cl.login-vp.com Open in urlscan Pro
139.177.207.225 Public Scan

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 05:52:04 GMT
x-content-type-options: nosniff
age: 453971
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Sep 2022 05:52:04 GMT

GET
H3 200 fontawesome-webfont.woff2
login-vp.com/fonts/ 63 KB
64 KB 679ms
662ms Font
application/octet-stream 172.67.206.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://login-vp.com/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: login-vp.com
URL: https://login-vp.com/css/font-awesome.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.206.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Request headers

Referer: https://login-vp.com/css/font-awesome.min.css
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
cf-cache-status: MISS
last-modified: Fri, 20 Mar 2020 06:40:08 GMT
server: cloudflare
etag: "fbd0-5a1438e7580d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kS26gtC0wn2kzrsk7qwfBmI0tq5y8T5jGXCRCrgrXOyl3iWf92nRUAJGtnjRRTB8%2FYm%2Bxc%2FLUe3LyH9dUqjU3MkJb0zqBp7hWjoMBZs8CR67L1qp0dJVBBWZLir1XO8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 68e133e52996412c-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 64464

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 49ms
13ms Font
font/woff2 66.102.1.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 07:48:56 GMT
x-content-type-options: nosniff
age: 274159
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Sep 2022 07:48:56 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 60ms
25ms Font
font/woff2 66.102.1.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

xx-fbcdn-shv-01-otp1.fbcdn.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 10:00:37 GMT
x-content-type-options: nosniff
age: 7058
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 10:00:37 GMT

GET
H3 200 in.png
login-vp.com/flag/ 503 B
1 KB 23ms
23ms Image
image/png 172.67.206.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login-vp.com/flag/in.png
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.206.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0aa7543328f3fddde96ab8fc7e3a8b85732de57de6e84447b22964971f399f28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1543
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 503
last-modified: Fri, 20 Mar 2020 06:39:36 GMT
server: cloudflare
etag: "1f7-5a1438c90bb43"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AUsbLpQgCrwBVEThr%2BEG5KUbCW%2BOc2Oc%2BRMkrmYJxivakff8NogMdFK%2FcU1HZi2JxJRwkL4ardH%2FImRqsxo3%2FychRbj4tP2M6qjlCtpH2cE7bPtv59YI4izY8dBnqOQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 68e133e59e744138-PRG

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4694c6e8eeb7ffee1e79a09c8eec2b07a0a7988ce945f86bee4b4c9729042df5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8aa6f88b7ada8cc64e9eb56178d6b2100eafe0ab6e06b7f4ab112694eb03b5ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 14 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3afe99f0ccc5c29e3e4584b9940a152396e67e864eebf079dddc55cf80134633

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7926d56f4204b8e92669142c87d6d00cd383931bb09d0d65d4ec30fc1295942

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 227 KB
67 KB 72ms
35ms Script
application/x-javascript 185.60.218.24
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=7744f45484b486a7bca86352e94defe7

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.24 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

353d80f84dbd4603b559a9d9619f78212031bfb68dfdc7152a3c26df1a4139f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cl.login-vp.com/
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: PE5L7KdelWh4oihW9UJ7fw==
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68293
x-fb-rlafr: 0
x-fb-debug: uiV7tCw8UHK/LJkxSmGavjub8kTBS8sdr6V2Crl8mdG5nPjosGBHY6RwGxO67Yp08LoGPHfKokYyV7cPj4YNZw==
x-fb-content-md5: 38eee61e8ba95560c76e6a58e4df3b27
x-frame-options: DENY
date: Mon, 13 Sep 2021 11:58:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "30a3522f2f916459bf53347e51e9fb84"
timing-allow-origin: *
priority: u=3,i
expires: Tue, 13 Sep 2022 09:58:37 GMT

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b0a5aaf14aa32cd33b3cef90cb5afa90d920d153c29636a37a2fa849346b98c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 26e9c7be04781a18b701ff647169999109779fe4b651ac0a82bfbaacfc283e1b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 elogin-db-stamp.png
login-vp.com/ 14 KB
14 KB 23ms
22ms Image
image/png 172.67.206.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login-vp.com/elogin-db-stamp.png
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.206.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d86e98e5c29e7a6cda4fe7a8b623dd49ba415cc072066f09de985adbc322d25b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6386
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13969
last-modified: Mon, 23 Mar 2020 08:48:46 GMT
server: cloudflare
etag: "3691-5a181b403ac8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QR%2BbMeQTwCdhCeS9mf3tAE8N7Q2Z65qNvs%2BWKu5FZAxH%2F0uyFiyVqP1noanCzu%2FhYyW6NS4KYgEggNUpHSOpiivCbgeCweILpHsEwYAdWh3KVe0%2FG8%2BOKUoYP40M%2F1c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 68e133e63f414138-PRG

GET
H3 200 jquery.min.js Show response
login-vp.com/js/ 86 KB
32 KB 39ms
39ms Script
application/javascript 172.67.206.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://login-vp.com/js/jquery.min.js
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.206.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6386
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 20 Mar 2020 06:40:05 GMT
server: cloudflare
etag: W/"15851-5a1438e49b5e3-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7rrU0lsEKRHLqRw0IGvoGBQhSFL9fKeQSLYQXi4lyzmFpBkPkIwetGOrKREf5q2Z73ghM0bh8Z77EanbCHqpu6D%2FRMxEE5xkd4p71wbZLSuYVeN%2F2ZvmKOvcKeB90fs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 68e133e63f424138-PRG

GET
H3 200 bootstrap.bundle.min.js Show response
login-vp.com/js/ 77 KB
23 KB 37ms
37ms Script
application/javascript 172.67.206.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://login-vp.com/js/bootstrap.bundle.min.js
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.206.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6386
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 20 Mar 2020 06:40:05 GMT
server: cloudflare
etag: W/"1332b-5a1438e4a451d-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T3g%2FoJ7d3kQGwo86bjf5BnEaVQINH5zYQkKPJgPlcaO%2FZ%2BpqoB4HFdjZzjOXUYEoI6vZaLhGj7ne3Pm0QBnjYCzKNwvo1Immv3AxR%2B%2FZWhaz5TbvNgOS37QDzLdlOQA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 68e133e63f434138-PRG

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 546af585ac7b7119b375426c1994ddd73a9f98f7232c1e46cd4512d1bebdda29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2c40ccb06118d5b6da589b802deb8827599eb4cbc544d7dc06369343c32b4db4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 / Show response
a3.pubguru.net/ 140 B
437 B 36ms
8ms XHR
application/json 18.196.21.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a3.pubguru.net/?device=desktop&domain=login-vp.com

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.21.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-21-34.eu-central-1.compute.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

174bd92744fdfe257addae62abdb06a524fbda3306a029c96c9cc2bfdd7ae1e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
access-control-allow-origin: https://cl.login-vp.com
x-frame-options: DENY
content-type: application/json
x-m2: 1
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true
x-duration: 0
vary: Origin
content-length: 140
x-xss-protection: 1; mode=block

POST
H2 200 stream Show response
a3.pubguru.net/ 2 B
352 B 19ms
9ms XHR
text/plain 18.196.21.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a3.pubguru.net/stream?beacon=immediate

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.21.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-21-34.eu-central-1.compute.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
access-control-allow-origin: https://cl.login-vp.com
x-frame-options: DENY
content-type: text/plain
x-m2: 1
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true
x-duration: 1
vary: Origin,Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 71 KB
25 KB 70ms
23ms Script
text/javascript 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f154.1e100.net

Software

sffe /

Resource Hash

e1a6bca0134c530d141223bcc0cc7b0f42482acb50c90269dc4741e80a594bce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "985 / 0 of 1000 / last-modified: 1631531382"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25098
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:16 GMT

GET
H2 200 pubads_impl_2021090701.js Show response
securepubads.g.doubleclick.net/gpt/ 333 KB
117 KB 28ms
21ms Script
text/javascript 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f154.1e100.net

Software

sffe /

Resource Hash

ac8d2f2be577b89fdbd26a497ece0c0bc127dd2ed5676119e0055b62e4daf48e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 08:38:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 119497
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:16 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 139 B
733 B 50ms
17ms XHR
application/json 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=cl.login-vp.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed4cc0ce519abcf5f8710c9969c2d6961ac354a347ded16146251a1a3f173453

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 13 Sep 2021 11:58:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 105
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:16 GMT

GET
H2 200 23081961 Show response
fundingchoicesmessages.google.com/i/ 93 KB
35 KB 192ms
53ms Script
application/javascript 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/23081961?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c57c7956d787069bbad645fc1c856f6181cb86c15dd8320d1c91fbf15162de6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zYQhloy30a6ajFc7MqBWRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-zYQhloy30a6ajFc7MqBWRw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorServingWebSwitchboardHttp"
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorServingWebSwitchboardHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorServingWebSwitchboardHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: script-src 'report-sample' 'nonce-zYQhloy30a6ajFc7MqBWRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-zYQhloy30a6ajFc7MqBWRw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxV-zw-F23zONzTTflPQoIgHtnGEXwzSOTQhBr5Hs5np85_ctTvfkL38Jp864QCDDKu5Dd142P22bXnajhJCymk= Show response
fundingchoicesmessages.google.com/el/ 0
26 B 53ms
26ms XHR
text/html 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV-zw-F23zONzTTflPQoIgHtnGEXwzSOTQhBr5Hs5np85_ctTvfkL38Jp864QCDDKu5Dd142P22bXnajhJCymk=?pvid=4133694C-974A-4A2A-AC7F-1FD033D762E8&anonid=DCE6DB3A-504E-49C4-AFDB-7E2AD7F6E5C3

