuY3Rpb24oYSl7dmFyIGI9MSxjO2ZvcihjIGluIGEuaCliPWMubGVuZ3RoPmI%2FYy5sZW5ndGg6YjtyZXR1cm4gMzk5Ny1iLWEuaS5sZW5ndGgtMX07dmFyIFg9ZnVuY3Rpb24oYSl7aWYoLjAxPk1hdGgucmFuZG9tKCkpdHJ5e2lmKGEgaW5zdGFuY2VvZiBOKXZhciBiPWE7ZWxzZSBiPW5ldyBOLEkoYSxmdW5jdGlvbihkLGcpe3ZhciBlPWIsZj1lLm8rKztkPU8oZyxkKTtlLmcucHVzaChmKTtlLmhbZl09ZH0pO3ZhciBjPVcoYik7YyYmTShjKX1jYXRjaChkKXt9fTt2YXIgWT1mdW5jdGlvbihhKXt2YXIgYj1hLnRvU3RyaW5nKCk7YS5uYW1lJiYtMT09Yi5pbmRleE9mKGEubmFtZSkmJihiKz1cIjogXCIrYS5uYW1lKTthLm1lc3NhZ2UmJi0xPT1iLmluZGV4T2YoYS5tZXNzYWdlKSYmKGIrPVwiOiBcIithLm1lc3NhZ2UpO2lmKGEuc3RhY2spe2E9YS5zdGFjazt2YXIgYz1iO3RyeXstMT09YS5pbmRleE9mKGMpJiYoYT1jK1wiXFxuXCIrYSk7Zm9yKHZhciBkO2EhPWQ7KWQ9YSxhPWEucmVwbGFjZSgvKChodHRwcz86XFwvLi4qXFwvKVteXFwvOl0qOlxcZCsoPzoufFxcbikqKVxcMi8sXCIkMVwiKTtiPWEucmVwbGFjZSgvXFxuICovZyxcIlxcblwiKX1jYXRjaChnKXtiPWN9fXJldHVybiBifTt2YXIgYWE9L14oW147XSspOyhcXGQrKTsoW1xcc1xcU10qKSQvLGJhPWZ1bmN0aW9uKCl7dmFyIGE9d2luZG93Lm5hbWUsYj1hYS5leGVjKGEpO2lmKG51bGw9PT1iKXRocm93IEVycm9yKFwiQ2Fubm90IHBhcnNlIHNlcmlhbGl6ZWQgZGF0YS4gXCIrYS5zdWJzdHJpbmcoMCw1MCkpO2E9K2JbMl07dmFyIGM9YlszXTtpZihhPmMubGVuZ3RoKXRocm93IEVycm9yKFwiUGFyc2VkIGNvbnRlbnQgc2l6ZSBkb2Vzbid0IG1hdGNoLiBcIithK1wiOlwiK2MubGVuZ3RoKTtyZXR1cm57bTpiWzFdLGNvbnRlbnQ6Yy5zdWJzdHIoMCxhKSxsOmMuc3Vic3RyKGEpfX07dmFyIFo9bnVsbCxkYT1mdW5jdGlvbihhKXt2YXIgYj1hLmxlbmd0aCxjPTMqYi80O2MlMz9jPU1hdGguZmxvb3IoYyk6LTEhPVwiPS5cIi5pbmRleE9mKGFbYi0xXSkmJihjPS0xIT1cIj0uXCIuaW5kZXhPZihhW2ItMl0pP2MtMjpjLTEpO3ZhciBkPW5ldyBVaW50OEFycmF5KGMpLGc9MDtjYShhLGZ1bmN0aW9uKGUpe2RbZysrXT1lfSk7cmV0dXJuIGQuc3ViYXJyYXkoMCxnKX0sY2E9ZnVuY3Rpb24oYSxiKXtmdW5jdGlvbiBjKGwpe2Zvcig7ZDxhLmxlbmd0aDspe3ZhciBoPWEuY2hhckF0KGQrKyksbj1aW2hdO2lmKG51bGwhPW4pcmV0dXJuIG47aWYoIS9eW1xcc1xceGEwXSokLy50ZXN0KGgpKXRocm93IEVycm9yKFwiVW5rbm93biBiYXNlNjQgZW5jb2RpbmcgYXQgY2hhcjogXCIraCk7fXJldHVybiBsfWVhKCk7Zm9yKHZhciBkPTA7Oyl7dmFyIGc9YygtMSksZT1jKDApLGY9Yyg2NCksaz1jKDY0KTtpZig2ND09PWsmJi0xPT09ZylicmVhaztiKGc8PDJ8ZT4%2BNCk7NjQhPWYmJihiKGU8PDQmMjQwfGY%2BPjIpLDY0IT1rJiZiKGY8PDYmMTkyfGspKX19LGVhPWZ1bmN0aW9uKCl7aWYoIVope1o9e307Zm9yKHZhciBhPVwiQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODlcIi5zcGxpdChcIlwiKSxiPVtcIisvPVwiLFwiKy9cIixcIi1fPVwiLFwiLV8uXCIsXCItX1wiXSxjPTA7NT5jO2MrKylmb3IodmFyIGQ9YS5jb25jYXQoYltjXS5zcGxpdChcIlwiKSksZz0wO2c8ZC5sZW5ndGg7ZysrKXt2YXIgZT1kW2ddO3ZvaWQgMD09PVpbZV0mJihaW2VdPWcpfX19OyhmdW5jdGlvbihhKXtpZih3aW5kb3cubmFtZSl7dmFyIGI9ZnVuY3Rpb24oZSl7dHJ5e3ZhciBmPW5ldyBOO2YuZy5wdXNoKDEpO2YuaFsxXT1PKFwiY29udGV4dFwiLDUwNyk7ZS5lcnJvciYmZS5tZXRhJiZlLmlkfHwoZT1uZXcgQyhlLHttZXNzYWdlOlkoZSl9KSk7aWYoZS5tc2cpe3ZhciBrPWUubXNnLnN1YnN0cmluZygwLDUxMik7Zi5nLnB1c2goMik7Zi5oWzJdPU8oXCJtc2dcIixrKX12YXIgbD1bZS5tZXRhfHx7fV07Zi5nLnB1c2goMyk7Zi5oWzNdPWw7bD1tO2s9W107ZT1udWxsO2Rve3ZhciBoPWw7dHJ5e3ZhciBuO2lmKG49ISFoJiZudWxsIT1oLmxvY2F0aW9uLmhyZWYpYjp7dHJ5e0QoaC5mb28pO249ITA7YnJlYWsgYn1jYXRjaChCKXt9bj0hMX12YXIgQT1ufWNhdGNoKEIpe0E9ITF9aWYoQSl7dmFyIHI9aC5sb2NhdGlvbi5ocmVmO2U9aC5kb2N1bWVudCYmaC5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIHI9ZSxlPW51bGw7ay5wdXNoKG5ldyBMKHJ8fFwiXCIpKTt0cnl7bD1oLnBhcmVudH1jYXRjaChCKXtsPW51bGx9fXdoaWxlKGwmJmghPWwpO3I9MDtmb3IodmFyIHQ9ay5sZW5ndGgtMTtyPD10OysrcilrW3JdLmRlcHRoPXQtcjtoPW07aWYoaC5sb2NhdGlvbiYmaC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmgubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09ay5sZW5ndGgtMSlmb3IodD0xO3Q8ay5sZW5ndGg7Kyt0KXt2YXIgdT1rW3RdO3UudXJsfHwodS51cmw9aC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbdC0xXXx8XCJcIix1Lmo9ITApfXZhciBwPW5ldyBMKG0ubG9jYXRpb24uaHJlZiwhMSk7aD1udWxsO3ZhciBGPWsubGVuZ3RoLTE7Zm9yKHU9RjswPD11Oy0tdSl7dmFyIHE9a1t1XTshaCYmSi50ZXN0KHEudXJsKSYmKGg9cSk7aWYocS51cmwmJiFxLmope3A9cTticmVha319cT1udWxsO3ZhciBmYT1rLmxlbmd0aCYma1tGXS51cmw7MCE9cC5kZXB0aCYmZmEmJihxPWtbRl0pO3ZhciB2PW5ldyBLKHAscSk7aWYodi5oKXt2YXIgaGE9di5oLnVybHx8XCJcIjtmLmcucHVzaCg0KTtmLmhbNF09TyhcInRvcFwiLGhhKX12YXIgRz17dXJsOnYuZy51cmx8fFwiXCJ9O2lmKHYuZy51cmwpe3ZhciBIPXYuZy51cmwubWF0Y2goRSksUD1IWzFdLFE9SFszXSxSPUhbNF07cD1cIlwiO1AmJihwKz1QK1wiOlwiKTtRJiYocCs9XCIvL1wiLHArPVEsUiYmKHArPVwiOlwiK1IpKTt2YXIgUz1wfWVsc2UgUz1cIlwiO0c9W0cse3VybDpTfV07Zi5nLnB1c2goNSk7Zi5oWzVdPUc7WChmKX1jYXRjaChCKXt0cnl7WCh7Y29udGV4dDpcImVjbXNlcnJcIixyY3R4OjUwNyxtc2c6WShCKSx1cmw6diYmdi5nLnVybH0pfWNhdGNoKGlhKXt9fX07dHJ5e3ZhciBjPWJhKCksZD1KU09OLnBhcnNlKGMubCksZz12b2lkIDA9PT1kLmVuY3J5cHRpb25Nb2RlP251bGw6ZC5lbmNyeXB0aW9uTW9kZTt3aW5kb3cubmFtZT1cIlwiO2EoYy5jb250ZW50LGcsZnVuY3Rpb24oZSl7ZC5nb29nX3NhZmVmcmFtZV9obHQmJihtLmdvb2dfc2FmZWZyYW1lX2hsdD1kLmdvb2dfc2FmZWZyYW1lX2hsdCk7ZC5fY29udGV4dCYmKG0uQU1QX0NPTlRFWFRfREFUQT1kLl9jb250ZXh0KTttLnNmXz17djpjLm0sY2ZnOmR9O2RvY3VtZW50Lm9wZW4oXCJ0ZXh0L2h0bWxcIixcInJlcGxhY2VcIik7aWYodm9pZCAwPT09eCl7dmFyIGY9bnVsbDt2YXIgaz1tLnRydXN0ZWRUeXBlcztpZihrJiZrLmNyZWF0ZVBvbGljeSl7dHJ5e2Y9ay5jcmVhdGVQb2xpY3koXCJnb29nI2h0bWxcIix7Y3JlYXRlSFRNTDp3&i=1-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29662
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
6JXiEc94Yy1RSU-hSBP8YDacv3OXxTKbeyntbOZ0iIKc1y7CqccZYA==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
426 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=LGNyZWF0ZVNjcmlwdDp3LGNyZWF0ZVNjcmlwdFVSTDp3fSl9Y2F0Y2gobCl7bS5jb25zb2xlJiZtLmNvbnNvbGUuZXJyb3IobC5tZXNzYWdlKX14PWZ9ZWxzZSB4PWZ9ZT0oZj14KT9mLmNyZWF0ZUhUTUwoZSk6ZTtlPW5ldyB6KGUsbnVsbCx5KTtkb2N1bWVudC53cml0ZShlIGluc3RhbmNlb2YgeiYmZS5jb25zdHJ1Y3Rvcj09PXo%2FZS5nOlwidHlwZV9lcnJvcjpTYWZlSHRtbFwiKTtkb2N1bWVudC5jbG9zZSgpO20uc2ZfJiYod2luZG93Lm5hbWU9XCJcIil9LGIpfWNhdGNoKGUpe2IoZSl9fX0pKGZ1bmN0aW9uKGEsYixjKXtpZigyPT09Yil7Yj1uZXcgVGV4dERlY29kZXI7dmFyIGQ9LzxzdGFydGd1YXJkPiguKik8ZW5kZ3VhcmQ%2BL2cuZXhlYyhhKTtpZihhPWIuZGVjb2RlLmNhbGwoYixkYShkJiZkWzFdP2RbMV06YSkpKWI9YS50b0xvd2VyQ2FzZSgpLGE9LTE8Yi5pbmRleE9mKFwiPCFkb2N0eXBlXCIpfHwtMTxiLmluZGV4T2YoXCI8aHRtbFwiKT9hOlwiPCFkb2N0eXBlIGh0bWw%2BPGh0bWw%2BPGhlYWQ%2BPC9oZWFkPjxib2R5PlwiK2ErXCI8L2JvZHk%2BPC9odG1sPlwifWMoYSl9KTt9KS5jYWxsKHRoaXMpO1xuICAgIDwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzL2JsLWY4MjFhOTUtOTZjMDA3NTkuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMvYi03YjEyMGE1LWZlMTVjYjRlLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGQ9ZGVjb2RlVVJJQ29tcG9uZW50KFwiJTdCJTIyc2l0ZUlkJTIyJTNBJTIybWF0aC1haWRzJTIyJTJDJTIyd3YlMjIlM0ElMjIxLjAuMCUyQjdiMTIwYTUlMjIlMkMlMjJ0b3BEb21haW4lMjIlM0ElMjJodHRwcyUzQSUyRiUyRnNhZmVoYXZlbi5jb20lMkYlMjIlMkMlMjJjdXJyZW50VGFnSWQlMjIlM0ElMjJhZGx0YWdfa3czY2VreW5fcDR6YzA5MEtTUUIlMjIlMkMlMjJhdSUyMiUzQSUyMiUyRjIyNDA0MzM3NDY3JTJDMzY3MzY3ODclMkZzYWZlaGF2ZW4tNzI4eDkwLUJURl8wJTIyJTJDJTIyc2xvdEVsZW1lbnRJZCUyMiUzQSUyMmRpdi1ncHQtYWQtMTU1MzQ3NjA0NDE4My0wJTIyJTJDJTIyYWRTZXJ2ZXJEZXRhaWxzJTIyJTNBJTdCJTIyYWR2ZXJ0aXNlcklkJTIyJTNBJTIyNTAyNDU2OTM3NCUyMiUyQyUyMmNhbXBhaWduSWQlMjIlM0ElMjIyOTEwOTAwODYyJTIyJTJDJTIyY3JlYXRpdmVJZCUyMiUzQSUyMjEzODM2NTE3OTU3MyUyMiUyQyUyMmxpbmVpdGVtSWQlMjIlM0ElMjI1Nzk1NTc3NDg3JTIyJTJDJTIyYWRTZXJ2ZXIlMjIlM0ElMjJkZnAlMjIlMkMlMjJ5aWVsZEdyb3VwSWRzJTIyJTNBJTVCMjg1ODM3JTVEJTdEJTJDJTIydyUyMiUzQTcyOCUyQyUyMmglMjIlM0E5MCUyQyUyMnNhZmVGcmFtZUtleSUyMiUzQSUyMjYxNzUyMjkyJTIyJTdEXCIpO3dpbmRvd1tcIjI1Mjg3MjE1X21hdGgtYWlkc1wiXT17fTt3aW5kb3dbXCIyNTI4NzIxNV9tYXRoLWFpZHNcIl0udGFnRGV0YWlscz1KU09OLnBhcnNlKGQpO3dpbmRvdy5ibG9ja2VyICYmIGJsb2NrZXIoXCIyNTI4NzIxNV9tYXRoLWFpZHNcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge30pOzwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGpzY1ZlcnNpb24gPSAncjIwMjExMTExJzs8L3NjcmlwdD48c2NyaXB0PnZhciBnb29nbGVfY2FzbT1bXTs8L3NjcmlwdD48L2hlYWQ%2BPGJvZHkgbGVmdG1hcmdpbj1cIjBcIiB0b3BtYXJnaW49XCIwXCIgbWFyZ2lud2lkdGg9XCIwXCIgbWFyZ2luaGVpZ2h0PVwiMFwiPjxzY3JpcHQ%2Bd2luZG93LmRpY25mID0ge307PC9zY3JpcHQ%2BPHNjcmlwdCBkYXRhLWpjPVwiNDJcIiBkYXRhLWpjLXZlcnNpb249XCJyMjAyMTExMTFcIiBkYXRhLWpjLWZsYWdzPVwiWyZxdW90O3glMjc4NDQ2JzllZm90bSgmYW1wOzIwMDY3Oz44JmFtcDs%2BYGRvcGIvJTwxNzMyMjYxIT1uZWh1YH4mcXVvdDtdXCI%2BKGZ1bmN0aW9uKCl7LyogIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wICovICd1c2Ugc3RyaWN0Jzt2YXIgZGE9XCJmdW5jdGlvblwiPT10eXBlb2YgT2JqZWN0LmRlZmluZVByb3BlcnRpZXM%2FT2JqZWN0LmRlZmluZVByb3BlcnR5OmZ1bmN0aW9uKGEsYixjKXtpZihhPT1BcnJheS5wcm90b3R5cGV8fGE9PU9iamVjdC5wcm90b3R5cGUpcmV0dXJuIGE7YVtiXT1jLnZhbHVlO3JldHVybiBhfTtmdW5jdGlvbiBlYShhKXthPVtcIm9iamVjdFwiPT10eXBlb2YgZ2xvYmFsVGhpcyYmZ2xvYmFsVGhpcyxhLFwib2JqZWN0XCI9PXR5cGVvZiB3aW5kb3cmJndpbmRvdyxcIm9iamVjdFwiPT10eXBlb2Ygc2VsZiYmc2VsZixcIm9iamVjdFwiPT10eXBlb2YgZ2xvYmFsJiZnbG9iYWxdO2Zvcih2YXIgYj0wO2I8YS5sZW5ndGg7KytiKXt2YXIgYz1hW2JdO2lmKGMmJmMuTWF0aD09TWF0aClyZXR1cm4gY310aHJvdyBFcnJvcihcIkNhbm5vdCBmaW5kIGdsb2JhbCBvYmplY3RcIik7fXZhciBmYT1lYSh0aGlzKTsgZnVuY3Rpb24gaGEoYSxiKXtpZihiKWE6e3ZhciBjPWZhO2E9YS5zcGxpdChcIi5cIik7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aC0xO2QrKyl7dmFyIGY9YVtkXTtpZighKGYgaW4gYykpYnJlYWsgYTtjPWNbZl19YT1hW2EubGVuZ3RoLTFdO2Q9Y1thXTtiPWIoZCk7YiE9ZCYmbnVsbCE9YiYmZGEoYyxhLHtjb25maWd1cmFibGU6ITAsd3JpdGFibGU6ITAsdmFsdWU6Yn0pfX1oYShcImdsb2JhbFRoaXNcIixmdW5jdGlvbihhKXtyZXR1cm4gYXx8ZmF9KTt2YXIgcj10aGlzfHxzZWxmO2Z1bmN0aW9uIHQoYSl7dFtcIiBcIl0oYSk7cmV0dXJuIGF9dFtcIiBcIl09ZnVuY3Rpb24oKXt9O3ZhciBpYT17fSx3PW51bGw7IGZ1bmN0aW9uIGphKGEsYil7dm9pZCAwPT09YiYmKGI9MCk7aWYoIXcpe3c9e307Zm9yKHZhciBjPVwiQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODlcIi5zcGxpdChcIlwiKSxkPVtcIisvPVwiLFwiKy9cIixcIi1fPVwiLFwiLV8uXCIsXCItX1wiXSxmPTA7NT5mO2YrKyl7dmFyIGc9Yy5jb25jYXQoZFtmXS5zcGxpdChcIlwiKSk7aWFbZl09Zztmb3IodmFyIGU9MDtlPGcubGVuZ3RoO2UrKyl7dmFyIGs9Z1tlXTt2b2lkIDA9PT13W2tdJiYod1trXT1lKX19fWI9aWFbYl07Yz1BcnJheShNYXRoLmZsb29yKGEubGVuZ3RoLzMpKTtkPWJbNjRdfHxcIlwiO2ZvcihmPWc9MDtnPGEubGVuZ3RoLTI7Zys9Myl7dmFyIGg9YVtnXSxsPWFbZysxXTtrPWFbZysyXTtlPWJbaD4%2BMl07aD1iWyhoJjMpPDw0fGw%2BPjRdO2w9YlsobCYxNSk8PDJ8az4%2BNl07az1iW2smNjNdO2NbZisrXT1lK2grbCtrfWU9MDtrPWQ7c3dpdGNoKGEubGVuZ3RoLWcpe2Nhc2UgMjplPSBhW2crMV0saz1iWyhlJjE1KTw8Ml18fGQ7Y2FzZSAxOmE9YVtnXSxjW2ZdPWJbYT4%2BMl0rYlsoYSYzKTw8NHxlPj40XStrK2R9cmV0dXJuIGMuam9pbihcIlwiKX07dmFyIGthPVwiZnVuY3Rpb25cIj09PXR5cGVvZiBVaW50OEFycmF5O2NvbnN0IHk9U3ltYm9sKHZvaWQgMCk7ZnVuY3Rpb24geihhKXtPYmplY3QuaXNGcm96ZW4oYSl8fCh5P2FbeV18PTE6dm9pZCAwIT09YS5nP2EuZ3w9MTpPYmplY3QuZGVmaW5lUHJvcGVydGllcyhhLHtnOnt2YWx1ZToxLGNvbmZpZ3VyYWJsZTohMCx3cml0YWJsZTohMCxlbnVtZXJhYmxlOiExfX0pKTtyZXR1cm4gYX07ZnVuY3Rpb24gbGEoYSl7cmV0dXJuIG51bGwhPT1hJiZcIm9iamVjdFwiPT09dHlwZW9mIGEmJmEuY29uc3RydWN0b3I9PT1PYmplY3R9bGV0IEE7ZnVuY3Rpb24gbWEoYSl7c3dpdGNoKHR5cGVvZiBhKXtjYXNlIFwibnVtYmVyXCI6cmV0dXJuIGlzRmluaXRlKGEpP2E6U3RyaW5nKGEpO2Nhc2UgXCJvYmplY3RcIjppZihrYSYmbnVsbCE9YSYmYSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpcmV0dXJuIGphKGEpfXJldHVybiBhfTtmdW5jdGlvbiBuYShhLGIpe2lmKG51bGwhPWEpcmV0dXJuIEFycmF5LmlzQXJyYXkoYSl8fGxhKGEpP0IoYSxiKTpiKGEpfWZ1bmN0aW9uIEIoYSxiKXtpZihBcnJheS5pc0FycmF5KGEpKXt2YXIgYz1BcnJheShhLmxlbmd0aCk7Zm9yKGxldCBmPTA7ZjxhLmxlbmd0aDtmKyspY1tmXT1uYShhW2ZdLGIpO2lmKGI9QXJyYXkuaXNBcnJheShhKSl7dmFyIGQ7eT9kPWFbeV06ZD1hLmc7Yj0obnVsbD09ZD8wOmQpJjF9YiYmeihjKTtyZXR1cm4gY31kPXt9O2ZvcihjIGluIGEpZFtjXT1uYShhW2NdLGIpO3JldHVybiBkfWZ1bmN0aW9uIG9hKGEpe2E9bWEoYSk7cmV0dXJuIEFycmF5LmlzQXJyYXkoYSk%2FQihhLG9hKTphfTtsZXQgcGE7ZnVuY3Rpb24gRCgpe3ZhciBhPXZvaWQgMCxiPXFhLGM9cGE7cGE9bnVsbDthfHwoYT1jKTtjPXRoaXMuY29uc3RydWN0b3IudjthfHwoYT1jP1tjXTpbXSk7dGhpcy5oPShjPzA6LTEpLSh0aGlzLmNvbnN0cnVjdG9yLnV8fDApO3RoaXMuZz1hO2E6e2M9dGhpcy5nLmxlbmd0aDthPWMtMTtpZihjJiYoYz10aGlzLmdbYV0sbGEoYykpKXt0aGlzLmo9YS10aGlzLmg7dGhpcy5pPWM7YnJlYWsgYX10aGlzLmo9TnVtYmVyLk1BWF9WQUxVRX1pZihiKWZvcihhPTA7YTxiLmxlbmd0aDthKyspaWYoYz1iW2FdLGM8dGhpcy5qKXtjKz10aGlzLmg7dmFyIGQ9dGhpcy5nW2NdO2Q%2FQXJyYXkuaXNBcnJheShkKSYmeihkKTp0aGlzLmdbY109cmF9ZWxzZSBzYSh0aGlzKSwoZD10aGlzLmlbY10pP0FycmF5LmlzQXJyYXkoZCkmJnooZCk6dGhpcy5pW2NdPXJhfWNvbnN0IHJhPU9iamVjdC5mcmVlemUoeihbXSkpOyBmdW5jdGlvbiBzYShhKXtsZXQgYj1hLmorYS5oO2EuZ1tiXXx8KGEuaT1hLmdbYl09e30pfWZ1bmN0aW9uIEUoYSxiLGMpe2I%2BPWEuaj8oc2EoYSksYS5pW2JdPWMpOmEuZ1tiK2EuaF09YztyZXR1cm4gYX1ELnByb3RvdHlwZS50b0pTT049ZnVuY3Rpb24oKXtjb25zdCBhPXRoaXMuZztyZXR1cm4gQT9hOkIoYSxvYSl9O2Z1bmN0aW9uIHRhKGEsYil7cmV0dXJuIG1hKGIpfUQucHJvdG90eXBlLnRvU3RyaW5nPWZ1bmN0aW9uKCl7cmV0dXJuIHRoaXMuZy50b1N0cmluZygpfTtjbGFzcyB1YXtjb25zdHJ1Y3RvcihhKXt0aGlzLmtleT1hfX12YXIgRj1jbGFzcyBleHRlbmRzIHVhe2NvbnN0cnVjdG9yKGEpe3N1cGVyKGEpO3RoaXMuZGVmYXVsdFZhbHVlPSExfX07dmFyIHZhPW5ldyBGKFwiNDUzNTcxNTZcIiksd2E9bmV3IEYoXCI0NTM1MDg5MFwiKTt2YXIgRz0oYSxiKT0%2BXCImYWR1cmw9XCI9PWEuc3Vic3RyaW5nKGEubGVuZ3RoLTcpP2Euc3Vic3RyaW5nKDAsYS5sZW5ndGgtNykrYitcIiZhZHVybD1cIjphK2I7LyogIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wICovIGZ1bmN0aW9uIEgoYSxiLGMpe2EuYWRkRXZlbnRMaXN0ZW5lciYmYS5hZGRFdmVudExpc3RlbmVyKGIsYywhMSl9O3ZhciB4YT1SZWdFeHAoXCJeKD86KFteOi8%2FIy5dKyk6KT8oPzovLyg%2FOihbXlxcXFxcXFxcLz8jXSopQCk%2FKFteXFxcXFxcXFwvPyNdKj8pKD86OihbMC05XSspKT8oPz1bXFxcXFxcXFwvPyNdfCQpKT8oW14%2FI10rKT8oPzpcXFxcPyhbXiNdKikpPyg%2FOiMoW1xcXFxzXFxcXFNdKikpPyRcIik7ZnVuY3Rpb24gSShhKXt0cnl7dmFyIGI7aWYoYj0hIWEmJm51bGwhPWEubG9jYXRpb24uaHJlZilhOnt0cnl7dChhLmZvbyk7Yj0hMDticmVhayBhfWNhdGNoKGMpe31iPSExfXJldHVybiBifWNhdGNoKGMpe3JldHVybiExfX1mdW5jdGlvbiB5YSgpe2lmKCFnbG9iYWxUaGlzLmNyeXB0bylyZXR1cm4gTWF0aC5yYW5kb20oKTt0cnl7Y29uc3QgYT1uZXcgVWludDMyQXJyYXkoMSk7Z2xvYmFsVGhpcy5jcnlwdG8uZ2V0UmFuZG9tVmFsdWVzKGEpO3JldHVybiBhWzBdLzY1NTM2LzY1NTM2fWNhdGNoKGEpe3JldHVybiBNYXRoLnJhbmRvbSgpfX1mdW5jdGlvbiBKKGEsYil7aWYoYSlmb3IoY29uc3&i=2-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
BxIh4xIxxSs4ceuEqpMDoCRFfo8GDJo2Kv2fRhyj7s0a42935JMPxg==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=QgYyBpbiBhKU9iamVjdC5wcm90b3R5cGUuaGFzT3duUHJvcGVydHkuY2FsbChhLGMpJiZiLmNhbGwodm9pZCAwLGFbY10sYyxhKX1mdW5jdGlvbiBEYShhKXthPXZvaWQgMD09PWE%2FZG9jdW1lbnQ6YTtyZXR1cm4gYS5jcmVhdGVFbGVtZW50KFwiaW1nXCIpfTtmdW5jdGlvbiBMKGEsYixjPW51bGwpe0VhKGEsYixjKX1mdW5jdGlvbiBFYShhLGIsYyl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSk7Y29uc3QgZD1EYShhLmRvY3VtZW50KTtpZihjKXtjb25zdCBmPWc9PntjJiZjKGcpO2QucmVtb3ZlRXZlbnRMaXN0ZW5lciYmZC5yZW1vdmVFdmVudExpc3RlbmVyKFwibG9hZFwiLGYsITEpO2QucmVtb3ZlRXZlbnRMaXN0ZW5lciYmZC5yZW1vdmVFdmVudExpc3RlbmVyKFwiZXJyb3JcIixmLCExKX07SChkLFwibG9hZFwiLGYpO0goZCxcImVycm9yXCIsZil9ZC5zcmM9YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cy5wdXNoKGQpfSB2YXIgR2E9KCk9PntsZXQgYT1cImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ%2FaWQ9YmFkcHVid2luXCI7Sih7c3RhY2s6RXJyb3IoKS5zdGFja30sKGIsYyk9PntiJiYoYSs9YCYke2N9PSR7ZW5jb2RlVVJJQ29tcG9uZW50KGIpfWApfSk7RmEoYSl9LEZhPWE9Pnt2YXIgYj13aW5kb3c7Yi5mZXRjaD9iLmZldGNoKGEse2tlZXBhbGl2ZTohMCxjcmVkZW50aWFsczpcImluY2x1ZGVcIixyZWRpcmVjdDpcImZvbGxvd1wiLG1ldGhvZDpcImdldFwiLG1vZGU6XCJuby1jb3JzXCJ9KTpMKGIsYSl9O2xldCBNPTA7ZnVuY3Rpb24gSGEoYSxiPW51bGwpe3JldHVybiBiJiZiLmdldEF0dHJpYnV0ZShcImRhdGEtamNcIik9PT1TdHJpbmcoYSk%2FYjpkb2N1bWVudC5xdWVyeVNlbGVjdG9yKGBbJHtcImRhdGEtamNcIn09XCIke2F9XCJdYCl9O2Z1bmN0aW9uIElhKGEpe058fChOPW5ldyBKYSk7Y29uc3QgYj1OLmdbYS5rZXldO2lmKGEgaW5zdGFuY2VvZiBGKXJldHVyblwiYm9vbGVhblwiPT09dHlwZW9mIGI%2FYjphLmRlZmF1bHRWYWx1ZTt0aHJvdyBFcnJvcigpO312YXIgS2E9Y2xhc3N7Y29uc3RydWN0b3IoKXt0aGlzLmc9e319fTt2YXIgSmE9Y2xhc3MgZXh0ZW5kcyBLYXtjb25zdHJ1Y3Rvcigpe3N1cGVyKCk7dmFyIGE9SGEoTSxkb2N1bWVudC5jdXJyZW50U2NyaXB0KTthPWEmJmEuZ2V0QXR0cmlidXRlKFwiZGF0YS1qYy1mbGFnc1wiKXx8XCJcIjt0cnl7Y29uc3QgYj1KU09OLnBhcnNlKGEpWzBdO2E9XCJcIjtmb3IobGV0IGM9MDtjPGIubGVuZ3RoO2MrKylhKz1TdHJpbmcuZnJvbUNoYXJDb2RlKGIuY2hhckNvZGVBdChjKV5cIlxcdTAwMDNcXHUwMDA3XFx1MDAwM1xcdTAwMDdcXGJcXHUwMDA0XFx1MDAwNFxcdTAwMDZcXHUwMDA1XFx1MDAwM1wiLmNoYXJDb2RlQXQoYyUxMCkpO3RoaXMuZz1KU09OLnBhcnNlKGEpfWNhdGNoKGIpe319fSxOO3ZhciBMYT1kb2N1bWVudCxNYT13aW5kb3c7dmFyIE5hPSEhd2luZG93Lmdvb2dsZV9hc3luY19pZnJhbWVfaWQ7bGV0IE89TmEmJndpbmRvdy5wYXJlbnR8fHdpbmRvdztjbGFzcyBPYXtjb25zdHJ1Y3RvcihhLGIpe3RoaXMuZXJyb3I9YTt0aGlzLmNvbnRleHQ9Yi5jb250ZXh0O3RoaXMubXNnPWIubWVzc2FnZXx8XCJcIjt0aGlzLmlkPWIuaWR8fFwianNlcnJvclwiO3RoaXMubWV0YT17fX19O2NvbnN0IFBhPVJlZ0V4cChcIl5odHRwcz86Ly8oXFxcXHd8LSkrXFxcXC5jZG5cXFxcLmFtcHByb2plY3RcXFxcLihuZXR8b3JnKShcXFxcP3wvfCQpXCIpO3ZhciBRYT1jbGFzc3tjb25zdHJ1Y3RvcihhLGIpe3RoaXMuZz1hO3RoaXMuaD1ifX0sUmE9Y2xhc3N7Y29uc3RydWN0b3IoYSxiKXt0aGlzLnVybD1hO3RoaXMubT0hIWI7dGhpcy5kZXB0aD1udWxsfX07ZnVuY3Rpb24gUChhLGIpe2NvbnN0IGM9e307Y1thXT1iO3JldHVybltjXX1mdW5jdGlvbiBTYShhLGIsYyxkLGYpe2NvbnN0IGc9W107SihhLGZ1bmN0aW9uKGUsayl7KGU9VGEoZSxiLGMsZCxmKSkmJmcucHVzaChrK1wiPVwiK2UpfSk7cmV0dXJuIGcuam9pbihiKX0gZnVuY3Rpb24gVGEoYSxiLGMsZCxmKXtpZihudWxsPT1hKXJldHVyblwiXCI7Yj1ifHxcIiZcIjtjPWN8fFwiLCRcIjtcInN0cmluZ1wiPT10eXBlb2YgYyYmKGM9Yy5zcGxpdChcIlwiKSk7aWYoYSBpbnN0YW5jZW9mIEFycmF5KXtpZihkPWR8fDAsZDxjLmxlbmd0aCl7Y29uc3QgZz1bXTtmb3IobGV0IGU9MDtlPGEubGVuZ3RoO2UrKylnLnB1c2goVGEoYVtlXSxiLGMsZCsxLGYpKTtyZXR1cm4gZy5qb2luKGNbZF0pfX1lbHNlIGlmKFwib2JqZWN0XCI9PXR5cGVvZiBhKXJldHVybiBmPWZ8fDAsMj5mP2VuY29kZVVSSUNvbXBvbmVudChTYShhLGIsYyxkLGYrMSkpOlwiLi4uXCI7cmV0dXJuIGVuY29kZVVSSUNvbXBvbmVudChTdHJpbmcoYSkpfWZ1bmN0aW9uIFVhKGEpe2xldCBiPTE7Zm9yKGNvbnN0IGMgaW4gYS5oKWI9Yy5sZW5ndGg%2BYj9jLmxlbmd0aDpiO3JldHVybiAzOTk3LWItYS5pLmxlbmd0aC0xfSBmdW5jdGlvbiBWYShhLGIsYyl7Yj1iK1wiLy9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbVwiK2M7bGV0IGQ9VWEoYSktYy5sZW5ndGg7aWYoMD5kKXJldHVyblwiXCI7YS5nLnNvcnQoZnVuY3Rpb24oZyxlKXtyZXR1cm4gZy1lfSk7Yz1udWxsO2xldCBmPVwiXCI7Zm9yKGxldCBnPTA7ZzxhLmcubGVuZ3RoO2crKyl7Y29uc3QgZT1hLmdbZ10saz1hLmhbZV07Zm9yKGxldCBoPTA7aDxrLmxlbmd0aDtoKyspe2lmKCFkKXtjPW51bGw9PWM%2FZTpjO2JyZWFrfWxldCBsPVNhKGtbaF0sYS5pLFwiLCRcIik7aWYobCl7bD1mK2w7aWYoZD49bC5sZW5ndGgpe2QtPWwubGVuZ3RoO2IrPWw7Zj1hLmk7YnJlYWt9Yz1udWxsPT1jP2U6Y319fWE9XCJcIjtudWxsIT1jJiYoYT1mK1widHJuPVwiK2MpO3JldHVybiBiK2F9Y2xhc3MgUXtjb25zdHJ1Y3Rvcigpe3RoaXMuaT1cIiZcIjt0aGlzLmg9e307dGhpcy5qPTA7dGhpcy5nPVtdfX07ZnVuY3Rpb24gV2EoKXt2YXIgYT1SLGI9Uy5nb29nbGVfc3J0OzA8PWImJjE%2BPWImJihhLmc9Yil9ZnVuY3Rpb24gVChhLGIsYyxkLGYsZyl7aWYoKGQ%2FYS5nOk1hdGgucmFuZG9tKCkpPChmfHwuMDEpKXRyeXtsZXQgZTtjIGluc3RhbmNlb2YgUT9lPWM6KGU9bmV3IFEsSihjLChoLGwpPT57dmFyIG09ZSxuPW0uaisrO2g9UChsLGgpO20uZy5wdXNoKG4pO20uaFtuXT1ofSkpO2NvbnN0IGs9VmEoZSxhLmgsXCIvcGFnZWFkL2dlbl8yMDQ%2FaWQ9XCIrYitcIiZcIik7ayYmKFwidW5kZWZpbmVkXCIhPT10eXBlb2YgZz9MKHIsayxnKTpMKHIsaykpfWNhdGNoKGUpe319Y2xhc3MgWGF7Y29uc3RydWN0b3IoKXt2YXIgYT12b2lkIDA9PT1hP01hOmE7dGhpcy5oPVwiaHR0cDpcIj09PWEubG9jYXRpb24ucHJvdG9jb2w%2FXCJodHRwOlwiOlwiaHR0cHM6XCI7dGhpcy5nPU1hdGgucmFuZG9tKCl9fTtsZXQgVT1udWxsO3ZhciBZYT0oKT0%2Be2NvbnN0IGE9ci5wZXJmb3JtYW5jZTtyZXR1cm4gYSYmYS5ub3cmJmEudGltaW5nP01hdGguZmxvb3IoYS5ub3coKSthLnRpbWluZy5uYXZpZ2F0aW9uU3RhcnQpOkRhdGUubm93KCl9LFphPSgpPT57Y29uc3QgYT1yLnBlcmZvcm1hbmNlO3JldHVybiBhJiZhLm5vdz9hLm5vdygpOm51bGx9O2NsYXNzICRhe2NvbnN0cnVjdG9yKGEsYil7dmFyIGM9WmEoKXx8WWEoKTt0aGlzLmxhYmVsPWE7dGhpcy50eXBlPWI7dGhpcy52YWx1ZT1jO3RoaXMuZHVyYXRpb249MDt0aGlzLnVuaXF1ZUlkPU1hdGgucmFuZG9tKCk7dGhpcy5zbG90SWQ9dm9pZCAwfX07Y29uc3QgVj1yLnBlcmZvcm1hbmNlLGFiPSEhKFYmJlYubWFyayYmVi5tZWFzdXJlJiZWLmNsZWFyTWFya3MpLFc9ZnVuY3Rpb24oYSl7bGV0IGI9ITEsYztyZXR1cm4gZnVuY3Rpb24oKXtifHwoYz1hKCksYj0hMCk7cmV0dXJuIGN9fSgoKT0%2Be3ZhciBhO2lmKGE9YWIpe3ZhciBiO2lmKG51bGw9PT1VKXtVPVwiXCI7dHJ5e2E9XCJcIjt0cnl7YT1yLnRvcC5sb2NhdGlvbi5oYXNofWNhdGNoKGMpe2E9ci5sb2NhdGlvbi5oYXNofWEmJihVPShiPWEubWF0Y2goL1xcYmRlaWQ9KFtcXGQsXSspLykpP2JbMV06XCJcIil9Y2F0Y2goYyl7fX1iPVU7YT0hIWIuaW5kZXhPZiYmMDw9Yi5pbmRleE9mKFwiMTMzN1wiKX1yZXR1cm4gYX0pO2Z1bmN0aW9uIGJiKGEpe2EmJlYmJlcoKSYmKFYuY2xlYXJNYXJrcyhgZ29vZ18ke2EubGFiZWx9XyR7YS51bmlxdWVJZH1fc3RhcnRgKSxWLmNsZWFyTWFya3MoYGdvb2dfJHthLmxhYmVsfV8ke2EudW5pcXVlSWR9X2VuZGApKX0gY2xhc3MgY2J7Y29uc3RydWN0b3IoKXt2YXIgYT1TO3RoaXMuaD1bXTt0aGlzLmk9YXx8cjtsZXQgYj1udWxsO2EmJihhLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWU9YS5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlfHxbXSx0aGlzLmg9YS5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlLGI9YS5nb29nbGVfbWVhc3VyZV9qc190aW1pbmcpO3RoaXMuZz1XKCl8fChudWxsIT1iP2I6MT5NYXRoLnJhbmRvbSgpKX1zdGFydChhLGIpe2lmKCF0aGlzLmcpcmV0dXJuIG51bGw7YT1uZXcgJGEoYSxiKTtiPWBnb29nXyR7YS5sYWJlbH1fJHthLnVuaXF1ZUlkfV9zdGFydGA7ViYmVygpJiZWLm1hcmsoYik7cmV0dXJuIGF9ZW5kKGEpe2lmKHRoaXMuZyYmXCJudW1iZXJcIj09PXR5cGVvZiBhLnZhbHVlKXthLmR1cmF0aW9uPShaYSgpfHxZYSgpKS1hLnZhbHVlO3ZhciBiPWBnb29nXyR7YS5sYWJlbH1fJHthLnVuaXF1ZUlkfV9lbmRgO1YmJlcoKSYmVi5tYXJrKGIpOyF0aGlzLmd8fDIwNDg8dGhpcy5oLmxlbmd0aHx8IHRoaXMuaC5wdXNoKGEpfX19O2Z1bmN0aW9uIFgoYSl7bGV0IGI9YS50b1N0cmluZygpO2EubmFtZSYmLTE9PWIuaW5kZXhPZihhLm5hbWUpJiYoYis9XCI6IFwiK2EubmFtZSk7YS5tZXNzYWdlJiYtMT09Yi5pbmRleE9mKGEubWVzc2FnZSkmJihiKz1cIjogXCIrYS5tZXNzYWdlKTtpZihhLnN0YWNrKXthPWEuc3RhY2s7dHJ5ey0xPT1hLmluZGV4T2YoYikmJihhPWIrXCJcXG5cIithKTtsZXQgYztmb3IoO2EhPWM7KWM9YSxhPWEucmVwbGFjZSgvKChodHRwcz86XFwvLi4qXFwvKVteXFwvOl0qOlxcZCsoPzoufFxcbikqKVxcMi8sXCIkMVwiKTtiPWEucmVwbGFjZSgvXFxuICovZyxcIlxcblwiKX1jYXRjaChjKXt9fXJldHVybiBifSBmdW5jdGlvbiBkYihhLGIpe2xldCBjLGQ7dHJ5e2EuZyYmYS5nLmc%2FKGQ9YS5nLnN0YXJ0KCg5MDMpLnRvU3RyaW5nKCksMyksYz1iKCksYS5nLmVuZChkKSk6Yz1iKCl9Y2F0Y2goZil7Yj0hMDt0cnl7YmIoZCksYj1hLnMoOTAzLG5ldyBPYShmLHttZXNzYWdlOlgoZil9KSx2b2lkIDAsdm9pZCAwKX1jYXRjaChnKXthLm8oMjE3LGcpfWlmKGIpe2xldCBnLGU7bnVsbD09KGc9d2luZG93LmNvbnNvbGUpfHxudWxsPT0oZT1nLmVycm9yKXx8ZS5jYWxsKGcsZil9ZWxzZSB0aHJvdyBmO31yZXR1cm4gY31mdW5jdGlvbiBlYihhKXt2YXIgYj1ZO3JldHVybiguLi5jKT0%2BZGIoYiwoKT0%2BYS5hcHBseSh2b2lkIDAsYykpfSBjbGFzcyBmYntjb25zdHJ1Y3Rvcigpe3ZhciBhPVo7dGhpcy5pPVI7dGhpcy5oPW51bGw7dGhpcy5zPXRoaXMubzt0aGlzLmc9dm9pZCAwPT09YT9udWxsOmE7dGhpcy5qPSExfXBpbmdlcigpe3JldHVybiB0aGlzLml9byhhLGIsYyxkLGYpe2Y9Znx8XCJqc2Vycm9yXCI7bGV0IGc7dHJ5e2NvbnN0IHY9bmV3IFE7dmFyIGU9djtlLmcucHVzaCgxKTtlLmhbMV09UChcImNvbnRleHRcIixhKTtiLmVycm9yJiZiLm1ldGEmJmIuaWR8fChiPW5ldyBPYShiLHttZXNzYWdlOlgoYil9KSk7aWYoYi5tc2cpe2U9djt2YXIgaz1iLm1zZy5zdWJzdHJpbmcoMCw1MTIpO2UuZy5wdXNoKDIpO2UuaFsyXT1QKFwibXNnXCIsayl9dmFyIGg9Yi5tZXRhfHx7fTtiPWg7aWYodGhpcy5oKXRyeXt0aGlzLmgoYil9Y2F0Y2goeCl7fWlmKGQpdHJ5e2QoYil9Y2F0Y2goeCl7fWQ9djtoPVtoXTtkLmcucHVzaCgzKTtkLmhbM109aDtkPXI7aD1bXTtiPW51bGw7ZG97dmFyIGw9ZDtpZihJKGwpKXt2YXIg&i=3-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
1Nz5TkE1y2thYj3Q1d-QUAqMUJG0c5PXcxUK1Cb4a5ZZJK_UjMOmtA==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
429 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=bT1sLmxvY2F0aW9uLmhyZWY7IGI9bC5kb2N1bWVudCYmbC5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIG09YixiPW51bGw7aC5wdXNoKG5ldyBSYShtfHxcIlwiKSk7dHJ5e2Q9bC5wYXJlbnR9Y2F0Y2goeCl7ZD1udWxsfX13aGlsZShkJiZsIT1kKTtmb3IobGV0IHg9MCx6YT1oLmxlbmd0aC0xO3g8PXphOysreCloW3hdLmRlcHRoPXphLXg7bD1yO2lmKGwubG9jYXRpb24mJmwubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zJiZsLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucy5sZW5ndGg9PWgubGVuZ3RoLTEpZm9yKG09MTttPGgubGVuZ3RoOysrbSl7dmFyIG49aFttXTtuLnVybHx8KG4udXJsPWwubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zW20tMV18fFwiXCIsbi5tPSEwKX12YXIgdT1oO2xldCBLPW5ldyBSYShyLmxvY2F0aW9uLmhyZWYsITEpO2w9bnVsbDtjb25zdCBhYT11Lmxlbmd0aC0xO2ZvcihuPWFhOzA8PW47LS1uKXt2YXIgcD11W25dOyFsJiZQYS50ZXN0KHAudXJsKSYmKGw9cCk7aWYocC51cmwmJiFwLm0pe0s9IHA7YnJlYWt9fXA9bnVsbDtjb25zdCBqYj11Lmxlbmd0aCYmdVthYV0udXJsOzAhPUsuZGVwdGgmJmpiJiYocD11W2FhXSk7Zz1uZXcgUWEoSyxwKTtpZihnLmgpe3U9djt2YXIgcT1nLmgudXJsfHxcIlwiO3UuZy5wdXNoKDQpO3UuaFs0XT1QKFwidG9wXCIscSl9dmFyIGJhPXt1cmw6Zy5nLnVybHx8XCJcIn07aWYoZy5nLnVybCl7dmFyIGNhPWcuZy51cmwubWF0Y2goeGEpLEM9Y2FbMV0sQWE9Y2FbM10sQmE9Y2FbNF07cT1cIlwiO0MmJihxKz1DK1wiOlwiKTtBYSYmKHErPVwiLy9cIixxKz1BYSxCYSYmKHErPVwiOlwiK0JhKSk7dmFyIENhPXF9ZWxzZSBDYT1cIlwiO0M9djtiYT1bYmEse3VybDpDYX1dO0MuZy5wdXNoKDUpO0MuaFs1XT1iYTtUKHRoaXMuaSxmLHYsdGhpcy5qLGMpfWNhdGNoKHYpe3RyeXtUKHRoaXMuaSxmLHtjb250ZXh0OlwiZWNtc2VyclwiLHJjdHg6YSxtc2c6WCh2KSx1cmw6ZyYmZy5nLnVybH0sdGhpcy5qLGMpfWNhdGNoKEspe319cmV0dXJuITB9fTtjbGFzcyBnYnt9O2xldCBSLFk7aWYoTmEmJiFJKE8pKXsuMDE%2BTWF0aC5yYW5kb20oKSYmR2EoKTtsZXQgYT1cIi5cIitMYS5kb21haW47dHJ5e2Zvcig7MjxhLnNwbGl0KFwiLlwiKS5sZW5ndGgmJiFJKE8pOylMYS5kb21haW49YT1hLnN1YnN0cihhLmluZGV4T2YoXCIuXCIpKzEpLE89d2luZG93LnBhcmVudH1jYXRjaChiKXt9SShPKXx8KE89d2luZG93KX1jb25zdCBTPU8sWj1uZXcgY2I7dmFyIGhiPSgpPT57aWYoIVMuZ29vZ2xlX21lYXN1cmVfanNfdGltaW5nKXt2YXIgYT1aO2EuZz0hMTthLmghPWEuaS5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlJiYoVygpJiZBcnJheS5wcm90b3R5cGUuZm9yRWFjaC5jYWxsKGEuaCxiYix2b2lkIDApLGEuaC5sZW5ndGg9MCl9fTsgKGE9PntSPW51bGwhPWE%2FYTpuZXcgWGE7XCJudW1iZXJcIiE9PXR5cGVvZiBTLmdvb2dsZV9zcnQmJihTLmdvb2dsZV9zcnQ9TWF0aC5yYW5kb20oKSk7V2EoKTtZPW5ldyBmYjtZLmg9Yj0%2Be3ZhciBjPU07MCE9PWMmJihiLmpjPVN0cmluZyhjKSxjPShjPUhhKGMsZG9jdW1lbnQuY3VycmVudFNjcmlwdCkpJiZjLmdldEF0dHJpYnV0ZShcImRhdGEtamMtdmVyc2lvblwiKXx8XCJ1bmtub3duXCIsYi5zaHY9Yyl9O1kuaj0hMDtcImNvbXBsZXRlXCI9PVMuZG9jdW1lbnQucmVhZHlTdGF0ZT9oYigpOlouZyYmSChTLFwibG9hZFwiLCgpPT57aGIoKX0pfSkoKTtmdW5jdGlvbiBpYigpe3ZhciBhLGI7Y29uc3QgYz13aW5kb3c7aWYoYy5nbWFTZGt8fChudWxsPT09KGE9Yy53ZWJraXQpfHx2b2lkIDA9PT1hPzA6YS5tZXNzYWdlSGFuZGxlcnMuZ2V0R21hVmlld1NpZ25hbHMpKXJldHVybiBjO3RyeXtjb25zdCBkPXdpbmRvdy5wYXJlbnQ7aWYoZC5nbWFTZGt8fChudWxsPT09KGI9ZC53ZWJraXQpfHx2b2lkIDA9PT1iPzA6Yi5tZXNzYWdlSGFuZGxlcnMuZ2V0R21hVmlld1NpZ25hbHMpKXJldHVybiBkfWNhdGNoKGQpe31yZXR1cm4gbnVsbH0gZnVuY3Rpb24ga2IoYSxiPXt9LGM9KCk9Pnt9LGQ9KCk9Pnt9KXtjb25zdCBmPVN0cmluZyhNYXRoLmZsb29yKDIxNDc0ODM2NDcqeWEoKSkpO2xldCBnPTA7Y29uc3QgZT1rPT57dHJ5e3ZhciBoPVwib2JqZWN0XCI9PT10eXBlb2Ygay5kYXRhP2suZGF0YTpKU09OLnBhcnNlKGsuZGF0YSk7Zj09PWgucGF3X2lkJiYod2luZG93LmNsZWFyVGltZW91dChnKSx3aW5kb3cucmVtb3ZlRXZlbnRMaXN0ZW5lcihcIm1lc3NhZ2VcIixlKSxoLnNpZ25hbD9jKGguc2lnbmFsKTpoLmVycm9yJiZkKGguZXJyb3IpKX1jYXRjaChtKXtrPXttc2c6XCJwb3N0bWVzc2FnZUVycm9yXCIsZXJyOm0gaW5zdGFuY2VvZiBFcnJvcj9tLm1lc3NhZ2U6XCJub25FcnJvclwiLGRhdGE6bnVsbD09ay5kYXRhP1wibnVsbFwiOjUwMDxrLmRhdGEubGVuZ3RoP2suZGF0YS5zdWJzdHJpbmcoMCw1MDApOmsuZGF0YX07aD1nYjt2YXIgbD1cImxcIjtoLmwmJmguaGFzT3duUHJvcGVydHkobCl8fChsPW5ldyBoLGgubD1sKTtoPVtdOyFrLmVpZCYmIGgubGVuZ3RoJiYoay5laWQ9aC50b1N0cmluZygpKTtUKFIsXCJwYXdfc2lnc1wiLGssITAsdm9pZCAwLHZvaWQgMCl9fTt3aW5kb3cuYWRkRXZlbnRMaXN0ZW5lcihcIm1lc3NhZ2VcIixlYihrPT57ZShrKX0pKTthLnBvc3RNZXNzYWdlKE9iamVjdC5hc3NpZ24oe3Bhd19pZDpmfSxiKSk7Zz13aW5kb3cuc2V0VGltZW91dCgoKT0%2Be3dpbmRvdy5yZW1vdmVFdmVudExpc3RlbmVyKFwibWVzc2FnZVwiLGUpO2QoXCJQQVcgR01BIHBvc3RtZXNzYWdlIHRpbWVkIG91dC5cIil9LDIwMCl9O3ZhciBsYj1jbGFzcyBleHRlbmRzIER7fSxxYT1bNl07Y29uc3QgbWI9XCJwbGF0Zm9ybSBwbGF0Zm9ybVZlcnNpb24gYXJjaGl0ZWN0dXJlIG1vZGVsIHVhRnVsbFZlcnNpb24gYml0bmVzc1wiLnNwbGl0KFwiIFwiKTt2YXIgbmI9KCk9Pnt2YXIgYT13aW5kb3c7cmV0dXJuIGEubmF2aWdhdG9yJiZhLm5hdmlnYXRvci51c2VyQWdlbnREYXRhJiZcImZ1bmN0aW9uXCI9PT10eXBlb2YgYS5uYXZpZ2F0b3IudXNlckFnZW50RGF0YS5nZXRIaWdoRW50cm9weVZhbHVlcz9hLm5hdmlnYXRvci51c2VyQWdlbnREYXRhLmdldEhpZ2hFbnRyb3B5VmFsdWVzKG1iKS50aGVuKGI9Pnt2YXIgYz1uZXcgbGI7Yz1FKGMsMSxiLnBsYXRmb3JtKTtjPUUoYywyLGIucGxhdGZvcm1WZXJzaW9uKTtjPUUoYywzLGIuYXJjaGl0ZWN0dXJlKTtjPUUoYyw0LGIubW9kZWwpO2M9RShjLDUsYi51YUZ1bGxWZXJzaW9uKTtyZXR1cm4gRShjLDksYi5iaXRuZXNzKX0pOm51bGx9O2NsYXNzIG9ie2NvbnN0cnVjdG9yKCl7dGhpcy5wcm9taXNlPW5ldyBQcm9taXNlKGE9Pnt0aGlzLmc9YX0pfX07d2luZG93LnZpZXdSZXE9W107Y29uc3QgcGI9YT0%2Be2NvbnN0IGI9bmV3IEltYWdlO2Iuc3JjPWEucmVwbGFjZShcIiZhbXA7XCIsXCImXCIpO3dpbmRvdy52aWV3UmVxLnB1c2goYil9LHFiPWE9PntmZXRjaChhLHtrZWVwYWxpdmU6ITAsY3JlZGVudGlhbHM6XCJpbmNsdWRlXCIscmVkaXJlY3Q6XCJmb2xsb3dcIixtZXRob2Q6XCJnZXRcIixtb2RlOlwibm8tY29yc1wifSkuY2F0Y2goKCk9PntwYihhKX0pfSxyYj1hPT57d2luZG93LmZldGNoP3FiKGEpOnBiKGEpfTtNPTQyOyB3aW5kb3cudnU9YT0%2Be3ZhciBiLGMsZCxmO2NvbnN0IGc9SWEodmEpLGU9aWIoKTtnJiZudWxsIT0obnVsbD09PShiPW51bGw9PT1lfHx2b2lkIDA9PT1lP3ZvaWQgMDplLmdtYVNkayl8fHZvaWQgMD09PWI%2Fdm9pZCAwOmIuZ2V0Vmlld1NpZ25hbHMpJiYoYj1udWxsPT09KGM9bnVsbD09PWV8fHZvaWQgMD09PWU%2Fdm9pZCAwOmUuZ21hU2RrKXx8dm9pZCAwPT09Yz92b2lkIDA6Yy5nZXRWaWV3U2lnbmFscygpKSYmKGE9RyhhLFwiJm1zPVwiK2IpKTtjb25zdCBrPVtdO2M9KCk9Pntjb25zdCBoPW5ldyBvYjtrLnB1c2goaC5wcm9taXNlKTtyZXR1cm4gaC5nfTtpZihiPUlhKHdhKSl7Y29uc3QgaD1uYigpO2lmKG51bGwhPWgpe2NvbnN0IGw9YygpO2gudGhlbihtPT57YTp7QT0hMDt0cnl7dmFyIG49SlNPTi5zdHJpbmdpZnkobS50b0pTT04oKSx0YSk7YnJlYWsgYX1maW5hbGx5e0E9ITF9bj12b2lkIDB9bT1uO249W107Zm9yKHZhciB1PTAscD0wO3A8bS5sZW5ndGg7cCsrKXt2YXIgcT0gbS5jaGFyQ29kZUF0KHApOzI1NTxxJiYoblt1KytdPXEmMjU1LHE%2BPj04KTtuW3UrK109cX1tPWphKG4sMyk7MDxtLmxlbmd0aCYmKGE9RyhhLFwiJnVhY2g9XCIrbSkpO2woKX0pfX1pZihnJiZudWxsIT0obnVsbD09PShkPW51bGw9PT1lfHx2b2lkIDA9PT1lP3ZvaWQgMDplLndlYmtpdCl8fHZvaWQgMD09PWQ%2Fdm9pZCAwOmQubWVzc2FnZUhhbmRsZXJzLmdldEdtYVZpZXdTaWduYWxzKSl7Y29uc3QgaD1jKCk7a2IobnVsbD09PShmPW51bGw9PT1lfHx2b2lkIDA9PT1lP3ZvaWQgMDplLndlYmtpdCl8fHZvaWQgMD09PWY%2Fdm9pZCAwOmYubWVzc2FnZUhhbmRsZXJzLmdldEdtYVZpZXdTaWduYWxzLHt9LGw9PnthPUcoYSxcIiZcIitsKTtoKCl9LCgpPT57aCgpfSl9Ynx8Zz9Qcm9taXNlLmFsbChrKS50aGVuKCgpPT57cmIoYSl9KTpyYihhKX07fSkuY2FsbCh0aGlzKTs8L3NjcmlwdD48c2NyaXB0PnZ1KFwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haVxceDNkQ0JpYTJGZENVWWYzMU51LXd4X0FQei1temtBN1BoNDZiWE1DRzJZTEdBc0NOdHdFUUFTQUFZSlg2OElHTUI0SUJGMk5oTFhCMVlpMDBNVEV6TmpneE9EZ3lNekV4TkRVMXlBRUo0QUlBcUFNQnFnU01Ba19RWW12OUZtUUF1eHRrSUVmUkJLRjdTcld1R2g0ZTZQeWF4MjNxUnBicmF6UTQwOFctY3ZSNEZHc0xKMjRzZFZtWXl4S0xBSDlhVnF6NG1hd2lQUDVOUFI1V0JSRzcyX3RVeFpXT0N0cXVVb0lXZGUwOXZHcDg5VDNDZnhYVmZ2czRMdmk0QUw5Umk1STZ0RHdiSW1BSUZ5a3pvaFBfM19hQnJuRGM0aDUwbFJ2cUNkd1loWU83SmtyRERrWXJQcWdleUtvUWZrUGtYQmFuNW9DMU9nR1MtS2s0VmJYRXNESHB4T3V1Vms3aENmNGJ2TENNcENYUy1lZmF4Z1B4QURHRlp0aUF1aUR5SGxzNHdxNGlYTXd4Zkh0dHNjN3ZHT0ZNVGxBZEppc2VHbHVLX0hzdTZZTWVRZVJXU2xSUW9neGxCdTFQS3hjeHg3RS1uSGhrdF9lbGFNbU9fMXU5bWZIYjFObmdCQUdBQnNycjZkRHVzSU9xaVFHZ0JpR29CNmEtRzZnSGx0Z2JxQWVxbTdFQ3FBZmZuN0VDMkFjQTBnZ0ZDSUJoRUFHQUNnUDZDd0lJQVlBTUFkQVZBWUFYQWJJWEhBb2FFaFJ3ZFdJdE5ERXhNelk0TVRnNE1qTXhNVFExTlJpRTIzc1xceDI2c2lnaFxceDNkVGQ3UlJSOHVuTEFcXHgyNnVhY2hfbVxceDNkW1VBQ0hdXFx4MjZjaWRcXHgzZENBUVNQQUNOSXJMTWQ3VDY1akd0Y1RiR1RIcXFPVGp1UkVsNnhySE1mdFZoOTM4eWEtUTlBZmNLM005MG1VTXM0OGVMNTlqN0JrakhNZ0hkcFl4ZkZoZ0JcXHgyNnRwZFxceDNkQUdXaEptdHNpV2RydHJEUURPNWxscFo0dXUtSHphRDQ5N2RwVmhzU0xmZFZtYXdYd0lMZHdvX20tQTl2NHAzaUpmc05CQzZUYVlVWnlpakIwS2hobEtSSHRwLWRTTHRCWld0aFVockU3eE53MUJIV0NQSkZoVlR2ZG1DWkkwbXNpTnBlMWtkaFZvaGJ6NW9MZlZyVlk2cmt2SEQ5U1hsUDFlcXdpN2FrVGNpeFBROHF1eFRUZHI5dU9aLTRoZmYyellTVnhEdUlqV1hOYkk4WkZFS2t3Z1k5RXV2Q2s2dW1GLWxvYWhHUTN0bjZGa1lCTlAyU2d4clVIQlUxclFWS2NldHUySElLcHNyVDllZ25Fend2VElvWWxmN0R5RVJJc29xQVNQbThnZ1BTU0RTSnJqSFpLM04wNVF6V2FYQWI0bU9GT2ZPYW9aNmZIY1R2d0w5TDRDUXB3VVRscDRqWWcxMnI1Z2RaZzJQS25LY0FzU3prUW81T0lRaWdqY0xITjJiRFdEckk4ZlpzaUQ0UmVOMHN6LUdyTnhURDR6Q1VLZGlER2lIelB5WXE4N1RRSFREOXBYYy1IYnMzQWNmVG5Ic3hOYlhPR2QtemVDSjlhQXZKTV9qc1E1N2dzU1ZsamJ5bzF1TlhFU0xoQ3ZGaVd5ODBBdXFIbDBTeFVpbzFYTkZXMTUyMGtfMWRzU3VHeGM5a0FsTXNfejk0MFV0LVJzRWdDdEp1aVIyRTBBUWZibGVWbmRfaGg3b2JTT1&i=4-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
lIbCWkgey_b1EC_NVZtXTqwDu6-ZPkfJGWSvYbWnCovvVXY_sfZM-w==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=pYOUlfQzVCNzZZYzYxeUYyZ0FOWVJfSWZmeWtDMmIyWndwLTVJT1J3WkRnRXQwMU1WY25HNTZnUXk1aWpfVXdnc0cwaTlWWXpFNmgzbHdsbzBKLU54SmxrZjFWTERfcWx6Mk52U1FWc3p0MDFYTmwwUDVTRWVFNnJmR1k4M0p1T3BoNzZqa1dfdHVWamdrQW80ckZ2ZzB6OUJuZ3ROWVdWckUxR04wZzhYbm5OUzJ1amNiTERvaE14bzJ2NWNDX2luM0hoVXh5b0RiNk50VW1PTmdtUWZISUlJazh0QnVyTmlybFh4dkNYeTBjM3FwVFJTTkRBRFd4MWptM1V0SU1PekhuZ2pfekU2T2RmMnJpOTNPVjdEb2VPeXoyRUZfRHRENTVlLTFud0Vsb21yOHlnaWJVdS1ySElJRG5DQUE0NWRxaVR0dEZCbFZWWXJTZk5tV19uM2h4R3FKd0xVbFpFWlkwbVhmLXNTYU1HazhuQXRycHlEZjZXNk80SlNsdnBPWC1aOHFIM3ZqSkcwR3FoMXFxTkJFbDRvcFU4N0VHMHcwZFcxN09qVDZYN3UxMnZWbmNDSEVvczZXaVQ1MEYwd2RSak5EUXd0eTROdk1YVVU5a1VmcUluSzJKUmdjcjg4T2R6M2J5Yk9KdktKbUtaQTR1OFBpZWxsR1BJQ19STWZ0NFl0N0FWTWx1MUpXbWlhb1VuQ1BlWVwiKTwvc2NyaXB0PjxkaXYgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3SW5uZXJDb250YWluZXJcIiBzdHlsZT1cImxlZnQ6MHB4O3RvcDowcHg7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTtwb3NpdGlvbjpmaXhlZDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6LTk5OTk7XCI%2BPC9kaXY%2BPGRpdiBzdHlsZT1cImRpc3BsYXk6aW5saW5lXCIgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3RWxlbWVudFwiIGRhdGEtZ29vZ2xlLWF2LWN4bj1cImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3NhSkpMT0Z2cmJBczhNOTJtanZ0d1FMbGJiaU1Eb3NuWjNiMWVMZlNRajMwYUtIRVBYWEY5Ulo4akpWWEd5RmlTUHdvcTNOUjNIYl8tSUpESlBlWGdkV1EmYW1wO3NpZz1DZzBBcktKU3pJX0kyLTEySlZaS0VBRSZhbXA7Y2lkPUNBQVNGZVJvWGdmd3g2STUzLTVFeTNqUzcwLXk1NnkycGdcIiBkYXRhLWdvb2dsZS1hdi1hZGs9XCIzMjczOTc1MzAyXCIgZGF0YS1nb29nbGUtYXYtbWV0YWRhdGE9XCJsYT0wJmFtcDt4ZGk9MCZhbXA7XCIgZGF0YS1nb29nbGUtYXYtb3ZlcnJpZGU9XCItMVwiIGRhdGEtZ29vZ2xlLWF2LWRtPVwiMlwiIGRhdGEtZ29vZ2xlLWF2LWltbWVkaWF0ZT1cIlwiIGRhdGEtZ29vZ2xlLWF2LWFpZD1cIjBcIiBkYXRhLWdvb2dsZS1hdi1uYWlkPVwiMVwiIGRhdGEtZ29vZ2xlLWF2LXNsaWZ0PVwiXCIgZGF0YS1nb29nbGUtYXYtY3BtYXY9XCJcIiBkYXRhLWdvb2dsZS1hdi1idHI9XCJcIiBkYXRhLWdvb2dsZS1hdi1pdHBsPVwiMjBcIiBkYXRhLWdvb2dsZS1hdi1ycz1cIjRcIiBkYXRhLWdvb2dsZS1hdi1mbGFncz1cIlsmcXVvdDt4JTI3ODQ0MCc5ZWZvdG0oJmFtcDs3NTMzNzQlMmJlanZmLyUyNzg0ND4nOXd1dmIkJmFtcDs1NjUzMz4hPXx2cWMpITI3Mzc5NCZhbXA7PHFxdmIvJTwxNzM1MDIwIT1uZWh1YC8hMzY0PTUwNTEhOWFia3thKCQxNjAyMTA6MyZhbXA7PGNib3RmKyowMTUwMDM0OiUyYmVqdmYvJTcyOzE3NjEzIT1lZmR3YSonNzY0NjM7MjEkP2Via3BiJCZhbXA7MDM2NjcxNz4qPmJnaXBmKyEzPTcxMjM2MyU5YWlod2MpITcyMDI8MjE3JzllZm90bSgmYW1wOzIwMDYxOzQ4JmFtcDs%2BYGRvcGIvJTwxNzA3MjAwIT04KCZhbXA7MjAwNTU3NT8mYW1wOz5gZG9wYn4mcXVvdDtdXCIgZGF0YS1jcmVhdGl2ZS1sb2FkLWxpc3RlbmVyPVwiXCI%2BPHNjcmlwdCBsYW5ndWFnZT1cIkphdmFTY3JpcHRcIiBzcmM9XCJodHRwczovL3RhZ3MubWF0aHRhZy5jb20vbm90aWZ5L2pzP2V4Y2g9YWR4JmFtcDtzX2V4Y2g9YWR4JmFtcDtpZD01YVc5NXEyakx6SXpMeUF2VGxkV2FrOVVTVEJPUjBWMFRucENhRTVETVdwYVIxSnBURlJCZDAxRVFYUk5SRUYzVFVSQmQwMUVRWGROUkVGM0x6STNOakk0TkRBNE1UZzJPVFV6TlRjME56Z3ZOall5TWpNek1pODBOVFl5TXpBMkx6UXZWazVIVUMxdE5rUm5VVU5MVlZBeWNpMXphakl0WVhWS2MycGhRWFZDYmtjNVREUm1NekZpZDNJMlNTOHhMelF2TUM4d0x6azFOamd3TXk4ek1qVTNNVFkyT0RRNEx6SXhOalV6Tmk4Mk5URTROekV2TVM4d0x6QXZUVVJCZDAxRVFYZE5SRUYwVFVSQmQwMURNSGROUkVGM1RGUkJkMDFFUVhSTlJFRjNUVVJCZDAxRVFYZE5SRUYzTHpBdk1DOHdMekF2TUM4eU56WXlPRFF3T0RFNE5qazFNelUzTkRjNEwzcHlhQzh3THpNNU5DODBOUzg1T1Rrdk16SXlMekU1TkM0ek5pNHhNRGd1TUM4d0xqQXdNQzh4TmpNM01UUXlOVFV3THpFMk16Y3hOVFV4TlRBdk5DOXdkV0l0TkRFeE16WTRNVGc0TWpNeE1UUTFOUzgvN2RKVzdmWmFxRVVZcE9ISHN3dDcxVEhGZkFrJmFtcDtub2RlaWQ9MjYzNCZhbXA7Z3JvdXA9enJoJmFtcDthdWN0aW9uaWQ9Mjc2Mjg0MDgxODY5NTM1NzQ3OCZhbXA7c2hhcmRrZXk9Mjc2Mjg0MDgxODY5NTM1NzQ3OCZhbXA7c2lkPTQ1NjIzMDYmYW1wO2NpZD02NjIyMzMyJmFtcDticD1hX2JnaWNjZyZhbXA7bmZ5X2FjdD1MRDV3ZWcmYW1wO3R5cGU9YWRtJmFtcDtjbGllbnQ9YzJzJmFtcDtiZmlwPTE4NS4yOS4xMzUuMTczJmFtcDszcGNrPWh0dHBzOi8vYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrJTNGc2ElM0RMJTI2YWklM0RDeFE4dkZkQ1VZZjMxTnUtd3hfQVB6LW16a0E3UGg0NmJYTUNHMllMR0FzQ050d0VRQVNBQVlKWDY4SUdNQjRJQkYyTmhMWEIxWWkwME1URXpOamd4T0RneU16RXhORFUxeUFFSjRBSUFxQU1CcWdTUEFrX1FZbXY5Rm1RQXV4dGtJRWZSQktGN1NyV3VHaDRlNlB5YXgyM3FScGJyYXpRNDA4Vy1jdlI0RkdzTEoyNHNkVm1ZeXhLTEFIOWFWcXo0bWF3aVBQNU5QUjVXQlJHNzJfdFV4WldPQ3RxdVVvSVdkZTA5dkdwODlUM0NmeFhWZnZzNEx2aTRBTDlSaTVJNnREd2JJbUFJRnlrem9oUF8zX2FCcm5EYzRoNTBsUnZxQ2R3WWhZTzdKa3JERGtZclBxZ2V5S29RZmtQa1hCYW41b0MxT2dHUy1LazRWYlhFc0RIcHhPdXVWazdoQ2Y0YnZMQ01wQ1hTLWVmYXhnUHhBREdGWnRpQXVpRHlIbHM0d3E0aVhNd3hmSHR0c2M3dkdPRk1UbEFkSmlzZUdsdUtfSHN1cTRFXzAwanE3bFBkQmtUTzNxM2cyd29selEwMHNtQ0ZDamZseHpNdjRYZWxOMmhuMDFUSXp6emdCQUdBQnNycjZkRHVzSU9xaVFHZ0JpR29CNmEtRzZnSGx0Z2JxQWVxbTdFQ3FBZmZuN0VDMkFjQTBnZ0ZDSUJoRUFINkN3SUlBWUFNQWRBVkFZQVhBUSUyNm51bSUzRDElMjZzaWclM0RBT0Q2NF8xek1fVVkxb095cC1ObUc3Z0JDekN3LUFnX2t3JTI2Y2xpZW50JTNEY2EtcHViLTQxMTM2ODE4ODIzMTE0NTUlMjZhZHVybCUzRFwiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPlxuICAgc2JfZ2RwciA9IFwiMFwiOyAvKiAwIGlmIEdEUFIgZG9lcyBub3QgYXBwbHksIDEgaWYgR0RQUiBhcHBsaWVzICovXG4gICBzYl9nZHByX2NvbnNlbnQgPSBcIlwiOyAvKiBJQUIgVENGIDIuMCBjb25zZW50IHN0cmluZyAqL1xuICAgc2JfcmVkaXJlY3RfY2xpY2sgPSBcImh0dHBzOi8vcGl4ZWwubWF0aHRhZy5jb20vY2xpY2svaW1nP210X2FpZD0yNzYyODQwODE4Njk1MzU3NDc4Jm10X2lkPTY2MjIzMzImbXRfYWRpZD0yMTY1MzYmbXRfc2lkPTQ1NjIzMDYmbXRfZXhpZD00Jm10X2luYXBwPTAmbXRfb3M9V2luZG93cyZtdF91dWlkPWE2ZWM2MTk0LWQwMTctNGQwMS1hYjFiLWU5ODNlODQ0Mzg0OCZtdF9jaWQ9YTZlYzYxOTQtZDAxNy00ZDAxLWFiMWItZTk4M2U4NDQzODQ4Jm10XzNwY2s9aHR0cHMlM0EvL2FkY2xpY2suZy5kb3VibGVjbGljay5uZXQvYWNsayUzRnNhJTNETCUyNmFpJTNEQ3hROHZGZENVWWYzMU51LXd4X0FQei1temtBN1BoNDZiWE1DRzJZTEdBc0NOdHdFUUFTQUFZSlg2OElHTUI0SUJGMk5oTFhCMVlpMDBNVEV6TmpneE9EZ3lNekV4TkRVMXlBRUo0QUlBcUFNQnFnU1BBa19RWW12OUZtUUF1eHRrSUVmUkJLRjdTcld1R2g0ZTZQeWF4MjNxUnBicmF6UTQwOFctY3ZSNEZHc0xKMjRzZFZtWXl4S0xBSDlhVnF6NG1hd2lQUDVOUFI1V0JSRzcyX3RVeFpXT0N0cXVVb0lXZGUwOXZHcDg5VDNDZnhYVmZ2czRMdmk0QUw5Umk1STZ0RHdiSW1BSUZ5a3pvaFBfM19hQnJuRGM0aDUwbFJ2cUNkd1loWU83SmtyRERrWXJQcWdleUtvUWZrUGtYQmFuNW9DMU9nR1MtS2s0VmJYRXNESHB4T3V1Vms3aENmNGJ2TENNcENYUy1lZmF4Z1B4QURHRlp0aUF1aUR5SGxzNHdxNGlYTXd4Zkh0dHNjN3ZHT0ZNVGxBZEppc2VHbHVLX0hzdXE0RV8wMGpxN2xQZEJrVE8zcTNnMndvbHpRMDBzbUNGQ2pmbHh6TXY0WGVsTjJobjAxVEl6enpnQkFHQUJzcnI2ZER1c0lPcWlRR2dCaUdvQjZhLUc2Z0hsdGdicUFlcW03RUNxQWZmbjdFQzJBY0EwZ2dGQ0lCaEVBSDZDd0lJQVlBTUFkQVZBWUFYQVElMjZudW0lM0QxJTI2c2lnJTNEQU9ENjRfMXpNX1VZMW9PeXAtTm1HN2dCQ3pDdy1BZ19rdyUyNmNsaWVudCUzRGNhLXB1Yi00MTEzNjgxODgyMzExNDU1JTI2YWR1cmwlM0QmcmVkaXJlY3Q9XCI7IC8qIDNyZC1wYXJ0eSBjbGlja3RyYWNraW5nICovXG4gICBzYl9zdWJpZCA9IFwiXCI7IC8qIHlvdXIgb3duIHRyYWNraW5nLXN1Yi1pZCwgbWF4LiAxMjggY2hhcnM6IGEteiwgQS1aLCAwLTkgYW5kOiAtXy4sOjsvfCAqL1xuXG4gICBzYl91cmxfYmFzZSA9IFwiLy9oYWw5MDAwLnJlZGludGVsbGlnZW5jZS5uZXQvem9uZS9hams0eGxlYm40bXdcIjtcbiAgIHNiX3VybCA9IHNiX3VybF9iYXNlO1xuICAgc2JfdXJsID0gc2JfdXJsICsgXCI%2Fc3ViaWQ9XCIgKyBlbmNvZGVVUklDb21wb25lbnQoc2Jfc3ViaWQpO1xuICAgc2JfdXJsID0gc2JfdXJsICsgXCImZ2Rwcj1cIitlbmNvZGVVUklDb21wb25lbnQoc2JfZ2Rwcik7XG4gICBzYl91cmwgPSBzYl91cmwgKyBcIiZnZHByX2NvbnNlbnQ9XCIrZW5jb2RlVVJJQ29tcG9uZW50KHNiX2dkcHJfY29uc2VudCk7XG4gICBzYl91cmwgPSBzYl91cmwgKyBcIiZybmQ9Mjc2Mjg0MDgxODY5NTM1NzQ3OFwiO1xuICAgc2JfdXJsID0gc2JfdXJsICsgXCImZXh0VmFyW109RE9VQkxFQk9SREVSOjEmZXh0VmFyW109TU1BX1NTUDphZHhcIjtcbiAgIHNiX3VybCA9IHNiX3VybCArIFwiJnJlZGlyZWN0Q2xpY2s9XCIgKyBlbmNvZGVVUklDb21wb25lbnQoc2JfcmVkaXJlY3RfY2xpY2spO1xuICAgZG9jdW1lbnQud3JpdGUoJzxzY3InKydpcHQgc3JjPVwiJytzYl91cmwrJ1wiPjwvc2NyJysnaXB0PicpO1xuPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCIvL2hhbDkwMDAucmVkaW50ZWxsaWdlbmNlLm5ldC96b25lL2FqazR4bGVibjRtdz9zdWJpZD0mYW1wO2dkcHI9MCZhbXA7Z2Rwcl9jb25zZW50PSZhbXA7cm5kPTI3NjI4NDA4MTg2OTUzNTc0NzgmYW1wO2V4dFZhcltdPURPVUJMRUJPUkRFUjoxJmFtcDtleHRWYXJbXT1NTUFfU1NQOmFkeCZhbXA7cmVkaXJlY3RDbGljaz1odHRwcyUzQSUyRiUyRnBpeGVsLm1hdGh0YWcuY29tJTJGY2xpY2slMkZpbWclM0ZtdF9haWQlM0QyNzYyODQwODE4Njk1MzU3NDc4JTI2bXRfaWQlM0Q2NjIyMzMyJTI2bXRfYWRpZCUzRDIxNjUzNiUyNm10X3NpZCUzRDQ1NjIzMDYlMjZtdF9leGlkJTNENCUyNm10X2luYXBwJTNEMCUyNm10X29zJTNEV2luZG93cyUyNm10X3V1aWQlM0RhNmVjNjE5NC1kMDE3LTRkMDEtYWIxYi1lOTgzZTg0NDM4NDglMjZtdF9jaWQlM0RhNmVjNjE5NC1kMDE3LTRkMDEtYWIxYi1lOTgzZTg0NDM4NDglMjZtdF8zcGNrJTNEaHR0cHMlMjUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGVjbGljay5uZXQlMkZhY2xrJTI1M0ZzYSUyNTNETCUyNTI2YWklMjUzREN4UTh2RmRDVVlmMzFOdS13eF9BUHotbXprQTdQaDQ2YlhNQ0cyWUxHQXNDTnR3RVFBU0FBWUpYNjhJR01CNElCRjJOaExYQjFZaTAwTVRFek5qZ3hPRGd5TXpFeE5EVTF5QUVKNEFJQXFBTUJxZ1NQQWtfUVltdjlGbVFBdXh0a0lFZlJCS0Y3U3JXdUdoNGU2UHlheDIzcVJwYnJhelE0MDhXLWN2UjRGR3NMSjI0c2RWbVl5eEtMQUg5YVZxejRtYXdpUFA1TlBSNVdCUkc3Ml90VXhaV09DdHF1VW9JV2RlMDl2R3A4OVQzQ2Z4WFZmdnM0THZpNEFM&i=5-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
vXno1aGfSKpUsN9Urll2zPZf028JwGlSbDdQRLvyRWtcYdABkaLVEw==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
428 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=OVJpNUk2dER3YkltQUlGeWt6b2hQXzNfYUJybkRjNGg1MGxSdnFDZHdZaFlPN0prckREa1lyUHFnZXlLb1Fma1BrWEJhbjVvQzFPZ0dTLUtrNFZiWEVzREhweE91dVZrN2hDZjRidkxDTXBDWFMtZWZheGdQeEFER0ZadGlBdWlEeUhsczR3cTRpWE13eGZIdHRzYzd2R09GTVRsQWRKaXNlR2x1S19Ic3VxNEVfMDBqcTdsUGRCa1RPM3EzZzJ3b2x6UTAwc21DRkNqZmx4ek12NFhlbE4yaG4wMVRJenp6Z0JBR0FCc3JyNmREdXNJT3FpUUdnQmlHb0I2YS1HNmdIbHRnYnFBZXFtN0VDcUFmZm43RUMyQWNBMGdnRkNJQmhFQUg2Q3dJSUFZQU1BZEFWQVlBWEFRJTI1MjZudW0lMjUzRDElMjUyNnNpZyUyNTNEQU9ENjRfMXpNX1VZMW9PeXAtTm1HN2dCQ3pDdy1BZ19rdyUyNTI2Y2xpZW50JTI1M0RjYS1wdWItNDExMzY4MTg4MjMxMTQ1NSUyNTI2YWR1cmwlMjUzRCUyNnJlZGlyZWN0JTNEXCI%2BPC9zY3JpcHQ%2BPGRpdiBzdHlsZT1cIndpZHRoOjJweDtoZWlnaHQ6MnB4O2JvcmRlcjowcHg7bWFyZ2luOjBweDtwYWRkaW5nOjBweDt0ZXh0LWFsaWduOmxlZnQ7dmVydGljYWwtYWxpZ246dG9wO3Bvc2l0aW9uOmFic29sdXRlO3Zpc2liaWxpdHk6aGlkZGVuO1wiPjxkaXYgaWQ9XCJlNjE3NzAzMDA2NzA0MVwiIHN0eWxlPVwid2lkdGg6MXB4O2hlaWdodDoxcHg7Ym9yZGVyOjBweDttYXJnaW46MHB4O21hcmdpbi1sZWZ0OjFweDttYXJnaW4tdG9wOjFweDtwYWRkaW5nOjBweDtwb3NpdGlvbjphYnNvbHV0ZTt2aXNpYmlsaXR5OmhpZGRlbjtcIj48L2Rpdj48ZGl2IGlkPVwiZTM2MTY1OTg2ODI0NDVcIiBzdHlsZT1cIndpZHRoOjFweDtoZWlnaHQ6MXB4O2JvcmRlcjowcHg7bWFyZ2luOjBweDtwYWRkaW5nOjBweDtwb3NpdGlvbjphYnNvbHV0ZTt2aXNpYmlsaXR5OmhpZGRlbjtcIj48L2Rpdj48L2Rpdj48c2NyaXB0IGxhbmd1YWdlPVwiSmF2YVNjcmlwdFwiIGlkPVwidHBBZHRhZ0lubmVyU2NyaXB0SWQwMzU0NjFjNDg3XCIgc3JjPVwiaHR0cHM6Ly9oYWw5MDAwMjQucmVkaW50ZWxsaWdlbmNlLm5ldC9yZXF1ZXN0LnBocD96b25lPWFqazR4bGVibjRtdyZhbXA7bnc9MjAmYW1wO3JlbmRlcmluZ1R5cGU9amF2YXNjcmlwdCZhbXA7bmFtZXNwYWNlPTAzNTQ2MWM0ODcmYW1wO3N1YmlkPSZhbXA7dWlkPTgwZDBkZTY5OGY2MTkzMzImYW1wO3NjcmVlblNpemU9MTYwMHgxMjAwJmFtcDtzY3JlZW5TaXplQXZhaWw9MTYwMHgxMjAwJmFtcDtjbGllbnRTaXplPTcyOHg5MCZhbXA7c2Nyb2xsUG9zPTB4MCZhbXA7ZXh0RGF0YVtdPSZhbXA7ZXh0VmFyW109RE9VQkxFQk9SREVSJTNBMSZhbXA7ZXh0VmFyW109TU1BX1NTUCUzQWFkeCZhbXA7ZW52RGF0YT0mYW1wO2dkcHI9MCZhbXA7Z2Rwcl9jb25zZW50PSZhbXA7dWQ9JmFtcDtyZWRpcmVjdENsaWNrPWh0dHBzJTNBJTJGJTJGcGl4ZWwubWF0aHRhZy5jb20lMkZjbGljayUyRmltZyUzRm10X2FpZCUzRDI3NjI4NDA4MTg2OTUzNTc0NzglMjZtdF9pZCUzRDY2MjIzMzIlMjZtdF9hZGlkJTNEMjE2NTM2JTI2bXRfc2lkJTNENDU2MjMwNiUyNm10X2V4aWQlM0Q0JTI2bXRfaW5hcHAlM0QwJTI2bXRfb3MlM0RXaW5kb3dzJTI2bXRfdXVpZCUzRGE2ZWM2MTk0LWQwMTctNGQwMS1hYjFiLWU5ODNlODQ0Mzg0OCUyNm10X2NpZCUzRGE2ZWM2MTk0LWQwMTctNGQwMS1hYjFiLWU5ODNlODQ0Mzg