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.de.KiQvK_SNewk.es5.O/d=1/rs=AJlcJMwllTyluRqLaHXDUePiis_3uxG8Cw/m=loader_js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rmvo60VEOumGuhZd9QI/Dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-rmvo60VEOumGuhZd9QI/Dg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-rmvo60VEOumGuhZd9QI/Dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-rmvo60VEOumGuhZd9QI/Dg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxVrLRzVIWAZlNVc7C5t64tS9_sCGKwft-N5sta6gKpvO1_i5qxmdYtPOA_gLb41lFWWR3pqil-bMioqVxGh9h0= Show response
fundingchoicesmessages.google.com/f/ 63 KB
24 KB 78ms
51ms Script
application/javascript 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVrLRzVIWAZlNVc7C5t64tS9_sCGKwft-N5sta6gKpvO1_i5qxmdYtPOA_gLb41lFWWR3pqil-bMioqVxGh9h0=?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCwyLFsxNjMxNTM0Mjk3LDExMjAwMDAwMF0sIjQxMzM2OTRDLTk3NEEtNEEyQS1BQzdGLTFGRDAzM0Q3NjJFOCIsIkRDRTZEQjNBLTUwNEUtNDlDNC1BRkRCLTdFMkFEN0Y2RTVDMyIsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL2NsLmxvZ2luLXZwLmNvbS9yb2Jsb3gtZmFjZWJvb2siXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.de.KiQvK_SNewk.es5.O/d=1/rs=AJlcJMwllTyluRqLaHXDUePiis_3uxG8Cw/m=loader_js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fc68f2fa8334bc92f3cae01397eed1593389170190219635799517fec6d5af42

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hIqX8qkaZbTWwg9qTDfoFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-hIqX8qkaZbTWwg9qTDfoFQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: script-src 'report-sample' 'nonce-hIqX8qkaZbTWwg9qTDfoFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-hIqX8qkaZbTWwg9qTDfoFQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 stream
a3.pubguru.net/ 0
0 22ms
7ms Ping
text/plain 18.196.21.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a3.pubguru.net/stream?beacon=test
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.21.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-21-34.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://cl.login-vp.com
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true

GET
H2 200 tc-modernizr.js Show response
cdn.pubguru.com/ 55 KB
21 KB 9ms
8ms Script
application/javascript 99.86.4.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pubguru.com/tc-modernizr.js
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-77.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b78222040390c142b5db713e2056cdce01d935a8a289fba890281a4867dddda1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: wK1yK.seBcNMdh0KRrdWih.NVUUalRr_
content-encoding: gzip
last-modified: Fri, 15 Jan 2021 14:02:53 GMT
server: AmazonS3
age: 16015
etag: W/"7397d6933f0607215d5803ac483dccf0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c5.cloudfront.net (CloudFront)
date: Mon, 13 Sep 2021 07:31:24 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 6J-XrOoktS2gBjOBoLlgu5_9H8IpDnHKyB5BRmfgSy8OO7scHoocxg==

POST
H2 204 mvo Show response
tag.1rx.io/rmp/237177/0/ 0
171 B 57ms
20ms XHR
text/plain 213.19.147.42
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/237177/0/mvo?z=1r&hbv=3.3,2.1
Requested by: Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cl.login-vp.com
pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 138 KB
49 KB 61ms
27ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

584da571f67b1e738befcc9acc3412dcb324f43ac172257ee967b6ba8e11621e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49434
x-xss-protection: 0
server: cafe
etag: 7772695300083110601
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 13 Sep 2021 11:58:17 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 129 KB
51 KB 57ms
22ms Script
application/javascript 173.194.76.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LFL5HW1V30

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8b716a67ac9e8d33385526933248a7574938bbe3c7a05eb040b5a2a09a728f01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51739
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:17 GMT

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 497790947d4666760ce38f3c00e852c71fdb66cae849bae8e9ede352719e1581

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 51ms
17ms Script
application/javascript 64.233.166.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cl.login-vp.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.166.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wm-in-f155.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
0 19ms
16ms Fetch
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=tagging_dupdiv&b=2&dp=20

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 61 KB
17 KB 2040ms
2026ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=596249320331672&correlator=3949354234299796&output=ldjh&impl=fif&eid=31062367%2C22316437%2C31062523%2C31062297&vrg=2021090701&ptt=17&gdpr=0&sc=1&sfv=1-0-38&ecs=20210913&iu_parts=23081961%3A21709746915%2Clvp_sd__sticky_right_desk&enc_prev_ius=%2F0%2F1&prev_iu_szs=120x600%7C160x600%7C300x250%7C300x600%7C336x280&prev_scp=m2_pageview%3D10483-210908-e2c%25400%26m2_session%3D10483-210908-e2c%25400%26m2_canonical%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_canonical_session%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_config%3D10483-210908-e2c%25400%26m2_stack%3Denabled%2Cadx%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F%26m2_tc%3Dtc-init%26m2_pid%3Dgb-adsense%252F%26m2_bidder%3Dgb-adsense%26m2_size%3D300x600%26m2_adid%3D28e1c740%26m2_pb%3D0.01&cookie_enabled=1&bc=31&abxe=1&lmt=1631534297&dt=1631534297298&dlt=1631534295707&idt=1118&frm=20&biw=1600&bih=1200&oid=3&adxs=1005&adys=2618&adks=4294809664&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&vis=1&dmc=8&scr_x=0&scr_y=0&psz=380x4365&msz=350x0&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

431f0618ac803d9e033b853a55feb659da8da0d62c0440e5826ed182194b1690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17868
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7DEA 6 KB
3 KB 76ms
14ms Document
text/html 173.194.76.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 13 Sep 2021 11:58:17 GMT
expires: Tue, 13 Sep 2022 11:58:17 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 12 KB
7 KB 2885ms
2872ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=596249320331672&correlator=3949354234299796&output=ldjh&impl=fif&eid=31062367%2C22316437%2C31062523%2C31062297&vrg=2021090701&ptt=17&gdpr=0&sc=1&sfv=1-0-38&ecs=20210913&iu_parts=23081961%3A21709746915%2Clvp_rectangle_atf&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&prev_scp=m2_canonical%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_canonical_session%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_config%3D10483-210908-e2c%25400%26m2_stack%3Denabled%2Cadx%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F%26m2_tc%3Dtc-init%26m2_pid%3Dgb-adsense%252F%26m2_bidder%3Dgb-adsense%26m2_size%3D300x250%26m2_adid%3D920cbdc5%26m2_pb%3D0.01&cookie_enabled=1&bc=31&abxe=1&lmt=1631534297&dt=1631534297303&dlt=1631534295707&idt=1118&frm=20&biw=1600&bih=1200&oid=3&adxs=1005&adys=322&adks=3317464499&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&vis=1&dmc=8&scr_x=0&scr_y=0&psz=380x4365&msz=350x0&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ab5cb7fa96fb281c591c670f860095231f959da69f4d2746b3daa2f30578e72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7104
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 50 KB
16 KB 1176ms
1163ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dadbcb25aac0f6e4d3ca22f6b23fb7a8fc444cbf6f7605b91d74727c89355098

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16778
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 683ms
671ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82e59aad0009a494115f2c43bde808e6ddf8bbeae579088226fab747eac2571f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9740
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
10 KB 1598ms
1586ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12510ad6ad1be2b014bcd3bef7e8ad0a9b603934aee46dad3fa203ae91a49f7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10604
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 105 KB
27 KB 3244ms
3232ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=596249320331672&correlator=3949354234299796&output=ldjh&impl=fif&eid=31062367%2C22316437%2C31062523%2C31062297&vrg=2021090701&ptt=17&gdpr=0&sc=1&sfv=1-0-38&ecs=20210913&iu_parts=23081961%3A21709746915%2Cpg_interstitial_login-vp.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ists=1&fas=8&prev_scp=m2_canonical%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_canonical_session%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_config%3D10483-210908-e2c%25400%26m2_stack%3Denabled%2Cadx%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F%26m2_tc%3Dtc-init&cookie_enabled=1&bc=31&abxe=1&lmt=1631534297&dt=1631534297309&dlt=1631534295707&idt=1118&frm=20&biw=1600&bih=1200&oid=3&adks=1981540020&ucis=6&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=false&fws=2&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e62930645b51e54bffede14573c71614fa3571ae6e0078b4d8e44472f24d3532