0OCUyNm10XzNwY2slM0RodHRwcyUyNTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRmFjbGslMjUzRnNhJTI1M0RMJTI1MjZhaSUyNTNEQ3hROHZGZENVWWYzMU51LXd4X0FQei1temtBN1BoNDZiWE1DRzJZTEdBc0NOdHdFUUFTQUFZSlg2OElHTUI0SUJGMk5oTFhCMVlpMDBNVEV6TmpneE9EZ3lNekV4TkRVMXlBRUo0QUlBcUFNQnFnU1BBa19RWW12OUZtUUF1eHRrSUVmUkJLRjdTcld1R2g0ZTZQeWF4MjNxUnBicmF6UTQwOFctY3ZSNEZHc0xKMjRzZFZtWXl4S0xBSDlhVnF6NG1hd2lQUDVOUFI1V0JSRzcyX3RVeFpXT0N0cXVVb0lXZGUwOXZHcDg5VDNDZnhYVmZ2czRMdmk0QUw5Umk1STZ0RHdiSW1BSUZ5a3pvaFBfM19hQnJuRGM0aDUwbFJ2cUNkd1loWU83SmtyRERrWXJQcWdleUtvUWZrUGtYQmFuNW9DMU9nR1MtS2s0VmJYRXNESHB4T3V1Vms3aENmNGJ2TENNcENYUy1lZmF4Z1B4QURHRlp0aUF1aUR5SGxzNHdxNGlYTXd4Zkh0dHNjN3ZHT0ZNVGxBZEppc2VHbHVLX0hzdXE0RV8wMGpxN2xQZEJrVE8zcTNnMndvbHpRMDBzbUNGQ2pmbHh6TXY0WGVsTjJobjAxVEl6enpnQkFHQUJzcnI2ZER1c0lPcWlRR2dCaUdvQjZhLUc2Z0hsdGdicUFlcW03RUNxQWZmbjdFQzJBY0EwZ2dGQ0lCaEVBSDZDd0lJQVlBTUFkQVZBWUFYQVElMjUyNm51bSUyNTNEMSUyNTI2c2lnJTI1M0RBT0Q2NF8xek1fVVkxb095cC1ObUc3Z0JDekN3LUFnX2t3JTI1MjZjbGllbnQlMjUzRGNhLXB1Yi00MTEzNjgxODgyMzExNDU1JTI1MjZhZHVybCUyNTNEJTI2cmVkaXJlY3QlM0QmYW1wO2RvY3VtZW50UmVmZXJlcj1odHRwcyUzQSUyRiUyRnNhZmVoYXZlbi5jb20lMkYmYW1wO2FuY2VzdG9yT3JpZ2lucz1odHRwcyUzQSUyRiUyRnNhZmVoYXZlbi5jb20mYW1wO3JhbmRvbT02MjcwMDk0NzQ1NDUyJmFtcDtpc0lmcmFtZT0xJmFtcDtjb250YWluZXI9JmFtcDthZFBvcz0weDAmYW1wO2FkUG9zQ2hlY2s9MXgxJmFtcDthZHRhZ0lkPTBcIj48L3NjcmlwdD48ZGl2IHN0eWxlPVwicG9zaXRpb246YWJzb2x1dGU7dmlzaWJpbGl0eTpoaWRkZW47ZGlzcGxheTpub25lXCI%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BXG52YXIgYXhlbCA9IE1hdGgucmFuZG9tKCkgKyBcIlwiO1xudmFyIGEgPSBheGVsICogMTAwMDAwMDAwMDAwMDA7XG5kb2N1bWVudC53cml0ZSgnPGlmcmFtZSBzcmM9XCJodHRwczovLzgwMTkxOTEuZmxzLmRvdWJsZWNsaWNrLm5ldC9hY3Rpdml0eWk7c3JjPTgwMTkxOTE7dHlwZT1pbnZtZWRpYTtjYXQ9MXVwNGgwNGk7ZGNfbGF0PTtkY19yZGlkPTt0YWdfZm9yX2NoaWxkX2RpcmVjdGVkX3RyZWF0bWVudD07b3JkPScgKyBhICsgJz9cIiB3aWR0aD1cIjFcIiBoZWlnaHQ9XCIxXCIgZnJhbWVib3JkZXI9XCIwXCIgc3R5bGU9XCJkaXNwbGF5Om5vbmVcIj48L2lmcmFtZT4nKTtcbjwvc2NyaXB0PjxpZnJhbWUgc3JjPVwiaHR0cHM6Ly84MDE5MTkxLmZscy5kb3VibGVjbGljay5uZXQvYWN0aXZpdHlpO3NyYz04MDE5MTkxO3R5cGU9aW52bWVkaWE7Y2F0PTF1cDRoMDRpO2RjX2xhdD07ZGNfcmRpZD07dGFnX2Zvcl9jaGlsZF9kaXJlY3RlZF90cmVhdG1lbnQ9O29yZD01NTYyOTExMDIxNDEuMjQ0Mz9cIiB3aWR0aD1cIjFcIiBoZWlnaHQ9XCIxXCIgZnJhbWVib3JkZXI9XCIwXCIgc3R5bGU9XCJkaXNwbGF5Om5vbmVcIj48L2lmcmFtZT5cbjxub3NjcmlwdD5cbjxpZnJhbWUgc3JjPVwiaHR0cHM6Ly84MDE5MTkxLmZscy5kb3VibGVjbGljay5uZXQvYWN0aXZpdHlpO3NyYz04MDE5MTkxO3R5cGU9aW52bWVkaWE7Y2F0PTF1cDRoMDRpO2RjX2xhdD07ZGNfcmRpZD07dGFnX2Zvcl9jaGlsZF9kaXJlY3RlZF90cmVhdG1lbnQ9O29yZD0xP1wiIHdpZHRoPVwiMVwiIGhlaWdodD1cIjFcIiBmcmFtZWJvcmRlcj1cIjBcIiBzdHlsZT1cImRpc3BsYXk6bm9uZVwiPjwvaWZyYW1lPlxuPC9ub3NjcmlwdD48L2Rpdj48ZGl2IHN0eWxlPVwid2lkdGg6NzI4cHg7IGhlaWdodDo5MHB4OyBib3JkZXI6MHB4OyBtYXJnaW46MHB4OyBwYWRkaW5nOjBweDsgdGV4dC1hbGlnbjpsZWZ0OyB2ZXJ0aWNhbC1hbGlnbjp0b3A7IHBvc2l0aW9uOnN0YXRpYzsgZGlzcGxheTpibG9jazsgdmlzaWJpbGl0eTp2aXNpYmxlOyBvdmVyZmxvdzpoaWRkZW47XCI%2BPGlmcmFtZSBpZD1cImU5MTEwNDdcIiBuYW1lPVwiZTkxMTA0N1wiIHNyYz1cImh0dHBzOi8vaGFsOTAwMDI0LnJlZGludGVsbGlnZW5jZS5uZXQvcmVxdWVzdF9jb250ZW50LnBocD9zPTExMDIxNjAwMDQ5MDUxODAwOTUxMzg5MDExNzgxMDI0JmFtcDthPTgwZTY5NTRkXCIgc3R5bGU9XCJ3aWR0aDo3MjhweDsgaGVpZ2h0OjkwcHg7IGJvcmRlcjowcHg7IG1hcmdpbjowcHg7IHBhZGRpbmc6MHB4OyBwb3NpdGlvbjpzdGF0aWM7IGRpc3BsYXk6YmxvY2s7IHZpc2liaWxpdHk6dmlzaWJsZTtcIiBmcmFtZWJvcmRlcj1cIjBcIiBtYXJnaW53aWR0aD1cIjBcIiBtYXJnaW5oZWlnaHQ9XCIwXCIgc2Nyb2xsaW5nPVwibm9cIj48L2lmcmFtZT48L2Rpdj48ZGl2IHdpZHRoPVwiMVwiIGhlaWdodD1cIjFcIiBzdHlsZT1cImRpc3BsYXk6bm9uZTsgb3ZlcmZsb3c6aGlkZGVuXCI%2BPGltZyBzdHlsZT1cImxlZnQ6LTEwcHg7dG9wOi0xMHB4OyBwb3NpdGlvbjphYnNvbHV0ZVwiIHNyYz1cImh0dHBzOi8vdGFncy5tYXRodGFnLmNvbS9jay1jb25maXJtP2JpZF9pZD0yNzYyODQwODE4Njk1MzU3NDc4JmFtcDtub2RlX2lkPTI2MzQmYW1wO2V4Y2hfaWQ9NFwiIGhlaWdodD1cIjFcIiB3aWR0aD1cIjFcIj48L2Rpdj48ZGl2IHdpZHRoPVwiMVwiIGhlaWdodD1cIjFcIiBzdHlsZT1cImRpc3BsYXk6bm9uZTsgb3ZlcmZsb3c6aGlkZGVuXCI%2BPGltZyBzdHlsZT1cImxlZnQ6LTEwcHg7dG9wOi0xMHB4OyBwb3NpdGlvbjphYnNvbHV0ZVwiIHNyYz1cImh0dHBzOi8vcGl4ZWwubWF0aHRhZy5jb20vZXZlbnQvaW1nP210X2lkPTEzNjg4NzUmYW1wO210X2FkaWQ9MjE2NzY0JmFtcDt2MT00JmFtcDt2Mj0yNzYyODQwODE4Njk1MzU3NDc4JmFtcDt2Mz02NTE4NzEmYW1wO3Y0PTQ1NjIzMDYmYW1wO3Y1PTY2MjIzMzImYW1wO210X25zeW5jPTEmYW1wO25vX2F0dHI9MVwiIHdpZHRoPVwiMVwiIGhlaWdodD1cIjFcIj48aW1nIHN0eWxlPVwibGVmdDotOXB4O3RvcDotOXB4OyBwb3NpdGlvbjphYnNvbHV0ZVwiIHNyYz1cImh0dHBzOi8vdGFncy5tYXRodGFnLmNvbS9ldmVudC9pbWc%2FdHlwZT1tbUltcFRyYWNrJmFtcDtleGNoPWFkeCZhbXA7YmlkPTI3NjI4NDA4MTg2OTUzNTc0NzgmYW1wO3N0PTQ1NjIzMDYmYW1wO3RpbWU9MTYzNzE0MjU1MSZhbXA7bm9kZWlkPTI2MzRcIiB3aWR0aD1cIjFcIiBoZWlnaHQ9XCIxXCI%2BPC9kaXY%2BPC9kaXY%2BPHNjcmlwdCBkYXRhLWpjPVwiMjJcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL3IyMDIxMTExMS9yMjAxMTA5MTQvY2xpZW50L3dpbmRvd19mb2N1c19meTIwMTkuanNcIiBhc3luYz1cIlwiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIxMTExMVwiIGRhdGEtamNwLXVybD1cImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9pbnRlcmFjdGlvbi8%2FYWk9Q3hROHZGZENVWWYzMU51LXd4X0FQei1temtBN1BoNDZiWE1DRzJZTEdBc0NOdHdFUUFTQUFZSlg2OElHTUI0SUJGMk5oTFhCMVlpMDBNVEV6TmpneE9EZ3lNekV4TkRVMXlBRUo0QUlBcUFNQnFnU1BBa19RWW12OUZtUUF1eHRrSUVmUkJLRjdTcld1R2g0ZTZQeWF4MjNxUnBicmF6UTQwOFctY3ZSNEZHc0xKMjRzZFZtWXl4S0xBSDlhVnF6NG1hd2lQUDVOUFI1V0JSRzcyX3RVeFpXT0N0cXVVb0lXZGUwOXZHcDg5VDNDZnhYVmZ2czRMdmk0QUw5Umk1STZ0RHdiSW1BSUZ5a3pvaFBfM19hQnJuRGM0aDUwbFJ2cUNkd1loWU83SmtyRERrWXJQcWdleUtvUWZrUGtYQmFuNW9DMU9nR1MtS2s0VmJYRXNESHB4T3V1Vms3aENmNGJ2TENNcENYUy1lZmF4Z1B4QURHRlp0aUF1aUR5SGxzNHdxNGlYTXd4Zkh0dHNjN3ZHT0ZNVGxBZEppc2VHbHVLX0hzdXE0RV8wMGpxN2xQZEJrVE8zcTNnMndvbHpRMDBzbUNGQ2pmbHh6TXY0WGVsTjJobjAxVEl6enpnQkFHQUJzcnI2ZER1c0lPcWlRR2dCaUdvQjZhLUc2Z0hsdGdicUFlcW03RUNxQWZmbjdFQzJBY0EwZ2dGQ0lCaEVBSDZDd0lJQVlBTUFkQVZBWUFYQVEmYW1wO3NpZ2g9dnl3RWZLWERzOGMmYW1wO2NpZD1DQVFTUEFDTklyTE1kN1Q2NWpHdGNUYkdUSHFxT1RqdVJFbDZ4ckhNZnRWaDkzOHlhLVE5QWZjSzNNOTBtVU1zNDhlTDU5ajdCa2pITWdIZHBZeGZGZ1wiIGRhdGEtamNwLWd3cy1pZD1cIlwiIGRhdGEtamNwLXFlbS1pZD1cIkNMM1VpS0dQbl9RQ0ZXX1lFUWdkel9RTTRnXCI%2BPC&i=6-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
GmPD3tTJ3u7___EtmrgicGaZd4CuzR4N8FGUkSjCYIEnyynK3BUCUA==
place
math-aids-tagan.adlightning.com/ Frame 77F4 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://math-aids-tagan.adlightning.com/place?p=1&d=9zY3JpcHQ%2BPGlmcmFtZSB0aXRsZT1cIkJsYW5rXCIgc2Nyb2xsaW5nPVwibm9cIiBmcmFtZWJvcmRlcj1cIjBcIiBoZWlnaHQ9XCIwXCIgd2lkdGg9XCIwXCIgc3JjPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvcy9jb29raWVfcHVzaF9vbmxvYWQuaHRtbCNhSFIwY0hNNkx5OXplVzVqTG0xaGRHaDBZV2N1WTI5dEwzTjVibU12YVcxblAyMTBYMlY0YVdROU5DWm5iMjluYkdWZloybGtQVU5CUlZORlRIWkRVbHB6WVc5VWJsZGlVV2cwVUV0dlJsQkJVU1puYjI5bmJHVmZZM1psY2oweEptZHZiMmRzWlY5d2RYTm9QVUZaWnpWeFVFbHJWWFJ4ZVdwV1QxSmFTbU4yZHpOcVNWZFFOblpUTjFKbFRFbENVQzFxVmtWSVprZHJUMjk2VUVOcmJFWkZhVk42YkZSbWNXaGhkWFJRYmpCMFltTndhR0Z6WjBWWGMxTmhjMVYwWm5wTllYWmlha2hNYkRJd1UyVllWUT09LGFIUjBjSE02THk5aExuUnlhV0poYkdaMWMybHZiaTVqYjIwdmFTNXRZWFJqYUQ5d1BXSTJKblU5UTBGRlUwVkZYM2RNY0RWRlpGbHdjMko2YWxZelV6aFlRMkZCSm1kdmIyZHNaVjlqZG1WeVBURW1aMjl2WjJ4bFgzQjFjMmc5UVZsbk5YRlFTM2hQV2tkM1JGZ3djREJ6Y0RKclNUSlJUVGxTVVMxd1pFaFdYMHBmY3pSc1JVNUZjaTFrVjFNd1VtZzVNbEpNVkRaWmIwOW1iblF0UkhKRFZXUlpUa1JvVEhwNE1XMVpWWFZ3VVdGTWFteFRMWGRIU1hod1YwbE1USFZySm5KbFpHbHlaV04wUFdoMGRIQnpKVE5CTHk5amJTNW5MbVJ2ZFdKc1pXTnNhV05yTG01bGRDOXdhWGhsYkNVelJtZHZiMmRzWlY5dWFXUWxNMFJsZUhBbE1qWm5iMjluYkdWZmNIVnphQ1V6UkVGWlp6VnhVRXQ0VDFwSGQwUllNSEF3YzNBeWEwa3lVVTA1VWxFdGNHUklWbDlLWDNNMGJFVk9SWEl0WkZkVE1GSm9PVEpTVEZRMldXOVBabTUwTFVSeVExVmtXVTVFYUV4NmVERnRXVlYxY0ZGaFRHcHNVeTEzUjBsNGNGZEpURXgxYXlVeU5tZHZiMmRzWlY5MWJHRWxNMFF5TnpnMk9UVTBKVEkyWjI5dloyeGxYMmh0SlRORUpUSTBWRVpmVlZORlVsOUpSRjlGVGtNbE1qUT0sYUhSMGNITTZMeTl0WVhSamFDNWhaSE55ZG5JdWIzSm5MM1J5WVdOckwyTnRaaTluYjI5bmJHVV9aMjl2WjJ4bFgyZHBaRDFEUVVWVFJVSnpOak5OVGtORGJVZ3ljMmhNTm0xWWJHTmlZMmNtWjI5dloyeGxYMk4yWlhJOU1TWm5iMjluYkdWZmNIVnphRDFCV1djMWNWQkxhbmx1TTFweE5tVjNUbkpuU21SYVptTXpjMVpaYlVVM1lVRm1jbHAwWVVOUFdGOTRTRUoyUkdOdlpsZFhhMVZMVVdKWVUweEJVV0pQVTNsTFNVeGtNbEZMVjJzMGJHdFVUblZDYjFKc1lXOVZWWGhNY1U5ZmFubFliVms9LGFIUjBjSE02THk5d2NpMWlhQzU1WW5BdWVXRm9iMjh1WTI5dEwzTjVibU12WVdSNFAyZHZiMmRzWlY5bmFXUTlRMEZGVTBWSU5DMWlaMkptVUc1NlMySTVNR3QwZGtGMVdqQnJKbWR2YjJkc1pWOWpkbVZ5UFRFbVoyOXZaMnhsWDNCMWMyZzlRVmxuTlhGUVMydGtNM1ZZT0RaMmFUSkpUVWxZU1dsbGQzRnFaV1k0YjFoVlRteFdkRVUwVG5GVGVuWmZPRVJzZVd0RVpYZG9WbVp2ZEdWTFFqUjZRWEEzVVVodU5XZFNiMEV5WnpKS1gzQjVSMTl3YmtVMlFUa3RkRE52Y3pGbmIyYz0sYUhSMGNITTZMeTl6YzNBdVlXUnlhWFpsY2k1eWRTOWpaMmt0WW1sdUwzTjVibU11WTJkcFAzTnpjRjlwWkQweE1DWmxlSFJsY201aGJGOXBaRDBtWjI5dloyeGxYMmRwWkQxRFFVVlRSVWhEYzBSYWVEWndjVjlKZVdWdlJXUTRVRnBXYVZVbVoyOXZaMnhsWDJOMlpYSTlNU1puYjI5bmJHVmZjSFZ6YUQxQldXYzFjVkJKVFU1T1RteFNkRmQ1WWtGWE9ISTRjVzVxZFVoVU9WaDFkbkl4TTNaTkxYVkNWWFJoWTA5U2RsVldaazg1TVZsalZWY3lRVUkzZVZGWU4weGhTM0Y0V2tsTVUwNU5helIyVWw5b1ZWOXlYMDh5VWtvNU5VVmlMVFJuWTNjPSxhSFIwY0hNNkx5OWhaSE11ZVdsbGJHUnRieTVqYjIwdlpYaHdkSE41Ym1NX1oyOXZaMnhsWDJkcFpEMURRVVZUUlVaa2MzVlBiMkp3UzNFeVgweEhRM2RVZVRobmNFRW1aMjl2WjJ4bFgyTjJaWEk5TVNabmIyOW5iR1ZmY0hWemFEMUJXV2MxY1ZCTFdqVm9ibWxXVjNvMlFWUnRkV3BaVVhGZlJYUXlXamxzZEdZeWF6VjZZVFJMWTNaSWFUTTFWV1I0U2w5RFkwdDZXWGRMYm1oUE4zTllNSFJCVm1GS05qVXlhMmt4ZDJWNFJrZHJRVm8zU2paWWMzTmtSRlkzYWtOblpFMD0sYUhSMGNITTZMeTloTG5KbWFXaDFZaTVqYjIwdlkyMF9jSFZpUFRRME5TWnBiajB4Sm1kdmIyZHNaVjluYVdROVEwRkZVMFZMTjNReGIyNWtiM1JHYUUxUlNHTjVabDl2UVZsckptZHZiMmRzWlY5amRtVnlQVEVtWjI5dloyeGxYM0IxYzJnOVFWbG5OWEZRUzFJMFprNTFVMmgwVjNKclIxZzBYM1l5WVd0SWRraE9kRk0xUTJVeFkyaGxSUzFvU2pkU1NqZGlOalp4ZEhSck1GUktiVlJhWkU5M1MzSTViRU4zTnpsMFFWSTVjV3QwZDJSUVdFNXpYMDlHU210cFJXdFVZazFyU2xOUlpnPT0sYUhSMGNITTZMeTlqYlM1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d2FYaGxiQzloZEhSeVAyUTlRVWhPUmpFelRDMW9URzkzZFU0eVJWaG5ZemRVTTFKcmFHRnphRE5sY2sxdlRGVmZXRTV3Wkdsb1pXRnRkbEpsVldKc2RHaEthVFZxUlZOdlgySjRRamswUWkxTE5uSnhTblJ4YTFCQlwiIHN0eWxlPVwicG9zaXRpb246YWJzb2x1dGVcIiBhcmlhLWhpZGRlbj1cInRydWVcIj48L2lmcmFtZT48c2NyaXB0IHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZXRhZ3NlcnZpY2VzLmNvbS9hY3RpdmV2aWV3L2pzL2N1cnJlbnQvcnhfbGlkYXIuanM%2FY2FjaGU9cjIwMTEwOTE0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2Bb3NkbGZtKCk7PC9zY3JpcHQ%2BPHNjcmlwdCBkYXRhLWpjPVwiMjNcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL3IyMDIxMTExMS9yMjAxMTA5MTQvY2xpZW50L3FzX2NsaWNrX3Byb3RlY3Rpb25fZnkyMDE5LmpzXCIgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjExMTExXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD5nb29ncXNjcC5pbml0KFtbW1tudWxsLDUwMCw5OSwyLDksbnVsbCxudWxsLG51bGwsMV1dXV0pOzwvc2NyaXB0PjxkaXYgc3R5bGU9XCJkaXNwbGF5OiBub25lOyBwb3NpdGlvbjogYWJzb2x1dGU7IHotaW5kZXg6IDIxNDc0ODM2NDc7IHdpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IHRvcDogMHB4OyBsZWZ0OiAwcHg7XCI%2BPC9kaXY%2BPGltZyBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVFsdUVuYzFlSEd5dDExYU1LUzZGalVISUtGdVl4a2JnMVNJU0dWMUc5S291eUYzX0pwWTJjeFk1dTloMnZtcEt0dkZndjJLTFBGTzk5SXA1Sk85MmRvUHZrMnB3XCIgc3R5bGU9XCJkaXNwbGF5Om5vbmU7XCIgYWx0PVwiXCI%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2FmZWZyYW1lLzEtMC0zOC9qcy9leHQuanNcIj48L3NjcmlwdD48ZGl2IHN0eWxlPVwiYm90dG9tOjA7cmlnaHQ6MDt3aWR0aDo3MjhweDtoZWlnaHQ6OTBweDtiYWNrZ3JvdW5kOmluaXRpYWwgIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZSAhaW1wb3J0YW50O21heC13aWR0aDoxMDAlICFpbXBvcnRhbnQ7bWF4LWhlaWdodDoxMDAlICFpbXBvcnRhbnQ7cG9pbnRlci1ldmVudHM6bm9uZSAhaW1wb3J0YW50O2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQgIWltcG9ydGFudDt6LWluZGV4OjIxNDc0ODM2NDc7YmFja2dyb3VuZC1pbWFnZTp1cmwoJ2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCOFNVUkJWQmpUZFpFQkRzQWdDQVByRC9yLzEyNUFyYkE0VEVpWTlWWXJjSzlWQlMxTkFIUDM3U1RvS1JYU3dsUHNzSFNVUHJ2VnkzUU10dWhpL3poeEJYVDRocFU0N0JBbFZDN3lneFRaMGNBa2ZTRHA5WXUxYnhjZFh4OUtaZnRwVG9mdzNITDdacytzR1JrSnlvbll6czVSRHJZZmh5UEI4bzNTUHFHU0JlQ0JkRnM5QUFBQUFFbEZUa1N1UW1DQycpICFpbXBvcnRhbnQ7XCI%2BPC9kaXY%2BXG4gIFxuICBcbiAgXG5cbjwvYm9keT48L2h0bWw%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJtZXRhIjp7InBsUmF0aW8iOjAuMDF9fQ%3D%3D&i=7-7&t=adltag_kw3cekyn_p4zc090KSQB&r=3a046962cda6973b76c4cbd62bab5ef&c=math-aids&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-7b120a5-fe15cb4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-49.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-amz-version-id
jojxxrFPUieh9ZPhCvt1MB6RWikJaj0q
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
29663
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 18:35:14 GMT
server
AmazonS3
date
Wed, 17 Nov 2021 04:12:25 GMT
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
Onbw8DzPDNJy0X1ySf_EbNCjxJUPB1GWjs6lsP1IqKeKImietaUL4Q==
async_usersync
ib.adnxs.com/ Frame FC02 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
bb5cdd59-c04b-49d0-b8fe-0b3accbef053
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 5AC5 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
281cfa0c-8439-49a9-9518-291e877e2829
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
abt
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9F09 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=87041
expires
Thu, 18 Nov 2021 09:59:55 GMT
date
Wed, 17 Nov 2021 09:49:14 GMT
vary
Accept-Encoding
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 7890
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
Keep-Alive
Cache-Control
max-age=25303
Content-Length
4947
Content-Type
text/html
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges
bytes
etag
"1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id
tx0000000000000006585ef-006193e172-cbe9615-nyc3a
strict-transport-security
max-age=15552000; includeSubDomains; preload
age
0
x-rgw-object-type
Normal
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1637142555.dop031.lo4.t,1637142555.cds233.lo4.shn,1637142555.dop031.lo4.t,1637142555.cds210.lo4.c