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28081
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_page_level_ads_2021090701.js Show response
securepubads.g.doubleclick.net/gpt/ 39 KB
14 KB 28ms
17ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021090701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-196-21-34.eu-central-1.compute.amazonaws.com

Software

sffe /

Resource Hash

efd71524bcffdd2f2a5854f34f1f9d2e867aea3566829b200fc8d58b6ddfbc9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 08:38:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14158
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:17 GMT

POST
H2 200 tc Show response
a3.pubguru.net/ 61 B
356 B 15ms
15ms XHR
application/json 18.196.21.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a3.pubguru.net/tc

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.21.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

7106fc7a8a57bd3515049560e573cb31911735db6d9fef39321b159ffe24d50d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
access-control-allow-origin: https://cl.login-vp.com
x-frame-options: DENY
content-type: application/json
x-m2: 1
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true
x-duration: 7
vary: Origin
content-length: 61
x-xss-protection: 1; mode=block

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
8 KB 3043ms
3043ms XHR
text/plain 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=596249320331672&correlator=3949354234299796&output=ldjh&impl=fif&eid=31062367%2C22316437%2C31062523%2C31062297&vrg=2021090701&ptt=17&gdpr=0&sc=1&sfv=1-0-38&ecs=20210913&iu_parts=23081961%3A21709746915%2Clvp_sticky_footer_desk&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C1x1&prev_scp=m2_canonical%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_canonical_session%3Db8d241e55188f43ac2d37139ad35a9e7%26m2_config%3D10483-210908-e2c%25400%26m2_stack%3Denabled%2Cadx%26utm_term%3D%252Fempty%252F%26utm_source%3D%252Fempty%252F%26utm_campaign%3D%252Fempty%252F%26utm_content%3D%252Fempty%252F%26utm_medium%3D%252Fempty%252F%26m2_tc%3Dtc-init%26m2_pid%3Dgb-adsense%252F%26m2_bidder%3Dgb-adsense%26m2_size%3D728x90%26m2_adid%3D96d1ff39%26m2_pb%3D0.01&cookie_enabled=1&bc=31&abxe=1&lmt=1631534297&dt=1631534297496&dlt=1631534295707&idt=1118&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1510&adks=171477963&ucis=7&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x4521&msz=1600x-1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=false&fws=512&ohw=0&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d1cf86eca4e6640859ade0123a6d2380bdb23d0cc3a4d8c36cd32b77bf1d41f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:20 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7852
x-xss-protection: 0
google-lineitem-id: 5762080543
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138359697082
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 90 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/webp

POST
H3 204 AGSKWxVCtg2SWE-vRgB_n7aFoX0kwXKiasyPn8PKJ9LBrYrBMN2EyBvMmOLfgIkydFr9vXlq2ilB06Pvhl_Apa6EJ6tRer91L96_yw5xlzoUw1Kot9wQdbG3wZzjVO_JKskRgoUqdlcMHjwVoJSiDQGh9p7P2qcMoBkH7yV15p94HAiCdgV7ZW-7pw3fcVX2 Show response
fundingchoicesmessages.google.com/el/ 0
26 B 25ms
24ms XHR
text/html 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVCtg2SWE-vRgB_n7aFoX0kwXKiasyPn8PKJ9LBrYrBMN2EyBvMmOLfgIkydFr9vXlq2ilB06Pvhl_Apa6EJ6tRer91L96_yw5xlzoUw1Kot9wQdbG3wZzjVO_JKskRgoUqdlcMHjwVoJSiDQGh9p7P2qcMoBkH7yV15p94HAiCdgV7ZW-7pw3fcVX2?dmid=3f55eae8a0803d31

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2SignalJs.de.hUbKalM9mTs.es5.O/d=1/rs=AJlcJMzYP9dj22-r2NXKXr4t1o14-uYV2w/m=iabtcfv2signalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4YGZwH+Nrl2SxaCcB1hvOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-4YGZwH+Nrl2SxaCcB1hvOQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-4YGZwH+Nrl2SxaCcB1hvOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-4YGZwH+Nrl2SxaCcB1hvOQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxVkMXlUOk8japFINywTYsutA4c6dgV_uzVtx41YIysAHIFKK7xcpP3DxoY_1iX9t5u9TRxeu0-H35ZFlfx5rnfXOCZcq6aYUkCARB034DJlRI7RAqkZMuP53-2LrROMHBpFxciThOTqM-sa5iX65UjKHxFuVl-iymIaG9MKPZspWvr7_TlwPz20hZ68 Show response
fundingchoicesmessages.google.com/f/ 85 KB
31 KB 50ms
50ms Script
application/javascript 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVkMXlUOk8japFINywTYsutA4c6dgV_uzVtx41YIysAHIFKK7xcpP3DxoY_1iX9t5u9TRxeu0-H35ZFlfx5rnfXOCZcq6aYUkCARB034DJlRI7RAqkZMuP53-2LrROMHBpFxciThOTqM-sa5iX65UjKHxFuVl-iymIaG9MKPZspWvr7_TlwPz20hZ68?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCwyLFsxNjMxNTM0Mjk3LDU3MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyXSwiaHR0cHM6Ly9jbC5sb2dpbi12cC5jb20vcm9ibG94LWZhY2Vib29rIl0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6e044b105f3c964097de4f2ed220e9c1c7b64a4fb80c3e38332e1a65cf90cee6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ciqZNfaYX/TKNy8Y/VZiFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-ciqZNfaYX/TKNy8Y/VZiFQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-ciqZNfaYX/TKNy8Y/VZiFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-ciqZNfaYX/TKNy8Y/VZiFQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
988 B 89ms
35ms Script
text/javascript 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en-US

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.110.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

34cfd57fc39d692c79b8c064a386331687ac463dc45cfdfa2341437f07fe8497

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Mon, 13 Sep 2021 11:58:17 GMT

GET
DATA 200
OK truncated
/ 47 B
47 B Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad0dd5091814006e1986ba74f2492e12582594b1eca2221174c22a1ad10ad98c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: text/javascript

GET
BLOB 200
OK 8349e610-85a5-4af6-ba44-0c3fa89e26ce
https://cl.login-vp.com/ 47 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://cl.login-vp.com/8349e610-85a5-4af6-ba44-0c3fa89e26ce
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad0dd5091814006e1986ba74f2492e12582594b1eca2221174c22a1ad10ad98c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Length: 47
Content-Type: text/javascript

GET
H3 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/ 251 KB
93 KB 47ms
31ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cadedca735c6ec45885014e69884b741d9ef44349cd95c9271ae066216d49f6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95406
x-xss-protection: 0
server: cafe
etag: 12270461373536854434
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Sep 2021 11:58:17 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/ Frame 4264 10 KB
5 KB 19ms
13ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210908/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 13 Sep 2021 08:33:46 GMT
expires: Mon, 27 Sep 2021 08:33:46 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 12271
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 collect
www.google-analytics.com/g/ 0
368 B 74ms
29ms Ping
text/plain 74.125.71.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-LFL5HW1V30&gtm=2oe910&_p=1839197286&sr=1600x1200&ul=en-us&cid=1282964859.1631534297&_s=1&dl=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&dt=Roblox%20Login%20Facebook&sid=1631534297&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LFL5HW1V30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f100.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/ 340 KB
133 KB 88ms
31ms Script
text/javascript 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en-US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e4f76389625a4e86c8328c2d1e01de5e3bb22dfd06edb9873313a6da47e4e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Origin: https://cl.login-vp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:54:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135849
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 17:56:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:54:14 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 202 B
409 B 68ms
42ms Script
text/javascript 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=cl.login-vp.com&callback=_gfp_s_&client=ca-pub-6983341711079297

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f154.1e100.net

Software

cafe /

Resource Hash

ec69461b05a134f5526befb60a6278b5965d5e853afccc5a48c2f9893890a03c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 193
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 34ms
33ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&tn=DIV&id=m2_bot_captcha&cls=pg-modal-blackout&ign=false&pw=1600&ph=1200&x=0&y=1060.8

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 35ms
34ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&tn=DIV&id=m2_bot_captcha&cls=pg-modal-blackout&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 112ms
34ms Script
application/javascript 64.233.166.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cl.login-vp.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.166.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wm-in-f155.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 412A 20 KB
1 KB 94ms
94ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&adk=1812271804&adf=3025194257&lmt=1631534297&plat=1%3A16777216%2C2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297608&bpp=2&bdt=1901&idt=130&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7097293150838&frm=20&pv=2&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=8&uci=a!8&fsb=1&dtd=146

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eadbe73ac70016d422c457eb9457f173f63c7d05dccd3b76bf55d227d356fa3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&adk=1812271804&adf=3025194257&lmt=1631534297&plat=1%3A16777216%2C2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297608&bpp=2&bdt=1901&idt=130&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7097293150838&frm=20&pv=2&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=8&uci=a!8&fsb=1&dtd=146
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 13 Sep 2021 11:58:17 GMT
server: cafe
content-length: 1140
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 13-Sep-2021 12:13:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 13 Sep 2021 11:58:17 GMT
cache-control: private