Redirect headers

content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control
no-cache
usync.html
eus.rubiconproject.com/ Frame 3B31 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 17 Nov 2021 09:49:14 GMT
Connection
keep-alive
Vary
Accept-Encoding
sync.html
public.servenobid.com/ Frame BD0C 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
31d5648df5eebdf3d492b355285870ced53b93143889c04edf9deb94357dd6e6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Mon, 08 Nov 2021 19:40:02 GMT
accept-ranges
bytes
etag
"1484c6be7981ef2d93457ae1b8222f04"
server
AmazonS3
x-cache
TCP_HIT
x-amz-id-2
R9FvHpz8HgvHkUoswrDXdcKmFY0iNSoGOYj3wqiiptinrg/YQWG3enQV6KoLPNen6cKtWfIUtCE=
x-amz-request-id
QM5EA494MFZ7Z6BP
x-amz-meta-codebuild-content-sha256
62eaff6ee8ff549c0050f611ee47c040b5383016dfbf921a2d194f6354569f2b
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:d8405d4a-5b5c-467c-aa1e-ad154dcb077c
x-amz-meta-codebuild-content-md5
81217ffa8e68730be30130a20e0871d1
x-azure-ref-originshield
0xlqUYQAAAACK0w5aUxj8RbAUqhd2Q0GoQU1TMDRFREdFMTkyMQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref
0GtCUYQAAAABGcD+q6N82QpZgTZtEzi5MRlJBRURHRTEwMTYAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date
Wed, 17 Nov 2021 09:49:14 GMT
pd
eu-u.openx.net/w/1.0/ Frame 03C1 		542 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
ace317a10de8eeccc322d1c5b4b320d21665fefcb5f7b23e2558bf521fa1a2ef