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 29ms
29ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74696de7db3cfc983f841facfdca75dbf4c114af467b05e23fe6d95694cab0fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273431406706"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27627
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:17 GMT

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 8A51 40 KB
20 KB 64ms
34ms Document
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&co=aHR0cHM6Ly9jbC5sb2dpbi12cC5jb206NDQz&hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&size=normal&cb=9e9lunb43p0r

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.110.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1181073af2e97db9753b99543b8b0134f88ac5281e9d85665747ed814e8b012b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-R8cFx0iO8SHziveMUu/LmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&co=aHR0cHM6Ly9jbC5sb2dpbi12cC5jb206NDQz&hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&size=normal&cb=9e9lunb43p0r
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 13 Sep 2021 11:58:17 GMT
content-security-policy: script-src 'report-sample' 'nonce-R8cFx0iO8SHziveMUu/LmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20800
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 23ms
23ms Script
application/javascript 64.233.166.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cl.login-vp.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.166.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wm-in-f155.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 13 Sep 2021 11:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET ads
googleads.g.doubleclick.net/pagead/ Frame 3790 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame D6A5 0
0

GET ads
googleads.g.doubleclick.net/pagead/ Frame E701 0
0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9249 15 KB
9 KB 684ms
684ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

393bca3930501ec8fd2509e485cd44a0f2e304d90c8de900b24bb1138ad7482a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 13 Sep 2021 11:58:18 GMT
server: cafe
content-length: 8954
x-xss-protection: 0
set-cookie: IDE=AHWqTUl0VXww5jnEHq0JJhFVIfudryV1ABy8DANKEBrWwrHC-PQM6uaJMA0sBTRr6-w; expires=Wed, 13-Sep-2023 11:58:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 13 Sep 2021 11:58:18 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0B08 69 KB
27 KB 650ms
649ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a645a737d17317a5b3d44c199497ef26fd94c393c74aebd758b22851542010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 13 Sep 2021 11:58:18 GMT
server: cafe
content-length: 27156
x-xss-protection: 0
set-cookie: IDE=AHWqTUkinJ4Hk2H7ihxndydDVvJzle0EV67cAPELuUxfTPrbz6g-f54b3SGKE5UcNVA; expires=Wed, 13-Sep-2023 11:58:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 13 Sep 2021 11:58:18 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4C56 70 KB
27 KB 652ms
651ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

682a8c4176d82595b930f5222e13113da54c281ff2bf0033db6a99db048894e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 13 Sep 2021 11:58:18 GMT
server: cafe
content-length: 27333
x-xss-protection: 0
set-cookie: IDE=AHWqTUm9Xc6p9rDl3b22688G8QUrW7Nr9GZoB9RDaiI7zC99Og843bshClVo8tsMBko; expires=Wed, 13-Sep-2023 11:58:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 13 Sep 2021 11:58:18 GMT
cache-control: private

GET
H3 200 container.html Show response
24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 84B5 6 KB
3 KB 47ms
23ms Document
text/html 173.194.76.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.76.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 13 Sep 2021 11:58:17 GMT
expires: Tue, 13 Sep 2022 11:58:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/ Frame 8A51 52 KB
25 KB 42ms
20ms Stylesheet
text/css 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&co=aHR0cHM6Ly9jbC5sb2dpbi12cC5jb206NDQz&hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&size=normal&cb=9e9lunb43p0r

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 17:56:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:54:31 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/ Frame 8A51 340 KB
133 KB 52ms
31ms Script
text/javascript 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e4f76389625a4e86c8328c2d1e01de5e3bb22dfd06edb9873313a6da47e4e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:54:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135849
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 17:56:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:54:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A4FD 645 B
309 B 18ms
18ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIYBEM3zNhjyhO2ZATAB&v=APEucNWb-UBUGyOP6_4KWXICZzRbGu9DPvZlRkEHiYyTvxAIArv5jqrtjiXhsFJxfz1JSZwuizOVdmktLRyC_408DWSUqCIEvfa4PWIQMlpEtIuDQ1v_a-w

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CIYBEM3zNhjyhO2ZATAB&v=APEucNWb-UBUGyOP6_4KWXICZzRbGu9DPvZlRkEHiYyTvxAIArv5jqrtjiXhsFJxfz1JSZwuizOVdmktLRyC_408DWSUqCIEvfa4PWIQMlpEtIuDQ1v_a-w
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 13 Sep 2021 11:58:18 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUnuIDRRMZExPqfECz5GxFrsjpkr4MNqHDBSZOwZ5H6xoeXuN86yqeixQCjA; expires=Wed, 13-Sep-2023 11:58:18 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 84B5 11 KB
9 KB 44ms
43ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ca1DqgeLjZCCo2zRlc5K1RoOgdp3SOVH3YrpDuZC-3LrLC5bM10vck8Bg3c_zhhJ2I1aZ8gvsOYloaGnVsRqB7zaqZ64Vti1l71YsgGKk03m24k_rjN4HGSVzjCWogXoXygkxvU75VMnfz9tvv86wPufFiaw&dbm_d=AKAmf-BlTe9mNmLsYaWGXsh8F4KXXe7FFqhjBQFZW1wLY5ACdlSsKyUks-UxuI_8TdKUCRqTh4dzq2xOzdtqcF_RpccEfVl-0qMg5dWkMU4H-6TJPuTY-JVIK2ArQo9KkkOklL23XBgSN6b0kYvEREyDXqvM0lrXekk00nGNwLH8oa36n_AbG_Pprlr-nJuW36JAMw7PkAoqjnohoKtgXE48DyhQ8HNOUWJ-fvy56YJQwXv0MnfA-wgXa7xCozYjptJNnpzlpKV_RItBRjTbMaDs-U-IzGIqGKBh4JTsDAPikIUSUfEGEf_27Cjmq5rmzzFn8ORMuXOgHhG8uxSPmMOU788khhzVi1A3f1pyE7RhEWlm1kGrd9gQLuL-pdX3bMdlPaqP64oAjhYzmyefv3HOSuto14tfeggvF-qjvEORH1KV0e_7Ooget7OriwU0m31lEhygYk_J2ClrHqGzn9Y0m3pXovQeaXJAOi2DcyR_ldIlnAltAE8HtpTgrQAL3O0n9_YJm_HtlSdbSflJ7h9SxlHYZM8fs4k_TbQAQcxgq-oHPVXqKAE8j6RAw9UadTSvm-4naP8yVmLo_SmRHIdye-WNcOMPE5as8WDqw4rEbX8sBs1H1PcpDnP9BqurA19N6wqVyr7oYqr8vpmms_QR0iS0AdVcBS4LrXeT5tfREVwZFlD-v4ycA6v31pesfAk9ON-fHGg61Z5UjRUyKMd69swpLiOiiX4p4_1oiHOCHE4BrQGOhjVjh_s5ZTlLUtF_OE5yY3S9G_FyzLCIAUl1p_2D1XaSQwO_cDW6csu7ZyxQZmInGkCXMsKEJ-ItNlJC3oXzZuUNnJ5iThhUpo2J13lhvsmtskTropHqbf4Qras-bPFAGU39NUDuQj2QB65hdtzZL0-MAoL_mnJ_u5huHud7HKIpr9g6Q_MMSEskHZA44JeC6AtX-7pF51A-1J_IL3WR3PX5lktMgZCT5JN-Pjpfvxb1KNpR1RPvyQyfWjuAyczdigVEtc_AYMY4upmq8cNUWYOEUuNkoMQpTljHWuHGgrGerbwZOjgBq9Ye68BbdthoZehtsepXywF9qtRCDq4KtotWwBv28IpuNJDDj3WUn1lztPR_wLoCzJavAOaUSnZ--XJ-tp0JgtSyvGucgct1GaL6YiLn5HOvp_2nyLF8k2FLV1yGux9PsHF1bQcBToS4SOfx456SQwVPWFNT4aRRfqhPlBtigCx1RcOFBf2Z_pP6TQ_GJA8tUQNBZbQ4RTdewC30zGvlnDWMib9RjRRHSUf_OlQHhcy_vRXm57ZumbZamWi_fgkvOPXj9D7glWAPhMRSa3-D1pFYakGNHB-NbIvl-snNUzk55y2fnnYOPB_Z5fIK4eg56PiehHnEbxpyuzemlU9-sp_0-OpO2n7sUnf79ELC1lTvdW868ODm78Q_XFej2P7yQ0wmTGcuqLn14kJanArJkC3jVrXB5kt2uPJK_H4QvJO-dM8jhquLIh_yRP62wzRuUqOdeUiaRL9caTOgQOTkRBABMVQ8WuHU8BS3tQwUWIGMAvcJWgwwpHQgcRVetxGPxs8UD4-t9O6NPVUhX9uWt6asGtWteFP1nAHPnnZvAckkO2An-AKSyel-knxXNfU0RaVR5iUwtsKrXU2DGxgO-xvsJwtW5odg151xpterSQPHki6Mg4oaycvTskpslWKZO9iHg9Nnj6__uvPlC2cnrg2GkZqHdEVghSpsfO3QttgK2gQDMsRjRgpavfCwOeXIt9o5AmNDPvOdkBkgsZThPM97gZ-aUfifYh7NBG77cGZHtdo_-Ev3rhSLMoi-cxpKjKnsptUXAR77A4WXifSdvWwU6DOw9I4AlYpPcIHKNGG-gILVwfWuwSOL9ZnEzQDYCvdh5TDxcHXfS7FkcXzsoeIc0phmibvPCHS4Z3GAhnjkNG8U1ElOsWef6atNKaKoVJHDiZCC2AvovGr_2or4Z1DCPls-AJJ_rY0epu4CMmMg88XXCmlrpCkREGokol_Jc2TMvnJSpvfCZyrfOFsFiZ_PsuypkPDUvEHL78tt2KXajuqzRqxj-561jXsV5eIQDmDIkQ79jZRbbAcxw-sjh7DuGo84z45DLCuZppY9bVcJSKtkgJ5sUUXKztbOHF0nXd6Nj55Hkuw6cswOjNH-Afann6JzlrCzpjLP2ro_oZA0lx3lRYeYmzFTA4OZigLBnsKr23M0iw7f3nBZOp88qXVncpFQyhKL-yPz6iIcbYMcGTkV5LhlpCRhERKawA5EIi1UOSdwaBWqt45-1yq8O2ZRCXag_cIYHPEvCkHgfYm3YZfss7HkwIK5RyLwgEyHszzU3eky-W6kVxLOaQ1N8i0xzT5XRKaHwgwNAa13zQUqReNm3swWhLific0Cr2Vsza7i3Cw4bLnQa6Xr4AlhmMZc5x_tgKocJoV4CeYlsVowYqeTAqDWR3lRxu-HzGwfgVvKVvc1Tq_nyUpCXbVqP-R_I7FaDd3DjQPUzS80m9A3xR0G_TT8xP_W-5oc0mm3KnWyI_m5G8LwmLQ&cid=CAASFeRou4shT3d8TySRvxFwNs_PPJSwAg&rfl=1%2Chttps%253A%252F%252Fcl.login-vp.com%252F%240

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da05732e54e4c4db2e0942a45b2590f94d52a3a75337416aef626643d39ecd1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8725
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 84B5 42 B
63 B 15ms
14ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ahz7L-cLCwCi1GEHpr2ZX3RU4xXhp5AbHexKsJwmbsnkh4dYVrrkvK4ZJVY2S1lunkNSNQhpFXIq_jcmj5fSfBtFe7K7A-O_vdhjyHY6WWX2nBddg

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 84B5 2 KB
2 KB 86ms
16ms Script
application/javascript 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=875628&cmp=25196589&plc=290954009&sid=6316021&DVP_PROG_REP=1&prr=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0jvNvSx-uqDQrhl0CtaUpAl&DVP_DBM_1=134&DVP_DBM_2=17407223&DVP_DBM_3=45568759&DVP_DBM_4=322650738&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1233807912669&turl=https://cl.login-vp.com/roblox-facebook&DVP_PP_BUNDLE_ID=&dvregion=0&unit=300x250
Requested by: Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Aug 2021 12:31:25 GMT
Server: Microsoft-IIS/10.0
ETag: "e6262781a8dd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 84B5 8 KB
4 KB 87ms
17ms Script
application/javascript 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVPX_PP_IMP_ID=ABAjH0jvNvSx-uqDQrhl0CtaUpAl&DVP_DBM_1=134&DVP_DBM_2=17407223&DVP_DBM_3=45568759&DVP_DBM_4=322650738&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1233807912669&turl=https://cl.login-vp.com/roblox-facebook&DVP_PP_BUNDLE_ID=
Requested by: Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: c26600311d153f4655eb60fa1b1f6109dcea7ed58fa0a860f6e8c4325866c43f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Last-Modified: Sun, 05 Sep 2021 15:58:22 GMT
Server: Microsoft-IIS/10.0
ETag: "0a31ada6ea2d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3309

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 84B5 2 KB
1 KB 49ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 13:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 13:31:56 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 84B5 125 KB
38 KB 16ms
15ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 38649
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 84B5 14 KB
7 KB 48ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 07:47:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 07:47:43 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A4FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEL8HZHuGL8Xy4idMkYhiqP8&google_cver=1&gdpr=0

43 B
1014 B

29ms
17ms

Image
image/gif

23.0.33.234
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEL8HZHuGL8Xy4idMkYhiqP8&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIYBEM3zNhjyhO2ZATAB&v=APEucNWb-UBUGyOP6_4KWXICZzRbGu9DPvZlRkEHiYyTvxAIArv5jqrtjiXhsFJxfz1JSZwuizOVdmktLRyC_408DWSUqCIEvfa4PWIQMlpEtIuDQ1v_a-w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.0.33.234 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-0-33-234.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 13 Sep 2021 11:58:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEL8HZHuGL8Xy4idMkYhiqP8&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A4FD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YT882niDDZw-RQrpHdTLvQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHtYE08V_mInOdwmx3f76I8&google_cver=1&gdpr=0

43 B
894 B

13ms
13ms

Image
image/gif

23.0.33.234
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHtYE08V_mInOdwmx3f76I8&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIYBEM3zNhjyhO2ZATAB&v=APEucNWb-UBUGyOP6_4KWXICZzRbGu9DPvZlRkEHiYyTvxAIArv5jqrtjiXhsFJxfz1JSZwuizOVdmktLRyC_408DWSUqCIEvfa4PWIQMlpEtIuDQ1v_a-w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.0.33.234 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-0-33-234.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 13 Sep 2021 11:58:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHtYE08V_mInOdwmx3f76I8&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A4FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOezORJJueZLY2a69waTIfI&google_cver=1

43 B
1006 B

14ms
13ms

Image
image/gif

185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOezORJJueZLY2a69waTIfI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIYBEM3zNhjyhO2ZATAB&v=APEucNWb-UBUGyOP6_4KWXICZzRbGu9DPvZlRkEHiYyTvxAIArv5jqrtjiXhsFJxfz1JSZwuizOVdmktLRyC_408DWSUqCIEvfa4PWIQMlpEtIuDQ1v_a-w

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
X-Proxy-Origin: 216.131.114.78; 216.131.114.78; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f2836d31-f725-4c32-a14e-dbc7e0e72910
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOezORJJueZLY2a69waTIfI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A4FD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM2MDY5NTE2ODYwMTg3MjU4Nw%3D%3D

170 B
188 B

20ms
20ms

Image
image/png

142.250.110.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM2MDY5NTE2ODYwMTg3MjU4Nw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.110.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wf-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
X-Proxy-Origin: 216.131.114.78; 216.131.114.78; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cf055ad3-df9e-448b-9ba5-2c0f62478fa1
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM2MDY5NTE2ODYwMTg3MjU4Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 8A51 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8A51 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 8A51 2 KB
2 KB 20ms
20ms Image
image/png 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 02:28:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 120595
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Sun, 19 Sep 2021 02:28:23 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 8A51 15 KB
15 KB 28ms
14ms Font
font/woff2 66.102.1.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 09:05:52 GMT
x-content-type-options: nosniff
age: 442346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Sep 2022 09:05:52 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 8A51 102 B
132 B 22ms
21ms Other
text/javascript 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.110.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a439ae0050821147ee49c3b305da6f8ff50c36c040298bb30142c7a9d2922807