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 17 Nov 2021 09:49:14 GMT
content-type
text/html
content-length
339
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame AFD8 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Wed, 17 Nov 2021 04:21:31 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Wed, 17 Nov 2021 09:49:14 GMT
Age
19663
X-Served-By
cache-lga21974-LGA, cache-cdg20762-CDG
X-Cache
HIT, HIT
X-Cache-Hits
1, 145110
X-Timer
S1637142555.837643,VS0,VE0
Vary
Accept-Encoding
beacon
ap.lijit.com/ Frame 8CC7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13394437
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://safehaven.com/

Response headers

Server
nginx
Date
Wed, 17 Nov 2021 09:49:14 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap2ams1
dds
rtb.openx.net/sync/ Frame 03C1
Redirect Chain
  • https://rtb.openx.net/sync/dds
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=gbB2WDm6z0cBOkbt-KcZ-g==&ox_sc=1&ox_init=1
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
nqu6jr68nhmkg93594f85lmckp5alk75

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
249
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ca219a20-0090-e420-d699-1cafd4e9ee09
pr-bh.ybp.yahoo.com/sync/openx/ Frame 03C1 		43 B
204 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/ca219a20-0090-e420-d699-1cafd4e9ee09?gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 03C1
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=7gJRtG971MNhz45
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=7gJRtG971MNhz45
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-00eeed23208b59ecc@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=7gJRtG971MNhz45
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 03C1
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx
  • https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=o...
  • https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=openx
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=77c3e303-d00b-4e39-8e59-33f6f5712372
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=77c3e303-d00b-4e39-8e59-33f6f5712372
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
//us-u.openx.net/w/1.0/sd?id=537072968&val=77c3e303-d00b-4e39-8e59-33f6f5712372
Date
Wed, 17 Nov 2021 09:49:14 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sd
eu-u.openx.net/w/1.0/ Frame 03C1
Redirect Chain
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8449438386211448846
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8449438386211448846
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
2321f6b2-e83d-4e05-8256-7b19370027f5
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8449438386211448846
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
redir
rtb-csync.smartadserver.com/ Frame 03C1
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUF3SVQwN0RLYUFBQUNqMWpoNjdsdw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAwIT07DKaAAACj1jh67lw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAwIT07DKaAAACj1jh67lw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...
43 B
163 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAwIT07DKaAAACj1jh67lw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
HTTP/1.1
Server
185.86.138.144 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
transfer-encoding
chunked
content-type
image/gif

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAwIT07DKaAAACj1jh67lw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
async_usersync
ib.adnxs.com/ Frame AFD8 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
5058f79c-1e22-4013-a2e6-cca12d452056
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 3B31 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
1a477043f6ffa7aac547e5d3889e3c4569b57e38321fe2ccdd652ba27343eb47

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:14 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=76848
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9511
Expires
Thu, 18 Nov 2021 07:10:02 GMT
13926
g2.gumgum.com/usync/ Frame 301B 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a52cd2d88d3522e5c6d1e25f3944d2ec9072832b5ac81d13c3660963ff7bb3d7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
text/html;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
etag
W/"0756360dd0834b7b9bce50af35e3d063b"
timing-allow-origin
*
content-encoding
gzip
ps
pixel.33across.com/ Frame 9FDF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip23.67-202-105.static.steadfastdns.net
Software
33XP001 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

x-33x-status
2000208
server
33XP001
date
Wed, 17 Nov 2021 09:49:14 GMT
/
onetag-sys.com/usync/ Frame 0F00 		2 KB
823 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
strict-transport-security
max-age=15552000
sync
ssbsync.smartadserver.com/api/ Frame 0AE1 		859 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.120 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
2fb7d099213d904ed9af560fee2e724c8d4e2b0452dc81b4da09078f4b4b3425

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
content-type
text/html
content-length
859
usermatch
ssum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
59d84b5d4c5fb70a97d72f219027b74418234b2566b391115793f769e81e7ac5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
39|45|241|230|81|152|31|196
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1610
Expires
Wed, 17 Nov 2021 09:49:15 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive

Redirect headers

Server
Apache
Content-Length
311
Content-Type
text/html; charset=iso-8859-1
Location
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Wed, 17 Nov 2021 09:49:14 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:14 GMT
Connection
keep-alive
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
  • https://ads.servenobid.com/sync?pid=312&uid=8449438386211448846
0
345 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=312&uid=8449438386211448846
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
cdce8aac-8f56-49fe-86af-5827654a9299
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ads.servenobid.com/sync?pid=312&uid=8449438386211448846
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
  • https://ads.servenobid.com/sync?pid=310&uid=1dc50d1b49accb77b5a8cca4
0
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=310&uid=1dc50d1b49accb77b5a8cca4
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ads.servenobid.com/sync?pid=310&uid=1dc50d1b49accb77b5a8cca4
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1ams1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4537590229
  • https://sync.1rx.io/usersync/tradedesk/2e2d02af-7c4a-4a07-9559-17763045ad0b
  • https://sync.targeting.unrulymedia.com/csync/RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
  • https://ads.servenobid.com/sync?pid=321&uid=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
0
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=321&uid=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=321&uid=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
date
Wed, 17 Nov 2021 09:49:15 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXd44a00222cd54cae9d35f6c0b93c38f3003
content-type
text/html
101954
jadserve.postrelease.com/suid/ Frame BD0C 		43 B
428 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.153.224.87 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-153-224-87.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://p.rfihub.com/cm?pub=44007&in=1
  • https://ads.servenobid.com/sync?pid=324&uid=6955244342849360110
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=324&uid=6955244342849360110
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Location
https://ads.servenobid.com/sync?pid=324&uid=6955244342849360110
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
usa
sync.go.sonobi.com/ Frame BD0C 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
  • https://ads.servenobid.com/sync?pid=327&uid=03f1151a-199e-4b55-b5d2-963a2a707cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=327&uid=03f1151a-199e-4b55-b5d2-963a2a707cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=327&uid=03f1151a-199e-4b55-b5d2-963a2a707cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
date
Wed, 17 Nov 2021 09:49:14 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
0
server
envoy
content-length
0
sync
ads.servenobid.com/ Frame BD0C
Redirect Chain
  • https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60124%26uid%3D$UID
  • https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60124%26uid%3D%24UID
  • https://t.adx.opera.com/sync?vendor=60124&uid=12193933559667964209
  • https://ups.analytics.yahoo.com/ups/58484/occ
  • https://t.adx.opera.com/sync?vendor=60112&uid=y-afv8CqJE2uHUwxrffA8o.X4ky8mn.yH9Q9Qu6N4-~A
  • https://sync.aralego.com/idSync?ucf_nid=par-627D96DE43D94E241EAD99688E72B636&ucf_user_id=a2d332019cef2e9c&redirect=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fuid%3DUCFUID%26vendor%3D60114
  • https://t.adx.opera.com/sync?uid=d8be43cb-3d0f-3e4e-924b-00064c27cebb&vendor=60114
  • https://ads.servenobid.com/sync?operaUid=053c5325f6bd427fb8718d80aceddde1&pid=335&uid=
0
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?operaUid=053c5325f6bd427fb8718d80aceddde1&pid=335&uid=
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
Tengine
access-control-allow-origin
*
access-control-allow-methods
POST, GET
content-type
text/html; charset=utf-8
location
https://ads.servenobid.com/sync?operaUid=053c5325f6bd427fb8718d80aceddde1&pid=335&uid=
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
117
expires
Mon, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 3B31
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIndu79e_Oe2l-p4xMvAPb4&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIndu79e_Oe2l-p4xMvAPb4&google_cver=1
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIndu79e_Oe2l-p4xMvAPb4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 3B31
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/iW_CgSdTCI7TVkM5QzwDnMn5EUdSAgOZEtemQ7w0kco?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=9043961207974568702
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=9043961207974568702
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=9043961207974568702
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
rubicon
match.adsrvr.org/track/cmf/ Frame 3B31 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 3B31
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1czQ0VKVkctMjYtQ0pNMg==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1czQ0VKVkctMjYtQ0pNMg==
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1czQ0VKVkctMjYtQ0pNMg==
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
6f9fd0201ed801884e5299d5aabca094
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
v1
ads.yahoo.com/cms/ Frame 3B31
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KW3CEJVG-26-CJM2&sigv=1&esig=2~d647d80a158a9feb4bbf9458a0d9cfed5086deda
0
618 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KW3CEJVG-26-CJM2&sigv=1&esig=2~d647d80a158a9feb4bbf9458a0d9cfed5086deda
Protocol
H2
Server
2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KW3CEJVG-26-CJM2&sigv=1&esig=2~d647d80a158a9feb4bbf9458a0d9cfed5086deda
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
6f9fd0201ed801884e5299d5aabca094
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 3B31
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=a6ec6194-d017-4d01-ab1b-e983e8443848&expires=28
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=a6ec6194-d017-4d01-ab1b-e983e8443848&expires=28
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
MT3 4103 f8fad19 master zrh-pixel-x28 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=a6ec6194-d017-4d01-ab1b-e983e8443848&expires=28
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 17 Nov 2021 09:49:14 GMT
tap.php
pixel.rubiconproject.com/ Frame 3B31
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YZTQGQAFL7inQwAz
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YZTQGQAFL7inQwAz
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 varnish
server
Varnish
x-timer
S1637142555.010327,VS0,VE0
x-served-by
cache-hhn4023-HHN
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YZTQGQAFL7inQwAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
709414.gif
id.rlcdn.com/ Frame 3B31 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
casale
match.adsrvr.org/track/cmf/ Frame 8587 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
crum
dsum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YZTQG.bYSobulYyrQPB.aQAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMaPnOK0FxAkUYq6vUwDOHw&google_cver=1&gdpr=1&google_hm=2
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMaPnOK0FxAkUYq6vUwDOHw&google_cver=1&gdpr=1&google_hm=2
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:15 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMaPnOK0FxAkUYq6vUwDOHw&google_cver=1&gdpr=1&google_hm=2
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
341
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 8587
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
370WTS2AMNK12NX35GXS
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
3M2P15C1H2T2BCQPEB9S
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEIzktQ-JkLpX36-LvJcSQnE&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEIzktQ-JkLpX36-LvJcSQnE&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:15 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEIzktQ-JkLpX36-LvJcSQnE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=GztJ9Ek6QfkAOUShHz5dokhuE6YAbkakGz6JmH7K
43 B
1014 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=GztJ9Ek6QfkAOUShHz5dokhuE6YAbkakGz6JmH7K
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:15 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=GztJ9Ek6QfkAOUShHz5dokhuE6YAbkakGz6JmH7K
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://sync.extend.tv/r.gif?exchange=index
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=bfc8fe84-92e8-4e72-a838-dfb6dbca4460
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=bfc8fe84-92e8-4e72-a838-dfb6dbca4460
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:15 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Access-Control-Allow-Origin
*
Content-Type
text/html; charset=utf-8
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=bfc8fe84-92e8-4e72-a838-dfb6dbca4460
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
132
Expires
Tue, 29 May 1984 15:00:00 GMT
noop
px.owneriq.net/ Frame 8587
Redirect Chain
  • https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID)
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fdsum-sec.casalemedia.com%2fcrum%3fcm_dsp_id%3d31%26external_user_id%3dQ6904289551340172358&uid=Q6904289551340172358&ref=%2Feucm%2Fp%2Fcc
  • https://px.owneriq.net/noop?ct=image%2Fgif
0
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.owneriq.net/noop?ct=image%2Fgif
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
104.111.242.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-53.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache/2.2.15 (CentOS)
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By
PHP/5.3.3
Content-Length
0
Content-Type
image/gif

Redirect headers

Location
https://px.owneriq.net/noop?ct=image%2Fgif
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0
crum
dsum-sec.casalemedia.com/ Frame 8587
Redirect Chain
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Wed, 17 Nov 2021 09:49:15 GMT

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT
server
nginx
access-control-allow-origin
*
transfer-encoding
chunked
access-control-allow-methods
POST, GET, OPTIONS
p3p
CP="NOI DEV OUR BUS UNI"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control
no-cache
content-type
text/html; charset=UTF-8
access-control-allow-headers
Origin
keep-alive
timeout=10
sync
ads.servenobid.com/ Frame 8587 		0
357 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=333&uid=YZTQG-bYSobulYyrQPB-aQAABFAAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=8449438386211448846
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=8449438386211448846
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 400.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
a87df17d-7346-4f43-bc7d-53ce7250df68
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=8449438386211448846
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_c357b845-a85a-49da-bb56-1c75559f386a&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=02706488-945b-4f0e-a02b-304be83e3758&ssp=gumgum2
  • https://rtb.gumgum.com/usersync?b=bsw&i=77c3e303-d00b-4e39-8e59-33f6f5712372
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=77c3e303-d00b-4e39-8e59-33f6f5712372
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=77c3e303-d00b-4e39-8e59-33f6f5712372
Date
Wed, 17 Nov 2021 09:49:15 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-70e0900b-6d09-46a0-6dae-0a6bd00455a5$ip$194.36.108.20
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-70e0900b-6d09-46a0-6dae-0a6bd00455a5$ip$194.36.108.20
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-70e0900b-6d09-46a0-6dae-0a6bd00455a5$ip$194.36.108.20
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_c357b845-a85a-49da-bb56-1c75559f386a&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=6IQ6pfYfKqjS3-k1j6QQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2NSJKE3HAZSZMZFXC2STGMWWWMLKGZIVCJTVONPXA...
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6IQ6pfYfKqjS3-k1j6QQ&us_privacy=1---
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6IQ6pfYfKqjS3-k1j6QQ&us_privacy=1---
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
P3p
CP="We do not support P3P header."
Location
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6IQ6pfYfKqjS3-k1j6QQ&us_privacy=1---
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
118
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003&rndcb=3492431408
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=77c3e303-d00b-4e39-8e59-33f6f5712372&google_hm=NzdjM2UzMDMtZDAwYi00ZTM5LThlNTktMzNmNmY1NzEy...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEPp3p1rSHftQOxSdmaLaWwU&google_cver=1&ssp=adconductor&bsw_param=77c3e303-d00b-4e39-8e59-33f6f5712372
  • https://sync.1rx.io/usersync/bidswitch/77c3e303-d00b-4e39-8e59-33f6f5712372?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=rhy&i=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=rhy&i=RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
date
Wed, 17 Nov 2021 09:49:15 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXd44a00222cd54cae9d35f6c0b93c38f3003
content-type
text/html
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=ZUsQ70DGJKqb&ev=1&pid=558355
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=ZUsQ70DGJKqb&ev=1&pid=558355
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
de-DE
location
https://rtb.gumgum.com/usersync?b=pln&i=ZUsQ70DGJKqb&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-544c4f9c45-6vt9p
expires
-1
cookie-sync
sync.outbrain.com/ Frame 301B
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28VCJUKekPMziObJhxbaBv5Wbz3J0DkUKoLZUAQezF57PmuJrypuTcOBAuxjeaRm7l%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_c357b845-a85a-49da-bb56-1c75559f386a&obuid=ENC(VCJUKekPMziObJhxbaBv5Wbz3J0DkUKoLZUAQezF57PmuJrypuTcOBAuxjeaRm7l)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=$D
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=$D
  • https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=fb1c6933-e24b-40d0-b484-85d0af649749
0
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=fb1c6933-e24b-40d0-b484-85d0af649749
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Server
64.202.112.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:16 GMT
Cache-Control
no-cache
X-TraceId
ec627d1c31232f7def590eb7bb1238fd
Content-Length
0

Redirect headers

Location
//sync.outbrain.com/cookie-sync?p=mediaforce&uid=fb1c6933-e24b-40d0-b484-85d0af649749
Date
Wed, 17 Nov 2021 09:49:16 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=a9db5814-b829-4e3f-8035-1ab7e3ee2206
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=a9db5814-b829-4e3f-8035-1ab7e3ee2206
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-encoding
gzip
server
OXGW/16.218.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=a9db5814-b829-4e3f-8035-1ab7e3ee2206
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=oth&i=y-AjPNN31E2pd40oRA2L9GZKOq0jZ3G8Gnbi7k~A
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=oth&i=y-AjPNN31E2pd40oRA2L9GZKOq0jZ3G8Gnbi7k~A
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://rtb.gumgum.com/usersync?b=oth&i=y-AjPNN31E2pd40oRA2L9GZKOq0jZ3G8Gnbi7k~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=a026b47e-478b-11ec-b40a-db78886add51
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=a026b47e-478b-11ec-b40a-db78886add51
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=a026b47e-478b-11ec-b40a-db78886add51
Date
Wed, 17 Nov 2021 09:49:14 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
a026b47f-478b-11ec-b40a-db78886add51
services
sync.technoratimedia.com/ Frame 301B 		0
293 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
132.226.41.106 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
314347803
access-control-allow-origin
https://g2.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame 301B 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
0
server
b
usersync
rtb.gumgum.com/ Frame 301B
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://rtb.gumgum.com/usersync?b=idi&i=857e617a-2dea-44e5-b335-0429974df9cf
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=idi&i=857e617a-2dea-44e5-b335-0429974df9cf
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=idi&i=857e617a-2dea-44e5-b335-0429974df9cf
date
Wed, 17 Nov 2021 09:49:15 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
sync
ssbsync.smartadserver.com/api/ Frame 301B 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.120 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
content-length
0
sync
ads.servenobid.com/ Frame 301B 		0
358 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=309&uid=e_c357b845-a85a-49da-bb56-1c75559f386a
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame F41A 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=87040
expires
Thu, 18 Nov 2021 09:59:55 GMT
date
Wed, 17 Nov 2021 09:49:15 GMT
vary
Accept-Encoding
usersync
rtb.gumgum.com/ Frame A542
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=2e2d02af-7c4a-4a07-9559-17763045ad0b&t=1639734555
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=2e2d02af-7c4a-4a07-9559-17763045ad0b&t=1639734555
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
text/html
content-length
209
location
https://rtb.gumgum.com/usersync?b=ttd&i=2e2d02af-7c4a-4a07-9559-17763045ad0b&t=1639734555
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usync.html
eus.rubiconproject.com/ Frame 06F1
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=gumgum
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
usersync
rtb.gumgum.com/ Frame EFA8
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=360
Access-Control-Allow-Origin
*
Server
MT3 4103 f8fad19 master zrh-pixel-x26 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://rtb.gumgum.com/usersync?b=mmh&i=a6ec6194-d017-4d01-ab1b-e983e8443848&gdpr=0&gdpr_consent=
Expires
Wed, 17 Nov 2021 09:49:14 GMT
usersync
rtb.gumgum.com/ Frame 4BBB
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=atm&i=YZTQGQAFL7inQwAz&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=atm&i=YZTQGQAFL7inQwAz&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

server
Varnish
retry-after
0
location
https://rtb.gumgum.com/usersync?b=atm&i=YZTQGQAFL7inQwAz&gdpr=0&gdpr_consent=
accept-ranges
bytes
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 varnish
x-served-by
cache-hhn4023-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1637142555.104362,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
pixel
cm.g.doubleclick.net/ Frame 135A 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jMzU3Yjg0NS1hODVhLTQ5ZGEtYmI1Ni0xYzc1NTU5ZjM4NmE=&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
image/png
date
Wed, 17 Nov 2021 09:49:15 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
server
HTTP server (unknown)
content-length
170
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
ssc-cms.33across.com/ps/ Frame 237E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip23.67-202-105.static.steadfastdns.net
Software
33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

x-33x-status
2000208
server
33XP005
date
Wed, 17 Nov 2021 09:49:14 GMT
um
cs.emxdgt.com/ Frame 179F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
text/html
date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame 6162
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=YZTQG8Co5ugAAEZWn-UAAAAA
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=YZTQG8Co5ugAAEZWn-UAAAAA
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Server
nginx
Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
private
Location
https://rtb.gumgum.com/usersync?b=sus&i=YZTQG8Co5ugAAEZWn-UAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time
2
X-SO-HostName
m-ad348.dc4p.scaleout.jp
X-SO-LB-Hostname
a-tgng40017.dc2p.scaleout.jp
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":28,"gdpr":true,"ipv4":"0.0.0.0","key":"YZTQG8Co5ugAAEZWn-UAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad348"}
X-SO-Key
YZTQG8Co5ugAAEZWn-UAAAAA
X-SO-IP
194.36.108.20
X-SO-Cluster-ID
28
X-SO-Upstream-ID
m-ad348
usersync
rtb.gumgum.com/ Frame 28CA
Redirect Chain
  • https://p.rfihub.com/cm?pub=42796&in=1
  • https://rtb.gumgum.com/usersync?b=zet&i=6955244342849360110
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=zet&i=6955244342849360110
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://rtb.gumgum.com/usersync?b=zet&i=6955244342849360110
Content-Length
0
Server
Jetty(9.3.29.v20201019)
usersync
rtb.gumgum.com/ Frame 0ABE
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=IxK4Am4b0eX031jwlNhe&pi=gumgum&tc=1
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=IxK4Am4b0eX031jwlNhe&pi=gumgum&tc=1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.173.19 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-173-19.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Wed, 17 Nov 2021 09:49:15 GMT Wed, 17 Nov 2021 09:49:15 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=IxK4Am4b0eX031jwlNhe&pi=gumgum&tc=1
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
sync
ads.servenobid.com/ Frame 0AE1 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=317&uid=3018712670415424945&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.203.227.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-227-77.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 0AE1
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=641922670622144214&gdpr=0&gdpr_consent=
43 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=641922670622144214&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.144 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
server
nginx
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=641922670622144214&gdpr=0&gdpr_consent=
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 0AE1
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=87443bd9-3835-4110-8798-147b496692b2&gdpr=0&gdpr_consent=
43 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=87443bd9-3835-4110-8798-147b496692b2&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.144 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
server
Kestrel
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=87443bd9-3835-4110-8798-147b496692b2&gdpr=0&gdpr_consent=
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1540006
content-length
0
expires
Wed, 17 Nov 2021 00:00:00 GMT
/
s.ad.smaato.net/c/ Frame 0AE1 		0
241 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:d600:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
server
CloudFront
cache-control
no-cache, must-revalidate
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
Z8KEpLtX2M_TTy5uuQBsLUvA1SkvwIKwt1cI31SrW8h1bmKUFkYwzQ==
x-cache
FunctionGeneratedResponse from cloudfront
/
rtb-csync.smartadserver.com/redir/ Frame 0AE1
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=rXtUeP96XHW2eVktqX5ALv4uDiq2LlsorX6q7ot2
43 B
429 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=rXtUeP96XHW2eVktqX5ALv4uDiq2LlsorX6q7ot2
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.144 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=rXtUeP96XHW2eVktqX5ALv4uDiq2LlsorX6q7ot2
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 06F1 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
1a477043f6ffa7aac547e5d3889e3c4569b57e38321fe2ccdd652ba27343eb47