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&co=aHR0cHM6Ly9jbC5sb2dpbi12cC5jb206NDQz&hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&size=normal&cb=9e9lunb43p0r
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 84B5 41 KB
15 KB 30ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ca1DqgeLjZCCo2zRlc5K1RoOgdp3SOVH3YrpDuZC-3LrLC5bM10vck8Bg3c_zhhJ2I1aZ8gvsOYloaGnVsRqB7zaqZ64Vti1l71YsgGKk03m24k_rjN4HGSVzjCWogXoXygkxvU75VMnfz9tvv86wPufFiaw&dbm_d=AKAmf-BlTe9mNmLsYaWGXsh8F4KXXe7FFqhjBQFZW1wLY5ACdlSsKyUks-UxuI_8TdKUCRqTh4dzq2xOzdtqcF_RpccEfVl-0qMg5dWkMU4H-6TJPuTY-JVIK2ArQo9KkkOklL23XBgSN6b0kYvEREyDXqvM0lrXekk00nGNwLH8oa36n_AbG_Pprlr-nJuW36JAMw7PkAoqjnohoKtgXE48DyhQ8HNOUWJ-fvy56YJQwXv0MnfA-wgXa7xCozYjptJNnpzlpKV_RItBRjTbMaDs-U-IzGIqGKBh4JTsDAPikIUSUfEGEf_27Cjmq5rmzzFn8ORMuXOgHhG8uxSPmMOU788khhzVi1A3f1pyE7RhEWlm1kGrd9gQLuL-pdX3bMdlPaqP64oAjhYzmyefv3HOSuto14tfeggvF-qjvEORH1KV0e_7Ooget7OriwU0m31lEhygYk_J2ClrHqGzn9Y0m3pXovQeaXJAOi2DcyR_ldIlnAltAE8HtpTgrQAL3O0n9_YJm_HtlSdbSflJ7h9SxlHYZM8fs4k_TbQAQcxgq-oHPVXqKAE8j6RAw9UadTSvm-4naP8yVmLo_SmRHIdye-WNcOMPE5as8WDqw4rEbX8sBs1H1PcpDnP9BqurA19N6wqVyr7oYqr8vpmms_QR0iS0AdVcBS4LrXeT5tfREVwZFlD-v4ycA6v31pesfAk9ON-fHGg61Z5UjRUyKMd69swpLiOiiX4p4_1oiHOCHE4BrQGOhjVjh_s5ZTlLUtF_OE5yY3S9G_FyzLCIAUl1p_2D1XaSQwO_cDW6csu7ZyxQZmInGkCXMsKEJ-ItNlJC3oXzZuUNnJ5iThhUpo2J13lhvsmtskTropHqbf4Qras-bPFAGU39NUDuQj2QB65hdtzZL0-MAoL_mnJ_u5huHud7HKIpr9g6Q_MMSEskHZA44JeC6AtX-7pF51A-1J_IL3WR3PX5lktMgZCT5JN-Pjpfvxb1KNpR1RPvyQyfWjuAyczdigVEtc_AYMY4upmq8cNUWYOEUuNkoMQpTljHWuHGgrGerbwZOjgBq9Ye68BbdthoZehtsepXywF9qtRCDq4KtotWwBv28IpuNJDDj3WUn1lztPR_wLoCzJavAOaUSnZ--XJ-tp0JgtSyvGucgct1GaL6YiLn5HOvp_2nyLF8k2FLV1yGux9PsHF1bQcBToS4SOfx456SQwVPWFNT4aRRfqhPlBtigCx1RcOFBf2Z_pP6TQ_GJA8tUQNBZbQ4RTdewC30zGvlnDWMib9RjRRHSUf_OlQHhcy_vRXm57ZumbZamWi_fgkvOPXj9D7glWAPhMRSa3-D1pFYakGNHB-NbIvl-snNUzk55y2fnnYOPB_Z5fIK4eg56PiehHnEbxpyuzemlU9-sp_0-OpO2n7sUnf79ELC1lTvdW868ODm78Q_XFej2P7yQ0wmTGcuqLn14kJanArJkC3jVrXB5kt2uPJK_H4QvJO-dM8jhquLIh_yRP62wzRuUqOdeUiaRL9caTOgQOTkRBABMVQ8WuHU8BS3tQwUWIGMAvcJWgwwpHQgcRVetxGPxs8UD4-t9O6NPVUhX9uWt6asGtWteFP1nAHPnnZvAckkO2An-AKSyel-knxXNfU0RaVR5iUwtsKrXU2DGxgO-xvsJwtW5odg151xpterSQPHki6Mg4oaycvTskpslWKZO9iHg9Nnj6__uvPlC2cnrg2GkZqHdEVghSpsfO3QttgK2gQDMsRjRgpavfCwOeXIt9o5AmNDPvOdkBkgsZThPM97gZ-aUfifYh7NBG77cGZHtdo_-Ev3rhSLMoi-cxpKjKnsptUXAR77A4WXifSdvWwU6DOw9I4AlYpPcIHKNGG-gILVwfWuwSOL9ZnEzQDYCvdh5TDxcHXfS7FkcXzsoeIc0phmibvPCHS4Z3GAhnjkNG8U1ElOsWef6atNKaKoVJHDiZCC2AvovGr_2or4Z1DCPls-AJJ_rY0epu4CMmMg88XXCmlrpCkREGokol_Jc2TMvnJSpvfCZyrfOFsFiZ_PsuypkPDUvEHL78tt2KXajuqzRqxj-561jXsV5eIQDmDIkQ79jZRbbAcxw-sjh7DuGo84z45DLCuZppY9bVcJSKtkgJ5sUUXKztbOHF0nXd6Nj55Hkuw6cswOjNH-Afann6JzlrCzpjLP2ro_oZA0lx3lRYeYmzFTA4OZigLBnsKr23M0iw7f3nBZOp88qXVncpFQyhKL-yPz6iIcbYMcGTkV5LhlpCRhERKawA5EIi1UOSdwaBWqt45-1yq8O2ZRCXag_cIYHPEvCkHgfYm3YZfss7HkwIK5RyLwgEyHszzU3eky-W6kVxLOaQ1N8i0xzT5XRKaHwgwNAa13zQUqReNm3swWhLific0Cr2Vsza7i3Cw4bLnQa6Xr4AlhmMZc5x_tgKocJoV4CeYlsVowYqeTAqDWR3lRxu-HzGwfgVvKVvc1Tq_nyUpCXbVqP-R_I7FaDd3DjQPUzS80m9A3xR0G_TT8xP_W-5oc0mm3KnWyI_m5G8LwmLQ&cid=CAASFeRou4shT3d8TySRvxFwNs_PPJSwAg&rfl=1%2Chttps%253A%252F%252Fcl.login-vp.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 12:14:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 517421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 12:14:37 GMT

GET
H/1.1 200
OK dvbs_src_internal99.js Show response
cdn.doubleverify.com/ Frame 84B5 61 KB
19 KB 20ms
20ms Script
application/javascript 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=875628&cmp=25196589&plc=290954009&sid=6316021&DVP_PROG_REP=1&prr=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0jvNvSx-uqDQrhl0CtaUpAl&DVP_DBM_1=134&DVP_DBM_2=17407223&DVP_DBM_3=45568759&DVP_DBM_4=322650738&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1233807912669&turl=https://cl.login-vp.com/roblox-facebook&DVP_PP_BUNDLE_ID=&dvregion=0&unit=300x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 158edd2a7562d2b16eadda8fb990eb8d20e53837dd1abdfd2c890fcc0980ede0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Aug 2021 12:31:42 GMT
Server: Microsoft-IIS/10.0
ETag: "08bf9811a8dd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19248

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame C7BF 7 KB
1 KB 25ms
25ms Document
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&cb=khg2dac1syw5

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.110.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aa0854db2f7ba5b5fb75f72bdc92caf6d6ac3c08522cadffb9c0029ed51f9c18

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GHM6+po65Xj0IP/3hUWP+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&cb=khg2dac1syw5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 13 Sep 2021 11:58:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-GHM6+po65Xj0IP/3hUWP+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1114
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1FBE 22 KB
8 KB 14ms
13ms Document
text/html 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 09 Sep 2021 17:58:15 GMT
expires: Fri, 09 Sep 2022 17:58:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 324003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame 3932 1 KB
981 B 64ms
23ms Document
text/html 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/

Response headers

Content-Type: text/html
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 634
Cache-Control: max-age=13217
Date: Mon, 13 Sep 2021 11:58:18 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 84B5 4 KB
2 KB 54ms
18ms Script
text/javascript 213.254.244.18
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_310180143071&jsTagObjCallback=__tagObject_callback_310180143071&num=6&ctx=875628&cmp=25196589&plc=290954009&sid=6316021&advid=&adsrv=&unit=300x250&isdvvid=&uid=310180143071&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dvp_strhd=0.30&dvpx_strhd=0.30&brid=3&brver=92&bridua=3&dup=null&turl=https://cl.login-vp.com/roblox-facebook&srcurlD=0&ssl=1&refD=1&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0jvNvSx-uqDQrhl0CtaUpAl&DVP_DBM_1=134&DVP_DBM_2=17407223&DVP_DBM_3=45568759&DVP_DBM_4=322650738&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1233807912669&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=18&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETar9EEADTbpTauTauac77ad53dfg43c4e3%60b%606g7caf2fca57%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETauC%403%3D%40I%5C72463%40%40%3C&dvp_exetime=8.80&callbackName=__verify_callback_310180143071
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.18 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: 56b36410d416cfc85b9adbbbee5223959abadeb365e13b78c0a435b85c00e9f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 1
Content-Encoding: gzip
Date: Mon, 13 Sep 2021 11:58:18 GMT
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 9/12/2021 11:58:18 AM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame 8BDC 4 KB
2 KB 17ms
16ms Script
application/javascript 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=13218
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/ Frame C7BF 52 KB
25 KB 20ms
20ms Stylesheet
text/css 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&cb=khg2dac1syw5

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 17:56:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:54:31 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/ Frame C7BF 340 KB
133 KB 22ms
22ms Script
text/javascript 64.233.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=wxAi4AKLXL2kBAvXqI4XLSWS&k=6LfK2HYUAAAAANzy4CR5rAg3my4Tria55kER9dWP&cb=khg2dac1syw5

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e4f76389625a4e86c8328c2d1e01de5e3bb22dfd06edb9873313a6da47e4e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 19:54:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135849
x-xss-protection: 0
last-modified: Mon, 30 Aug 2021 17:56:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 19:54:14 GMT

GET
H3 200 SRvJn55X6RWbfV9KOXYL310U_n7bQjLBtP3JEbFBTGg.js Show response
pagead2.googlesyndication.com/bg/ Frame 1FBE 35 KB
13 KB 17ms
17ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/SRvJn55X6RWbfV9KOXYL310U_n7bQjLBtP3JEbFBTGg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

491bc99f9e57e9159b7d5f4a39760bdf5d14fe7edb4232c1b4fdc911b1414c68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 20:37:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 487239
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13367
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 20:37:39 GMT

POST
H/1.1 200
OK bsevent.gif
tps20511.doubleverify.com/ Frame 84B5 807 B
1 KB 49ms
9ms Ping
image/gif 213.254.244.18
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20511.doubleverify.com/bsevent.gif?impid=e6d5768409f141b1b2b035682bbc5ba8&dvp_or2=1&cbust=1631534298327139
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.18 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 9/12/2021 11:58:18 AM

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 84B5 9 KB
4 KB 17ms
16ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37bfceb04cc7a18df0c1da8269c382b3b088e870ab39a0987ae17a54589b2dba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:49:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4105
x-xss-protection: 0
last-modified: Wed, 04 Aug 2021 13:52:44 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 13 Sep 2021 12:49:12 GMT

GET
H3 200 impl_v78.js Show response
www.googletagservices.com/dcm/ Frame 84B5 37 KB
15 KB 13ms
13ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v78.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07000140ab52c28ef2a522fae638638b2783786e8e2ae8cb883cc1f0a0c00df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 11:04:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262452
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15595
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 17:50:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 10 Sep 2022 11:04:06 GMT

GET
H3 200 banner Show response
fundingchoicesmessages.google.com/f/AGSKWxULKJzDEKdM482iWCiwWq0hgeD0YOmVWyvMJOhUIUK-AH465072F_FkpzgoUiP0H7mtZsyLktnm38fReGXuZ5morWD-Va1if9Oyw2xR9jJwyT3NGu6mKGYYgUv_nRP_TuDXFnnQzZLDjXQMVe_MwEMhvHApu... 54 B
106 B 33ms
33ms Script
application/javascript 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxULKJzDEKdM482iWCiwWq0hgeD0YOmVWyvMJOhUIUK-AH465072F_FkpzgoUiP0H7mtZsyLktnm38fReGXuZ5morWD-Va1if9Oyw2xR9jJwyT3NGu6mKGYYgUv_nRP_TuDXFnnQzZLDjXQMVe_MwEMhvHApuoO3Jm8QN6n-gBJKqcrNtxKmvEA1dBBFctWn67GaOm4cnNHsdpGWO1gHU7Dzu_thiUpO4vYgh2FjIBmpUR4=/_/ads/banner?/slide_in_ads_/cubead..net/noidadx//posts_ad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6437e597e78afea9a4f104e41bf7fbc31e7c8cf9df3e78318c08fcc1be2ad61a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-usJ8fvJSBtcWUSZZhjKhtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-usJ8fvJSBtcWUSZZhjKhtw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-usJ8fvJSBtcWUSZZhjKhtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-usJ8fvJSBtcWUSZZhjKhtw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 72 KB
27 KB 14ms
14ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37f76058b57e779a8cca49136023ff354d4b32ed6c3a930b3be6a0b987a09b8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 853
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27565
x-xss-protection: 0
server: cafe
etag: 13043736828238691780
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 13 Sep 2021 12:44:05 GMT

POST
H3 204 AGSKWxUZ5jdTd1Kn9CSOlUF9ZJpgTHSvo-7_GQtn-7I6PmaSomwGgY8WzkAnS-1SOpWRLPSKZFTn6SOGYiTYSgtOdBYbVjqio81ZYgZYCmY4-y-mkuiOnRFYxrc91d5115Zuz9q0kXBWvWGKiFwuET0jwT0c9F6DGrmb-ksSCgqQCxAPltA02yQq0nJrBGZl Show response
fundingchoicesmessages.google.com/el/ 0
26 B 23ms
23ms XHR
text/html 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUZ5jdTd1Kn9CSOlUF9ZJpgTHSvo-7_GQtn-7I6PmaSomwGgY8WzkAnS-1SOpWRLPSKZFTn6SOGYiTYSgtOdBYbVjqio81ZYgZYCmY4-y-mkuiOnRFYxrc91d5115Zuz9q0kXBWvWGKiFwuET0jwT0c9F6DGrmb-ksSCgqQCxAPltA02yQq0nJrBGZl

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RwY22jpSxufGAglzuZMalQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-RwY22jpSxufGAglzuZMalQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-RwY22jpSxufGAglzuZMalQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-RwY22jpSxufGAglzuZMalQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2+G8c0tdhZNO2jrXXbAeXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-2+G8c0tdhZNO2jrXXbAeXw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-2+G8c0tdhZNO2jrXXbAeXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-2+G8c0tdhZNO2jrXXbAeXw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements1748.js Show response
cdn.doubleverify.com/ Frame 697D 495 KB
90 KB 20ms
20ms Script
application/javascript 2.22.78.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1748.js
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.78.9 Paris, France, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-22-78-9.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 754893be5a5c16b7a2cafebd29494358611d47cfe7d2d65f2f8f8c9166785e2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Aug 2021 11:34:30 GMT
Server: Microsoft-IIS/10.0
ETag: "0676e295c9ed71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91695

GET
DATA 200
OK truncated
/ Frame 84B5 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e238e5d3c4d9b5a525f3770054c29d1fc24137e89a92f704cb9ac7e41a7f398d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 965F 6 KB
3 KB 23ms
23ms Document
text/html 173.194.76.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.76.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f132.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cl.login-vp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 13 Sep 2021 11:58:17 GMT
expires: Tue, 13 Sep 2022 11:58:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Atk+DdZhACLxdo0bFTpbCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Atk+DdZhACLxdo0bFTpbCQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-Atk+DdZhACLxdo0bFTpbCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Atk+DdZhACLxdo0bFTpbCQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxU46weIXE7F6tPkEwaWTo2mrkxQe3HPtS-5aOfN3zEXQg5W86amLQOFj-wxxq1mkurxd8CGfsItefYO7I6I_bUXA36es863U5koOMEg6SJ4qDX2fhlzsoaohOFBgNeNP80d29Vk-MYp_3M3lAkJSuJMAmNb6fg9gjB4MRk-r5_Uk2YSHCHRFXSbC_9y Show response
fundingchoicesmessages.google.com/f/ 70 KB
25 KB 48ms
47ms Script
application/javascript 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU46weIXE7F6tPkEwaWTo2mrkxQe3HPtS-5aOfN3zEXQg5W86amLQOFj-wxxq1mkurxd8CGfsItefYO7I6I_bUXA36es863U5koOMEg6SJ4qDX2fhlzsoaohOFBgNeNP80d29Vk-MYp_3M3lAkJSuJMAmNb6fg9gjB4MRk-r5_Uk2YSHCHRFXSbC_9y?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCwyLFsxNjMxNTM0Mjk4LDUzNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsWzEsWzcsOSw2XSxudWxsLDJdLCJodHRwczovL2NsLmxvZ2luLXZwLmNvbS9yb2Jsb3gtZmFjZWJvb2siXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

daaca311c0af0e8525a49488631d0dde45a2443bd05d1b81e3ea741349197e2d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BfhiBbuMlenWgwkmuxY5qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-BfhiBbuMlenWgwkmuxY5qw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-BfhiBbuMlenWgwkmuxY5qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-BfhiBbuMlenWgwkmuxY5qw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.T3w8R-rkGEM.es5.O/d=1/rs=AJlcJMwgvfsE-Yuxq75oJJj26H2mTq7Pqw/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PYKvNR0mEnZwdxbNcUIbig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-PYKvNR0mEnZwdxbNcUIbig' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-PYKvNR0mEnZwdxbNcUIbig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-PYKvNR0mEnZwdxbNcUIbig' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 697D 3 KB
1 KB 65ms
12ms Script
text/javascript 213.254.244.18
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=114&ttfrms=31&brid=3&brver=92.0.4515.159&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETar9EEADTbpTauTauac77ad53dfg43c4e3%60b%606g7caf2fca57%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTau4%3D%5D%3D%408%3A%3F%5CGA%5D4%40%3ETauC%403%3D%40I%5C72463%40%40%3C&srcurlD=0&aUrlD=-1&ssl=https:&uid=1631534298584613&jsCallback=dvCallback_1631534298584513&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F92.0.4515.159%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1748&tgjsver=1748&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&fcifrms=20&brh=2&sdf=2&dvp_epl=330&noc=4&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://cl.login-vp.com/roblox-facebook&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVPX_PP_IMP_ID=ABAjH0jvNvSx-uqDQrhl0CtaUpAl&DVP_DBM_1=134&DVP_DBM_2=17407223&DVP_DBM_3=45568759&DVP_DBM_4=322650738&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1233807912669&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=1845178158.890761&dvp_tukv=82862213.40607236&dvp_uuid=8046633780.3136425&dvp_strhd=0.19999998807907104&dvpx_strhd=0.19999998807907104&dvp_tuid=127845898280
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1748.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.18 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: b11646c08b29b5e608674371382c76b54f1164e63dc11a4c8540a7f24d3584df