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=76847
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9511
Expires
Thu, 18 Nov 2021 07:10:02 GMT
um
cs.emxdgt.com/ Frame DD5A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

content-type
text/html
date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
0
usync.html
eus.rubiconproject.com/ Frame 7C13
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
uc.html
go.sonobi.com/ Frame CB10 		43 B
575 B 		Document
General
Check archive.org
Download Go to
Full URL
https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.34.250.74 North Hollywood, United States, ASN27630 (AS-XFERNET, US),
Reverse DNS
Software
sonobi-go /
Resource Hash
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, no-store, private
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma
no-cache
Tcn
Choice
Vary
negotiate,Accept-Encoding
X-Go-Server
go-lax-1-5-28
X-Xss-Protection
0
Content-Encoding
gzip
Server
sonobi-go
cm
gift-connect-d.openx.net/w/1.0/ Frame EA29 		699 B
774 B 		Document
General
Check archive.org
Download Go to
Full URL
https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
d26977165f9edb920afa98e2ebbbf41bef724dd8dcd237fddc67c272d0cee522

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.218.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 17 Nov 2021 09:49:15 GMT
content-type
text/html
content-length
446
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B9E2 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.30.20.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-20-198.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=87040
expires
Thu, 18 Nov 2021 09:59:55 GMT
date
Wed, 17 Nov 2021 09:49:15 GMT
vary
Accept-Encoding
i.gif
e.serverbid.com/udb/9969/sync/ Frame 7890
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8449438386211448846
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8449438386211448846
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
42376c99-a64f-4d68-88b9-47f1e9905a71
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8449438386211448846
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 7890
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YZTQG.bYSobulYyrQPB.aQAA%261104
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YZTQG.bYSobulYyrQPB.aQAA%261104
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YZTQG.bYSobulYyrQPB.aQAA%261104
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
282
Expires
Wed, 17 Nov 2021 09:49:15 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 7890
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=1dc50d1b49accb77b5a8cca4
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=1dc50d1b49accb77b5a8cca4
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
0

Redirect headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=1dc50d1b49accb77b5a8cca4
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap2ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
usa
sync.go.sonobi.com/ Frame 7890 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=38&userId=
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 7890
Redirect Chain
  • https://pixel.advertising.com/ups/56621/occ
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP9ed4e051-478b-11ec-bcb9-02848bcde262
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP9ed4e051-478b-11ec-bcb9-02848bcde262
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP9ed4e051-478b-11ec-bcb9-02848bcde262
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
content-length
0

Redirect headers

location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP9ed4e051-478b-11ec-bcb9-02848bcde262
date
Wed, 17 Nov 2021 09:49:15 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
us.gif
sync.go.sonobi.com/ Frame 7890
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
49 B
513 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
cache-control
no-cache
content-length
0
56939
i6.liadm.com/s/ Frame 7890
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c&_li_chk=true&previous_uuid=49805f9161fd46288d03e905d543387b
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
43 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
2600:1f18:444a:4602:2c20:3113:5c28:1366 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:16 GMT
Cache-Control
no-store
Connection
keep-alive
trace-id
963616131c21a1c1
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
Date
Wed, 17 Nov 2021 09:49:15 GMT
Connection
keep-alive
trace-id
e91a02c25d94a274
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
sync.php
pixel.rubiconproject.com/exchange/ Frame 06F1 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif
i.gif
e.serverbid.com/udb/9969/sync/ Frame EA29 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=19&userId=137b5673-7558-495b-a2e7-1239fbfb4fb6
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
167.172.1.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
content-length
0
current
openx2-match.dotomi.com/match/bounce/ Frame EA29 		0
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://openx2-match.dotomi.com/match/bounce/current?networkId=15900&version=1&nuid={OX_USER_ID}
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:20::2040 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
sd
us-u.openx.net/w/1.0/ Frame EA29
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=1
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=no-consent&gdpr=1&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072977&val=no-consent&gdpr=1&gdpr_consent=
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://us-u.openx.net/w/1.0/sd?id=537072977&val=no-consent&gdpr=1&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
ox
match.justpremium.com/match/ Frame EA29 		43 B
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.justpremium.com/match/ox?ex_uid=14673294-c78d-4c03-b550-8c6c2acb607a
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.28.254.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-28-254-122.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:15 GMT
content-length
43
content-type
image/gif
sd
us-u.openx.net/w/1.0/ Frame EA29
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YZTQGQAFL7inQwAz
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YZTQGQAFL7inQwAz
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 varnish
server
Varnish
x-timer
S1637142555.321525,VS0,VE0
x-served-by
cache-hhn4023-HHN
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YZTQGQAFL7inQwAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
sd
us-u.openx.net/w/1.0/ Frame EA29
Redirect Chain
  • https://green.erne.co/openx/cm
  • https://pixel.onaudience.com/?mapped=wRK26hLPbSA1H9iSk3UOX1ON&partner=2&redirect=green.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072998%2526rtb...
  • https://sync.crwdcntrl.net/map/c=14544/tp=BIDB?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26redirect%3Dhttps%253A%252F%252Fgreen.erne.co%252Fc...
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=bae60edfc89c0247e20dae3ca33bda37&redirect=https%3A%2F%2Fgreen.erne.co%2Fct%2Fcm%3Fred%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%25...
  • https://green.erne.co/ct/cm?red=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072998%26rtb%3DwRK26hLPbSA1H9iSk3UOX1ON
  • https://us-u.openx.net/w/1.0/sd?id=537072998&rtb=wRK26hLPbSA1H9iSk3UOX1ON
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072998&rtb=wRK26hLPbSA1H9iSk3UOX1ON
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072998&rtb=wRK26hLPbSA1H9iSk3UOX1ON
date
Wed, 17 Nov 2021 09:49:15 GMT
server
openresty
strict-transport-security
max-age=0; includeSubDomains;
content-type
text/html; charset=UTF-8
sd
us-u.openx.net/w/1.0/ Frame EA29
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=1
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8967352942602574771&gdpr=1&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8967352942602574771&gdpr=1&gdpr_consent=&us_privacy=
Requested by
Host: gift-connect-d.openx.net
URL: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.218.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gift-connect-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Nov 2021 09:49:15 GMT
via
1.1 google
server
OXGW/16.218.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8967352942602574771&gdpr=1&gdpr_consent=&us_privacy=
pragma
no-cache
date
Wed, 17 Nov 2021 09:49:14 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
usync.js
eus.rubiconproject.com/ Frame 7C13 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-143-124.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
1a477043f6ffa7aac547e5d3889e3c4569b57e38321fe2ccdd652ba27343eb47

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Wed, 17 Nov 2021 09:49:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=76847
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9511
Expires
Thu, 18 Nov 2021 07:10:02 GMT
sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 7C13 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17632
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
e1bddfc34a927e97bda010c0d8a62b62
Content-Type
image/gif
SPug
simage4.pubmatic.com/AdServer/ Frame 9A78 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156858&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.47.127.20 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 09:49:14 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
async_usersync
ib.adnxs.com/ Frame AFD8 		0
731 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Nov 2021 09:49:15 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
cef75430-57e4-43ed-af03-394c76bf18ab
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
st
capi.connatix.com/tr/ Frame 0559 		0
294 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=138955
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.222.97.191 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-222-97-191.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 17 Nov 2021 09:49:16 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://safehaven.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20

Verdicts & Comments Add Verdict or Comment

225 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| gtag object| dataLayer object| LG03Yd2 function| LG03Yd3 object| xop object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug boolean| gTrackVisibility boolean| gLazyLoad boolean| gTrackPageVisibility number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| k999SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad300x250ATF object| ad300x250BTF object| ad300x250BTF2 object| ad728x90ATF object| ad728x90BTF object| ad160x600BTF object| ad300x250ATFM object| ad300x250BTFM object| adGoogleAdXInterstitial number| gBrowserWidth object| desktopAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount object| googletag object| ggeac object| google_js_reporting_queue undefined| google_measure_js_timing object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| pbjsChunk object| pbjs object| _pbjsGlobals object| ADAGIO string| nobidVersion object| nobid function| _0x10e398 object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gIntersectionObserver object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gPrebidBidsBack function| _0x306c function| _0x5af4 boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| sendAdserverRequest function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| attachCloseBoxSVG function| configureAdSlot function| getCookie object| apstag object| google_reactive_ads_global_state function| cnx function| fbq function| _fbq function| $ function| jQuery object| _pcq object| cookieconsent object| CdeTHI function| CdeTHt function| xblacklist function| menu_underline function| scrollWin function| dump function| addOption function| removeAllOptions function| externalLinks function| country function| hidelinks function| loginFocus function| featuredArticlesHeight function| bottomArticlesHeight object| jQuery112308604014154053932 function| cb function| raf object| om1720_20987 function| om1720_20987_poll number| $leftpos_margin object| qwcZBp2 function| qwcZBp3 function| xblocker object| gaplugins object| gaGlobal object| gaData boolean| apstagLOADED function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO boolean| _pc_loaded object| PC object| VWO object| _vwo_exp_ids object| _vwo_exp string| _vwo_server_url object| _vis_opt_queue function| bowser object| __pc object| _pushcrewDebuggingQueue object| _pc_u boolean| ecomEventsInit object| _pc object| pctracker function| _pc_s function| setImmediate function| clearImmediate function| OptinMonsterApp boolean| om_loaded boolean| _omvisitsadded function| omq object| cnx_usr_storage boolean| creativeVendorLibraryLoaded object| ID5 object| _omapp object| omimkmxwweszc4uccxqwku object| PublisherCommonId object| sas object| apntag object| _ADAGIO object| WebFont object| pushcrew number| height_diff number| margin_height object| player_instance_3045b0da98444904af71b3bd3e4e4ae4 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins function| cnxProxyTask object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id number| google_global_correlator object| GoogleGcLKhOms object| closure_lm_584929 object| ONFOCUS boolean| DFPSFMessageEnabled object| ampInaboxIframes object| ampInaboxPendingMessages object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| google_image_requests function| cnxAddEventListener

143 Cookies

Domain/Path Name / Value
i.liadm.com/s Name: _li_ss
Value: MgkI_____wcQ8hA
safehaven.com/ Name: csrf_safehaven_cookie
Value: f5eaec81aba56edf73c3539741502a9b
safehaven.com/ Name: safehaven_ci
Value: 17ffc6824c4bff3d87a097c3fbcfb32f8c6f7077
.safehaven.com/ Name: _gcl_au
Value: 1.1.1401665843.1637142548
safehaven.com/ Name: screensizewidth
Value: 1600
.safehaven.com/ Name: _ga
Value: GA1.2.1902631498.1637142549
.safehaven.com/ Name: _gid
Value: GA1.2.2121295973.1637142549
.safehaven.com/ Name: _gat_gtag_UA_2249023_27
Value: 1
safehaven.com/ Name: _wingify_pc_uuid
Value: 691203c4ace148339df7cc461cb28c34
safehaven.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
safehaven.com/ Name: _omappvp
Value: Pw85devb9DKu8GogoU0VuZwEJITr58XX2ZHwwgD6TWFmtMqBP6SXeFWn6xSXDZJsx2KQ3cPjIJjUoJThJ7q8dTWryE1m4d2G
safehaven.com/ Name: _omappvs
Value: 1637142549056
.openx.net/ Name: i
Value: 8d4ac33d-39bb-499e-bd98-c2b24f9910bd|1637142549
.lijit.com/ Name: ljtrtb
Value: eJyrrgUAAXUA%2BQ%3D%3D
.lijit.com/ Name: ljt_reader
Value: 1dc50d1b49accb77b5a8cca4
.adnxs.com/ Name: uuid2
Value: 8449438386211448846
.safehaven.com/ Name: _fbp
Value: fb.1.1637142549348.1713290992
e.serverbid.com/ Name: azk
Value: ue1-sb1-1f35ae48-6861-4edd-abcd-d973bd81f59c
safehaven.com/ Name: wingify_donot_track_actions
Value: 0
.rubiconproject.com/ Name: rsid
Value: 1|AIfsdBUO++vuGxiryvY4NyLgsLINffPD0nJRTZPyMmB0r4WWOQTuL9+dZLvlgeCkRh3C4GjGYWrGRQSWDHOtFAT+ngdWyQZYykB4JZyHexlK9j7tYKExPQ==
.a-mo.net/ Name: amuid2
Value: 03f1151a-199e-4b55-b5d2-963a2a707cca
safehaven.com/ Name: AWSALB
Value: MHk3BIAHH9SYhjoHs+2HYrWr3gPkqweBzxjW/Es9s/xb+IpL3TtjAg+x+MGn87vhRpHtvVYwHb2/xey7XILfGDVrIc2phFjlH6O3x7YA9D/9iCPNRUxA52CQPkRS
safehaven.com/ Name: AWSALBCORS
Value: MHk3BIAHH9SYhjoHs+2HYrWr3gPkqweBzxjW/Es9s/xb+IpL3TtjAg+x+MGn87vhRpHtvVYwHb2/xey7XILfGDVrIc2phFjlH6O3x7YA9D/9iCPNRUxA52CQPkRS
.rubiconproject.com/ Name: khaos
Value: KW3CEJVG-26-CJM2
.rubiconproject.com/ Name: audit
Value: 1|mFVHqHkj5bHEHiQMHYKLb0ZeVCuLeoYaJAQRvrb7NaaVL7v9nbH7loMVpeojicjx/D2e40fvnqcd7pACyQ9E0wvAG15loFpV9ffqWu8FjBY=
.safehaven.com/ Name: _pubcid
Value: 5ce3ca89-b55d-4e62-aa8f-d03135a7df0c
.adnxs.com/ Name: icu
Value: ChgIo_VZEAoYASABKAEwlaDTjAY4AUABSAEKGAi-rHUQChgBIAEoATCVoNOMBjgBQAFIARCVoNOMBhgB
prebid.a-mo.net/ Name: __amc
Value: 2_1637142549_1637142549
safehaven.com/ Name: cto_bidid
Value: PYmF_F9DeFNWR3lHRWs3NGx1bXBlTUpHa09GcXNuSHRLS241U3lvOTdJYXFXZ1NacFFNaWNiWiUyQlZpTjNEN1I4OGxCVUhuc09WSWp2NDlwcmJwNEpSM2Z6NkNBJTNEJTNE
safehaven.com/ Name: cto_bundle
Value: UA_aO19VelRPSm5IVTVpSGZjMVg0WnNpQzcyQ1QyTktBVmtUNWRMRDJqcW5uJTJGJTJCR2tWNzJVSk1IZkV5JTJGRnJybzAyTVREcVBleGtBVlBxVUpZNDFqRTIzQngzeWc0a2RqV2RXRiUyRnFXOWFOa24lMkJLVVlCUjN4aiUyQmpKYUVpeWpSWTBnTzR5eQ
.doubleclick.net/ Name: IDE
Value: AHWqTUnGqmkfjixyvlBGv0Il_7UbHj6Q80Cfb1clMsKtGmE7KXZKducnU1yI_4uRZyk
.safehaven.com/ Name: __gads
Value: ID=c19bc5f0ea7ea919:T=1637142549:S=ALNI_MY51GZdCUmAqWoD4MNQhF0QyB4W1Q
.mathtag.com/ Name: uuid
Value: a6ec6194-d017-4d01-ab1b-e983e8443848
.doubleclick.net/ Name: DSID
Value: NO_DATA
.redintelligence.net/ Name: 8lcfmzhxc8d6_uid
Value: 8875d9b61275e254
.quantserve.com/ Name: mc
Value: 6194d019-34a24-bedcf-d6d64
.adsrvr.org/ Name: TDID
Value: 2e2d02af-7c4a-4a07-9559-17763045ad0b
.advertising.com/ Name: APID
Value: UP9ed4e051-478b-11ec-bcb9-02848bcde262
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YZTQGQAFL7inQwAz
.adform.net/ Name: C
Value: 1
.adform.net/ Name: uid
Value: 641922670622144214
.pubmatic.com/ Name: KADUSERCOOKIE
Value: B0364E8B-6D29-4844-ADB9-6C1AFA5254A1
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 1
.pubmatic.com/ Name: pi
Value: 156858:2
.pubmatic.com/ Name: DPSync3
Value: 1637193600%3A174%7C1638316800%3A197_219_201
.pubmatic.com/ Name: SyncRTB3
Value: 1638316800%3A220_21_13_161_7_56
.yahoo.com/ Name: APID
Value: UP9ed4e051-478b-11ec-bcb9-02848bcde262
.yahoo.com/ Name: A3
Value: d=AQABBBnQlGECEBnM0ZONjMVgH8uCmQvqDDgFEgEBAQEhlmGeYQAAAAAA_eMAAA&S=AQAAAv3CsmJL3LUnmeIyBVK0Upg
.turn.com/ Name: uid
Value: 8967352942602574771
.simpli.fi/ Name: suid
Value: 58A602B54B5E4FCF950748AAAF40702C
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-641922670622144214&KRTB&23263-641922670622144214
.pubmatic.com/ Name: PUBMDCID
Value: 3
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:a6ec6194-d017-4d01-ab1b-e983e8443848&KRTB&16736-uid:a6ec6194-d017-4d01-ab1b-e983e8443848&KRTB&23019-uid:a6ec6194-d017-4d01-ab1b-e983e8443848&KRTB&23114-uid:a6ec6194-d017-4d01-ab1b-e983e8443848
.de17a.com/ Name: guid2
Value: 1.4378616187624166420
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEIcEKZ-uajGGl2OuYW2VK9k&KRTB&16514-CAESEIcEKZ-uajGGl2OuYW2VK9k&KRTB&23025-CAESEIcEKZ-uajGGl2OuYW2VK9k
.pubmatic.com/ Name: KRTBCOOKIE_336
Value: 5844-4378616187624166420
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrM0NTUyMTE2MbIwsTQ2MzA0NBDiM9TNDor3STFwck3NDg6Q4jU0MzY3NDEyNTU2NzcBABsBYEI0AAAA
.rfihub.com/ Name: smd
Value: H4sIAAAAAAAAAOPiNTQzNjc0MTI1NTY3NwEA5nE0VQ8AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrM0NTUyMTE2MbIwsTQ2MzA0NBDiM9TNDor3STFwck3NDg4AAH6tdRolAAAA
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAAAOOSMXR2dA129TYvMczPS8kvccvwDfRIrkyLz3eMzAYA2XP2ER4AAAA
.onaudience.com/ Name: cookie
Value: 25231d507455e889
.onaudience.com/ Name: done_redirects104
Value: 1
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: bae60edfc89c0247e20dae3ca33bda37
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQSEpMNTNITUlLtrBMNjAyMU81MkhJTDVOTjQ2TkpJNDZnAILEKRekQDQUAAB5bAug"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBInHJBCkhBAQAXwgHg"
.tribalfusion.com/ Name: ANON_ID
Value: aGnsIHoNIvbpmVrCJZaOXnIN8n7EB5TvCAoP9yWw9oBSivMRy6a1yZbOJyiVe6EqFTHJZcMpCXFBYBmYAATYcOK71bH
.onaudience.com/ Name: done_redirects147
Value: 1
.onaudience.com/ Name: done_redirects219
Value: 1
.zeotap.com/ Name: zc
Value: 629f74fe-6bbd-4ec8-6238-9688d5f2471f
.zeotap.com/ Name: zsc
Value: k%FE%88%7D%C7%24M%8F%D5t%5C%B2J%04%06%3E%DCQ%F8%A6%83%B8h%FF-%B1C~%A1%16%EA%B1%B3%3B%1C%9D%B0%F3%D4w%1D%09%1D%C7%85%96B%DB%26%FC%9C%11%D4V%0BG%5EO%2B6%28%F7%EC%3B%19u%D6%9C%0E0%0F%9E%11~%07%0Af%94q%2B%E3M%88
.bidswitch.net/ Name: tuuid
Value: 77c3e303-d00b-4e39-8e59-33f6f5712372
.bidswitch.net/ Name: c
Value: 1637142554
.bidswitch.net/ Name: tuuid_lu
Value: 1637142554
.w55c.net/ Name: wfivefivec
Value: 7gJRtG971MNhz45
.w55c.net/ Name: matchopenx
Value: 5
.rqtrk.eu/ Name: browser_id
Value: 1:c0a39fc1-7b66-42db-97b0-4f8463d2a368
.casalemedia.com/ Name: CMID
Value: YZTQG.bYSobulYyrQPB.aQAA
.casalemedia.com/ Name: CMPS
Value: 5221
.lijit.com/ Name: _ljtrtb_273657
Value: 273657
.adx.opera.com/ Name: UID
Value: 053c5325f6bd427fb8718d80aceddde1
.mathtag.com/ Name: mt_mop
Value: 9:1637142554
.casalemedia.com/ Name: CMPRO
Value: 1104
.casalemedia.com/ Name: CMST
Value: YZTQG2GU0BsA
.servenobid.com/ Name: pid_312
Value: 8449438386211448846
.servenobid.com/ Name: pid_310
Value: 1dc50d1b49accb77b5a8cca4
.3lift.com/ Name: tluid
Value: 12193933559667964209
.gumgum.com/ Name: vst
Value: e_c357b845-a85a-49da-bb56-1c75559f386a
.servenobid.com/ Name: pid_324
Value: 6955244342849360110
.smartadserver.com/ Name: pid
Value: 3018712670415424945
.bidr.io/ Name: bito
Value: AAwIT07DKaAAACj1jh67lw
.bidr.io/ Name: bitoIsSecure
Value: ok
.servenobid.com/ Name: pid_333
Value: YZTQG-bYSobulYyrQPB-aQAABFAAAAIB
.servenobid.com/ Name: pid_327
Value: 03f1151a-199e-4b55-b5d2-963a2a707cca
.quantserve.com/ Name: d
Value: EDYBGQHfJIqsMK67gQz7sQA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAOOSMXR2dA129TYvMczPS8kvccvwDfRIrkyLz3eMzA7iNTQzNjc0MTI1NTY3N3nFiMpfJYbgmxoampwSR-IbGJkCAP1sbEJdAAAA
.servenobid.com/ Name: pid_309
Value: e_c357b845-a85a-49da-bb56-1c75559f386a
.adsrvr.org/ Name: TDCPM
Value: CAEYASABKAIyCwiC5Yb0x-6UOhAFOAFaBmd1bWd1bWAC
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003%22%7D
.servenobid.com/ Name: pid_317
Value: 3018712670415424945
.creativecdn.com/ Name: u
Value: IxK4Am4b0eX031jwlNhe
.creativecdn.com/ Name: ts
Value: 1637142555
.owneriq.net/ Name: si
Value: Q6904289551340172358
.owneriq.net/ Name: p2
Value: cc
.criteo.com/ Name: uid
Value: 87443bd9-3835-4110-8798-147b496692b2
.servenobid.com/ Name: pid_321
Value: RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAwIT07DKaAAACj1jh67lw
.pubmatic.com/ Name: PugT
Value: 1637142555
.360yield.com/ Name: tuuid
Value: 857e617a-2dea-44e5-b335-0429974df9cf
.360yield.com/ Name: tuuid_lu
Value: 1637142555
.sportradarserving.com/ Name: zuuid
Value: 02706488-945b-4f0e-a02b-304be83e3758
.sportradarserving.com/ Name: c
Value: 1637142555
.sportradarserving.com/ Name: zuuid_lu
Value: 1637142555
.smartadserver.com/ Name: csync
Value: 22:641922670622144214|79:87443bd9-3835-4110-8798-147b496692b2
.sportradarserving.com/ Name: zuuid_k
Value: 1
.sportradarserving.com/ Name: zuuid_k_lu
Value: 1637142555
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-d44a0022-2cd5-4cae-9d35-f6c0b93c38f3-003%22%2C%22nxtrdr%22%3Afalse%7D
.openx.net/ Name: pd
Value: v2|1637142553.1.1|kiiygevNgun0.gqsLommOnsgi.j8mWfcsHqGiS
.analytics.yahoo.com/ Name: IDSYNC
Value: "1776~21kx:18wq~21kx:187s~21kx:194k~21kx:17ot~21kx"
.yahoo.com/ Name: APIDTS
Value: 1637142555
.postrelease.com/ Name: opt_out
Value: 1
.justpremium.com/ Name: jpxumaster
Value: um-f9c06b83-9992-4d5d-9f89-2265b8640e15-1637142555
.justpremium.com/ Name: jpxumatched
Value: ox
.erne.co/ Name: u
Value: wRK26hLPbSA1H9iSk3UOX1ON
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: a5c439746407c2d2
.technoratimedia.com/ Name: tads_uid
Value: GDPR
.outbrain.com/ Name: obuid
Value: 845a8404-0add-4ac7-b311-47249ef7235a
.onaudience.com/ Name: done_redirects200
Value: 1
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-70e0900b-6d09-46a0-6dae-0a6bd00455a5.s%2BneoKWRZmXEJFKG1WrA%2FtOgulzKCX6pLb07S2j68xA
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A0-70e0900b-6d09-46a0-6dae-0a6bd00455a5%24ip%24194.36.108.20.w6cxdnKlaAxPWQvMsqYQWOFq2WkaZObKMmnJPxMlWjM
.ipredictive.com/ Name: cu
Value: a026b47e-478b-11ec-b40a-db78886add51|1637142555456
.aralego.com/ Name: sspid
Value: d8be43cb-3d0f-3e4e-924b-00064c27cebb
.zemanta.com/ Name: zuid
Value: 6IQ6pfYfKqjS3-k1j6QQ
.casalemedia.com/ Name: CMRUM3
Value: 1f6194d01b05a00&986194d01b2760bfc8fe84-92e8-4e72-a838-dfb6dbca4460&f16194d01b05a0&2d6194d01b2760CAESEMaPnOK0FxAkUYq6vUwDOHw&c46194d01b05a0&516194d01b2760GztJ9Ek6QfkAOUShHz5dokhuE6YAbkakGz6JmH7K&e66194d01b2760&276194d01b0b40
.pubmatic.com/ Name: SPugT
Value: 1637142554
.servenobid.com/ Name: pid_335
Value: 053c5325f6bd427fb8718d80aceddde1
.liadm.com/ Name: lidid
Value: 49805f91-61fd-4628-8d03-e905d543387b
.go.sonobi.com/ Name: HAPLB3G
Value: s3528|YZTQH
.mfadsrvr.com/ Name: tuuid
Value: fb1c6933-e24b-40d0-b484-85d0af649749
.mfadsrvr.com/ Name: c
Value: 1637142556
.mfadsrvr.com/ Name: tuuid_lu
Value: 1637142556
.mfadsrvr.com/ Name: ssh
Value: !outbrain,1637142556
.outbrain.com/ Name: mdfrc
Value: fb1c6933-e24b-40d0-b484-85d0af649749

7 Console Messages

Source Level URL
Text
javascript warning URL: https://www.googletagservices.com/tag/js/gpt.js(Line 9)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/tag/js/gpt.js(Line 9)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111101.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other warning URL: https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://cdn.ampproject.org/rtv/012110042008000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1x1.a-mo.net
8019191.fls.doubleclick.net
a.omappapi.com
a.optmstr.com
a.rfihub.com
a.sportradarserving.com
a.tribalfusion.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
ad.turn.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
ads.yahoo.com
ads.yieldmo.com
adservice.google.com
adservice.google.de
ap.lijit.com
api.omappapi.com
b1sync.zemanta.com
bh.contextweb.com
btlr.sharethrough.com
c.amazon-adsystem.com
c1.adform.net
c2shb.ssp.yahoo.com
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cdn.contentspread.net
cdn.id5-sync.com
cdn.pushcrew.com
cdnjs.cloudflare.com
cds.connatix.com
ce.lijit.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
creativecdn.com
cs.emxdgt.com
d1o9e4un86hhpc.cloudfront.net
d2p6ty67371ecn.cloudfront.net
d2t794khe5w43b.cloudfront.net
d32r1sh890xpii.cloudfront.net
d5p.de17a.com
dis.criteo.com
dsum-sec.casalemedia.com
e.serverbid.com
e4a6536916d8cc5030263c61d7c637dc.safeframe.googlesyndication.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g2.gumgum.com
gift-connect-d.openx.net
go.sonobi.com
googleads.g.doubleclick.net
green.erne.co
gu.dyntrk.com
gum.criteo.com
hal9000.redintelligence.net
hal900024.redintelligence.net
hbopenbid.pubmatic.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id.rlcdn.com
id.sharedid.org
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
ins.connatix.com
jadserve.postrelease.com
match.adsrvr.org
match.deepintent.com
match.justpremium.com
match.prod.bidr.io
math-aids-tagan.adlightning.com
maxcdn.bootstrapcdn.com
mp.4dex.io
mug.criteo.com
mwzeom.zeotap.com
onetag-sys.com
openx2-match.dotomi.com
p.rfihub.com
pagead2.googlesyndication.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.33across.com
pixel.advertising.com
pixel.mathtag.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
pushcrew.com
px.owneriq.net
qd.admetricspro.com
r.turn.com
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb.openx.net
s.ad.smaato.net
s.amazon-adsystem.com
s.tribalfusion.com
s0.2mdn.net
safehaven.com
script.4dex.io
secure-assets.rubiconproject.com
secure.adnxs.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
simage2.pubmatic.com
simage4.pubmatic.com
spl.zeotap.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssp.adriver.ru
ssum-sec.casalemedia.com
stags.bluekai.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.aralego.com
sync.crwdcntrl.net
sync.extend.tv
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.serverbid.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
t.adx.opera.com
tag.1rx.io
tagan.adlightning.com
tags.mathtag.com
teachingaids-d.openx.net
tg.socdm.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
vid.connatix.com
web.hb.ad.cpe.dotomi.com
ws.rqtrk.eu
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
104.111.215.191
104.111.219.144
104.111.242.53
13.248.245.213
132.226.41.106
138.201.84.252
142.250.186.130
142.250.186.34
142.250.186.70
142.250.186.98
143.204.95.188
143.204.98.38
143.204.98.49
143.204.98.66
147.75.61.140
151.101.193.108
151.101.2.137
151.101.66.49
159.122.14.34
167.172.1.14
169.197.150.7
178.162.133.149
178.250.0.163
178.250.2.146
18.156.0.31
18.192.77.44
18.194.17.206
18.195.155.181
18.196.197.61
18.196.20.13
18.196.211.83
18.197.116.184
18.197.219.57
18.203.227.77
18.222.97.191
184.30.20.198
184.30.20.241
185.184.8.65
185.29.132.241
185.29.134.245
185.33.221.89
185.33.223.38
185.64.189.110
185.64.189.112
185.64.190.80
185.64.190.81
185.86.138.120
185.86.138.144
192.96.200.41
193.0.160.129
198.148.27.139
198.47.127.19
198.47.127.20
2.18.233.201
2001:678:cb4:bbbb::11
202.241.208.54
205.185.216.10
206.189.254.17
209.54.180.144
213.155.156.180
213.19.147.42
213.19.147.44
23.37.42.132
23.79.143.124
2600:1f18:444a:4602:2c20:3113:5c28:1366
2600:9000:2156:2000:3:442:6dc0:21
2600:9000:2156:b800:10:4f52:7800:21
2600:9000:2156:d600:1b:5138:8a40:93a1
2600:9000:2156:e400:17:eca0:da80:21
2600:9000:2156:fe00:c:5250:79c0:21
2602:803:c002:200::62
2606:4700:10::6814:3677
2606:4700:10::6816:1957
2606:4700:20::681a:9a9
2606:4700:3030::ac43:cf70
2606:4700::6810:125e
2606:4700::6812:372
2606:4700::6812:bcf
2606:4700::6812:c05
2620:112:f002:bbbb::21
2620:116:800d:21:51e4:db4b:4436:b305
2620:1ec:46::44
2a00:1288:110:c305::8000
2a00:1288:80:800::7000
2a00:1450:4001:801::2001
2a00:1450:4001:801::2006
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2001
2a00:1450:4001:811::2002
2a00:1450:4001:811::200a
2a00:1450:4001:812::2002
2a00:1450:4001:812::200a
2a00:1450:4001:827::2004
2a00:1450:4001:829::2002
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2003
2a00:1450:4001:831::2003
2a00:1450:400c:c07::9c
2a02:2638::1c
2a02:fa8:8806:16::1460
2a02:fa8:8806:20::2040
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.102.183.26
34.210.245.148
34.248.204.54
34.251.173.19
34.98.64.218
35.153.224.87
35.153.9.102
35.157.246.167
35.186.253.211
35.244.174.68
37.157.6.247
46.105.202.126
51.178.20.139
51.75.146.161
51.79.83.225
51.89.7.198
51.89.9.251
52.17.84.146
52.200.181.105
52.21.104.248
52.223.40.198
52.28.254.122
52.49.74.33
54.225.68.204
54.229.48.81
54.236.185.42
54.68.214.87
64.202.112.191
64.74.236.127
66.155.71.149
67.202.105.23
69.173.144.139
69.173.144.165
69.173.151.100
72.251.249.13
72.251.249.14
72.34.250.74
81.222.128.216
82.145.213.8
85.114.131.234
87.98.128.108
88.99.165.19
89.187.169.47
014f2fb8d253cee4da7966e085bf836310d85793e5ab4291489a6add2b123e6a
015b60e1b1ba7a981695787808ccf4ddd3f5d0111e57bf539ba95a35b4c59af7
026b66ba8fc2d845d86f280d24b2158e5184b14f3b484dec1e4fa7ee33e8022b
04439b4ea020c9b215b8c466b0ff5a2bff5c752c8450dd956b811b09f0f7137e
057dc6ee7532fb79e0642045112929f0dd827c70e6ee90e7eeda7d4de99c7c18
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06c0b9cd46f53c57c3ebc3531be56f50ca25c2bd7bb672eaa8b033c134957c6e
071ae33974e54b0b7586b5ecc94a40ab118f7df9a387f351231095b51aafe93e
079918885aba0d53fc91779b668295721d87d08b0244b06710c064f247e2e5b6
08da7c45cb204377e7e42249cda5713fa865116ddbb4cb5a1949b2e5b438a6ab
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0d1122b9392164ebc5e82b6600f8e579b1c2246b97ec3cf2e8e27886fb2d0ddb
0df7d9b36f573c68a2a18f201d4a1cbc60aa538f6213f7ddee6bb90e135a8a4f
0e267c1c08f41394bcb01ce851cc0a6a834741576f2c37e07eba58729b1ebfba
0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b
0fe506ebd2fdcccc4422de7d15b2137dbb73ff4aa74f02c74db27403b3481e9f
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1a477043f6ffa7aac547e5d3889e3c4569b57e38321fe2ccdd652ba27343eb47
1a7c32d8db742e1480f98057ec3486f455f6c4c5bc8cae79427d8bc35cf6d755
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1e9e614ccaf90d11329d6acab03126c195d911f9eee3513debcdb696cc713f0d
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
1efc74e10db1498e7e53885e69f4fdd2707e4c1590a4997464476b5f8b8fab1d
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
26d46b02656710d59021fddf76d7c4f851efb15c693e6f4ec072645207a47141
272f2c33dfc57d0546a017e4c1332f451296f5d719861e1ddddb1029cc6be048
284da3d2b11c82b2f5624dd0fad62bdcbe3b67a2a8687b00ff04e30deb17fd30
2974eb585cd805e63aac6982805c5ba28698efb09613699c03049df527bd8a84
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c048e8f59e18d3c16cd93bd66cf1b946f0a3c2ea7d8a40c78bd198c65217522
2d16b7dd1dd51de053865b8efbaa6362956026a068c2e8786740d8486dd7a9be
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27
2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d
2fb7d099213d904ed9af560fee2e724c8d4e2b0452dc81b4da09078f4b4b3425
31d5648df5eebdf3d492b355285870ced53b93143889c04edf9deb94357dd6e6
322548c867692bf85ca69b600eb86352b3398a82776acfe231dc31a855f1aa04
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3aab1d4681b3582c0eb091a210603be3cd50b8123631c802be06852b90a03e9e
3bfbb9ba774709a772a1304039f22e68a6868de1d408c84162454109121a1d21
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ebb37e8d84ad18d5076273ca7c1f6fcd24b6f7aa522c9d0d2438441b82b6e82
3f1912ff02efa15c167d148bf5381d3553ec91c6838e285adc1910ed3a7ea041
3f1babe7568891c073e5fc1e24a9caa4eeda5d276eb3eb3c9a0dccbe598a1bf6
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40c64c974b65ffdb2ab2e74777867f4ac23997321ca18e087f25239b2910a23d
40f877c857f0853ef32b188caddde5bbb7b916b051c4d0d1d3e0644405c30db5
43b631b711986dee34a566a7fd715b0345eea13e69771e4622b51a4181a69cb2
454cdb72d14efa43c2718af7420d281caf5bff5bb58778ad7d48341eceb3adf5
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
462da5681196228ae4ed1e3496df6075e199c79ad95227f6613462cfd32bea7a
48477fe19edb433f71fc3fa4a11b04aebfb8559550008da524a92d1ad94fb7fa
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
490c5de7a437b5992344d7aab01009ce5416d1d5b868b627d7e4211754feaa1b
4bc10602380ab8fefcaeaa51557f6809595821df8469fe39c2d8e438d1dce77a
4c7543adb08df72037fa41e361d3477fb3a018efc6da63ce50297d7d6ec6bb79
4c82af54e3b21398e7e63e673ace905792c262d07b82ef163976bb7437012b8d
4d0f3c00fd4cdd1fe64dfa1a9ece98d1bcf5640d2b704946f702d71d46f6b2ed
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2
52848570158d15712ef6e6c60c4aff269b85a737fa57336759e1015aa928b198
5462f2faffc0c97db3583d706890dcd7a45bf1d0b50d8728b784d03abd0f1270
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0
562106d01b6ad300bc1650fdf39073de8e2750ee330454c0ecf9c4bcc66287b6
594604c48df08a8fb7ee88f0971442f3bd2136b71aeccfabcc3cdca8c97880e5
59d84b5d4c5fb70a97d72f219027b74418234b2566b391115793f769e81e7ac5
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5d395f1d7b9526373af1bd107d3d973b17eb1be00fc9c67e5e6237aeabf4e60c
5f1d309077fe6ff1c8ca5e01d4d77080584b7587a6edcd9c17cf1358c79b9cac
604496ee6acca620cd59265c2302f6a03fe02d65bc5306d952f0fa94d92fa5c8
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
6766fcdfc44dbd8ca5c90eb5ac51e11ea5fffde9c723698f7c30f199db457a3d
698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79
69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174
6aba7347066660c96b92dfb152af283c56d48f747d9d99d0d8af612a3c58fa05
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c9a29d5877620bf729f6920b50466df6e2635d6cf6a7b3dd7bc7ec4f361bda4
6d0dbaafdbbf1d3f9334bffc7cf32213e7eeac013648dbbf947144d32b22993c
6f13443056f1ee2b4a7d5b865aa59fc1c4172cc9e08704203b2898a7954e6994
70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78
71ebaa7b30e6256d69d1da136962215a233d0535e2dc67ce3315e59852e5f576
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
7511782a904a1bd83ae7e9b2d676c13f6e311b06c159dda26321ab6b533372b1
77c0d53ad7a44dadf518e9960ec49dd00fa3859ecbaf646bb215d33e0b5f4658
7853ef14abb631943ddbae7ea2b301e44bf8ffc7b13fed0a8c36bbd09da6370f
7887765805505fd68b6855690d81b1533dd991da072c52d9777365a51b2a9ae2
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79b15b95bca31b2109d327202b9c538e9e5dd2ed85db0ad00bff927f6568497c
7ac96b7b4ad3f59ec56a4a3d52de2ca8bd232958da976a390ea4623a698c8025
7c67dc1e9ecce0d3757d97792fd606effaa6fe799ebe7423aff81e26e07900a1
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
807032880f7f3db70133f4a9d1507882124d2b22c804b138a9313ef4657332f3
80ef7b6efb5000c4b08bf102a339cf202d9ff1f070d7f260a845a846b339c081
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
875e2b6d2299842e7907dfbd11e834f1b62bb3c1adf5eec1a411b6c2cd932aff
898340526854f0b2e4dc972e311c312d3e68346fbb5477f0dea423c2c68ee28c
89a812c4e8107b708f59734c3467e56f57a002316cd730d82a06a02a8beaf8f8
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8acbc8c200acac076a24c08c6c095af3402dec73c1ed98eb48d8f6a2a54f3e5b
8d62b3ddb334d9db94dcbf6a6711a817daf96895573155b159d5d37d7a893cd8
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d
943d885541626ba4f42af73f1766356a3e3368d4588ea6f92d00cca05839572e
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9
973fe12f5130be123a73261e3956030b8a1c380f8cd8234e319b51bda6892898
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9def9010777d9b94bef87624b66760e86ec040c7889ccb80dcb0c36ab56e2ac5
9e5d8ecb3c8a58c2e27da6415c2903f5feb9f1e16fb4237b0e8a96acb9a9517e
9ecc12da9fc6548f1c3e5e6c5ce43feafd0e8181d7bdb1160f17a2b625077093
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a355508d811ac666d1b61e566f7f1daf5d39b8915c036b271f14a4cfb9247ac3
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a52cd2d88d3522e5c6d1e25f3944d2ec9072832b5ac81d13c3660963ff7bb3d7
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9043e96494c98c79f94ffcfb0fd22cc86023845637a621cff2beb0637320594
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa112d3656c8057c4e2c666dd560b14e45801e6ac3e2ca71bb843f49764d051b
ab3a9a2021b209f2ae112593fdac147baca1e5beca4b28f8d188c8f83d2e870e
ab71592cd90f248b86e7d1d717b1aa927ccaec516314322bd20fe1f13f5fc969
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ab82123bc03074522b22b00cd813f18651b82d035a16769296af893d231e1b58
abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107
ace317a10de8eeccc322d1c5b4b320d21665fefcb5f7b23e2558bf521fa1a2ef
ae1a453845c84c98108ca80bb5ea461210500d404db9d0906d78bc99aa5bffba
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
b11734511d68c3bcccae0646b415fff85a898d192a6130021bf1547b3d68bd26
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b18e90729452c8796f604d2f022f8b1e259a28e648c8ce9b7e06dbab25ad3eb8
b1d61643441ce36e671005211e1abc289354a0afb6170f84fcd5f2e7a7626f83
b227b4c931fa403fa96046f4afdda7212df6f0d2d1253e15ca4d60a59f1aad98
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b47100ebc4ff018fe95d6ab97131fedceb1f832528b985862613702f8502f77f
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b5ff995a266d426a876a1d9cb5a1bdc9b3926969758255253ef5a46a419fa501
b64fe9b742eecd866f22a4b4b2fb4083b1ccaa39dac51c17a19f7db1fee5245c
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29
be32eb2045a4d0a5eeb1fbe7a87ec822ba313b1f8c5f3faf2f31ee8235dd3486
c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c4203636462bb1fb653e6291e7ddc1bcd65d40334e5a6a6f92c90d01f1edc51d
c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8
c6f02ea61b580dd0d3d5fd8b473d8584ab32e741a5a969704928df2d2753a44e
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517
caa2dc8bcd978c8252652981e5de0ebccc280c17fbd94690dd95b85bba6e6e16
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
cf09dbb7d0ce6a73b4e49f9981dc5fc5654ecaee41e1818700e1c03c5bb90e8a
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d26977165f9edb920afa98e2ebbbf41bef724dd8dcd237fddc67c272d0cee522
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d2cc0f3e4ea2ee9d228c72c169c055a37137fdcdb0746508d3debd1f62997159
d5e492d4926219990952d0609ebce118aa3eb6d487a475be75c4090c71df220a
da913c5532c512206c7eab6fd77ce0027e07e533dd3c66db8a1d9486c531f5a2
db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59
dbf2e1b1d010d35327ee2a592e7a407416b108523b17c170e71e251fb5cefcef
dd12df38bb6d5e83053655d3a5d81a7166743b7e3bdb1f8cd38b3b556b515801
ddd0010a6f9f8edd8b545aa47b63a3ace7f81621e62c8b2b9e5453e326946576
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
e06757b0c9c78ec82a13a503d1f6a636d3a43081127fa0c6d5191350f3ae193c
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
ea96defa8284ab6fb47873d08324707fce48164694963421492e0c91573dbda6
eac86e17b35bae1ea30e105d8e49043932b115fb3a1f788e39e52b281c7514b7
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
ecd43d3f9c7f276c7cf3d90585d619704354539e0a36603507ac18580c08f2d0
ed3294322cb245eb7ee81b1cd441720860432d52c4d5309e8fa8fad356a51b84
eda2aee5525646e369b66c1cad37ef06ae16de16c01ce66770174ff8d60f54a7
edefa0e43fe019265a85f3510611b5ac610a960183a56011d082f460534b9c9f
ee5dca1e672f0b7ba2efe4e74d840b0e952e112dbff5dc4f618d68bf784c5f63
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef519d2e2741df82a3253cd4ce21f46948002e3802e4a7e289f9d6af927061fa
f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458
f1cd7af19bcd11c1f6bb50fc983f4be9243d8c3b8824cc5c343d5bd6763da513
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
f3dfe594f4ecc5815c63bb8a09a5bb89316f2670b5cb02cfa641b57aad0cf11f
f3efe7c9d1b4d0b24972d468f207b5740736aebc4bb8261b1eea596b061d28cd
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f703558ba0775d2e086b87476601a8c133c12fbb46b7833efb9571f3afedfae0
f95ada7af6f826b6e26557a190aeb4edc50680f6cc0f40b69e12be03aff38471
f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c
f9e3ddba5ad2bb502390e53180c9c20c1c3ebbb7e5068ea09c9a37aaaf5b138e
f9e4c4b88023cda76eef99379a6ba0a289294528f488859685258d60b46770b8
fcf499df09369ff1e215f83bd5504683e1a2a472f8ab1365d7c663e63bc9603f