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Sep 2021 11:58:18 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 9/12/2021 11:58:18 AM

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 965F 0
0 23ms
22ms Fetch
text/html 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cgs9e2Tw_Yb6EPImW1gbJ9IOoD8_0soJl7Zy6hacO8t_Kj4kKEAEgueiOTmDJBqABnK_7qALIAQLgAgCoAwHIA5kEqgToAU_QALRwBZ8zy1bQehelnUWNUw4eqthAPE1w4gL-nDu_Nw4BzgyOdQBcxlmnf5zyh_cZQVPJNKeqzokG0uwZXR3FV25znqQMAHSNAcAwXfZfaf00kyNxvpHB-gASuDz3znN2PdQb51F0UuznsioOdmS_ssMMjffnEXh_9VVUO-_Do2B0NY_Rng9L0TEnWVYAoLPADQRSLq-8cYh_YIRA_47EAZtyvx_EqwdNMQ6VBETkq_ovK_m343rEwP0n2fNEA41TweNuF6tC8Jv7srSiuugxG3oFdSNZmk3tm-jmEuBHAw-p5pFP6gzABLPGsMHtA-AEAZIFBAgEGAGSBQQIBRgEoAYCgAfM0ITXAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwHyBwQQ9rAO0ggHCIhhEAEYHYAKA8gLAdgTDdAVAZgWAYAXAbIXHgocCAASFHB1Yi01Mjc4OTczODg4Nzg2MzM0GKndGA&sigh=HTggTDLo5fk
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.206.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wk-in-f157.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 965F 18 KB
7 KB 13ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 18:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 18:15:41 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 965F 2 KB
1 KB 14ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 13:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 13:31:56 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 965F 125 KB
38 KB 15ms
15ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 38649
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 965F 14 KB
6 KB 14ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 07:47:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 07:47:43 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 965F 0
0 19ms
19ms Image
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTyQbqRnrU-tdd3katVFi4a4Rhxtg2e4mr8XBB8rYzbTgkoD7pelY9kbDCuDK2pWXtdPxI1MHXW4EcZHYGlA_xr9noEaQ
Requested by: Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.110.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wf-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 965F 26 KB
11 KB 14ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 09:18:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9562
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 09:18:56 GMT

GET
H3 200 12049404771498606354
tpc.googlesyndication.com/daca_images/simgad/ Frame 965F 38 KB
38 KB 19ms
19ms Image
image/jpeg 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/12049404771498606354

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e566b19f0d74d7ce2d2f2ee0f78107650bbb6dfcde38ba22777c3aac05885a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 17:20:17 GMT
x-content-type-options: nosniff
age: 412681
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38976
x-xss-protection: 0
last-modified: Tue, 17 Aug 2021 08:06:23 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Sep 2022 17:20:17 GMT

POST
H3 204 AGSKWxX6vusbZpqSXiaqoETo90PMgVdDlN329DtBlpV7oCckxrN-oi2uvh-Aa_V09y9TXnKLahfI8AFU9aKJw4koo0Du951i90L7eSfdY5mH4cawAp5FuB9LxH3o6JcjFf_Pm8zxcHHHveM8IGnu5M2nM3_5hjtMXe8bdpEFhkW5BusZ7syHYKwBj71x2vvN Show response
fundingchoicesmessages.google.com/el/ 0
27 B 23ms
22ms XHR
text/html 64.233.167.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxX6vusbZpqSXiaqoETo90PMgVdDlN329DtBlpV7oCckxrN-oi2uvh-Aa_V09y9TXnKLahfI8AFU9aKJw4koo0Du951i90L7eSfdY5mH4cawAp5FuB9LxH3o6JcjFf_Pm8zxcHHHveM8IGnu5M2nM3_5hjtMXe8bdpEFhkW5BusZ7syHYKwBj71x2vvN

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.de.-iaodh3Ygno.es5.O/d=1/rs=AJlcJMwcY7eJYgPgWbOO5jQJf_0Q24Jbfw/m=cookie_refresh

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CN6J/BPUXcM6UZtYlobcUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-CN6J/BPUXcM6UZtYlobcUQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-CN6J/BPUXcM6UZtYlobcUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-CN6J/BPUXcM6UZtYlobcUQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BfA+48L5XUNL/hXVWl7jAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-BfA+48L5XUNL/hXVWl7jAA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
access-control-max-age: 86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://cl.login-vp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-BfA+48L5XUNL/hXVWl7jAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-BfA+48L5XUNL/hXVWl7jAA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1612888260286511507
tpc.googlesyndication.com/simgad/ Frame 0B08 9 KB
9 KB 94ms
93ms Image
image/png 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1612888260286511507?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qljRqOu_8nt_ccpwhUKnc-vXO6o3Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c979ad42fceefbb104c8142a5f035a7a771f1a08c7a043f48566448130eadb3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 Jan 2021 22:04:05 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8759
x-xss-protection: 0
expires: Tue, 13 Sep 2022 11:58:18 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 0B08 18 KB
7 KB 14ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 18:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 18:15:41 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 0B08 2 KB
1 KB 15ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 13:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 13:31:56 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0B08 125 KB
38 KB 16ms
15ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 38649
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 0B08 14 KB
6 KB 14ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 07:47:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 07:47:43 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0B08 0
0 17ms
16ms Image
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSXLLIrqo6sFa12NnaEFHs4TZskBl9epy9OgG_IISOaSXzH5Ry_2825_UQ9f_RxUAkeCqlr6DGtOFaWAxWpqOXkfM5rmA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.110.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wf-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 0B08 26 KB
11 KB 16ms
15ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 09:18:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9562
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 09:18:56 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0B08 0
0 19ms
18ms Fetch
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQZqy2Tw_YfLTPNTBx_APkJKs2APqlqqnYMCVhq7dDLao-JyqDhABIKnuiIQBYMkGoAHmkqfHA8gBAqgDAcgDyQSqBMoBT9Akp25g20AdvlsMm6AAeSYQGLoHm_7qN9dFu34AuESW8Sb9Y5MZ8Fty0eWFzkDh71uwIId-RYZT31V98Eh-Uvyi5eYHQ6xJRY6exxZZUBvwwITdO3WqLPX0_x8MugiZ2TMlHeE2CQEM8O9R6zEc4tTjrdLldYqpF8xfybMCZoX8Kj9JYa6b2N9iYYlHaRMOujfuYiCQI6ajKo6LZQgN0hJLbqgwq-w_QcVpZQAKihHzjKsmh9XyGKzi-8iKrOy4l34Vn-bwTpMrZ8AE9tyZ6JADkgUECAQYAZIFBAgFGASgBgKAB4Lt2DioB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcB8gcEEMj8HtIIBwiAYRABGB-ACgHICwHYEwzQFQGYFgGAFwGyFxwKGggAEhRwdWItNjk4MzM0MTcxMTA3OTI5NxgA&sigh=R_sxGHYUjOU&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 13 Sep 2021 11:58:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET 10922041042197105981
tpc.googlesyndication.com/simgad/ Frame 4C56 0
0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 4C56 18 KB
7 KB 14ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 18:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63757
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 18:15:41 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4C56 2 KB
1 KB 15ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 13:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 13:31:56 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4C56 125 KB
38 KB 17ms
16ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 38649
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4C56 14 KB
6 KB 14ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 07:47:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 07:47:43 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4C56 26 KB
11 KB 16ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 09:18:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9562
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 09:18:56 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4C56 0
0 19ms
18ms Fetch
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CubZZ2jw_YacMwYq3B9funogGhsjX9GPQ37m9uA7o-r_xjw4QASCp7oiEAWDJBqABnK_7qALIAQKoAwHIA8kEqgTHAU_QsQ3Z5ikEWMkHAI7LP7DBIimbKlUtmxah11c4OAUF_YLcHi0fw8yDxOB0yjV4iac32Y8lRAhKZwSTMifNPgeTMsRm6m0EDbnmITFqsO43nRSsT8tu5Kg6Me4S4M5boy3T6iw5GYv96zUfaY2sHSDIex9ALBaP-YILQg0lobhfnLXqo5LoRSEwiEI4vLJOIkCXKEukrU5Y6z0szmTcQGszusUcP5_Ip-cbm1HTkzfPu69ruHoJElsU09YybwkSI6Ix9KEF7ozABP-H9PbMA5IFBAgEGAGSBQQIBRgEoAYCgAfM0ITXAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwHyBwQQ7ekl0ggHCIBhEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi02OTgzMzQxNzExMDc5Mjk3GAA&sigh=rwjFhCNRsYk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 13 Sep 2021 11:58:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9249 42 B
63 B 15ms
14ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AY8g4798E2_6LYHka7mBL3m8R26huNm5IHrxntkh-_oSsEX_6bsnibowwEbOsl9LWKSgFeLxQ0xINcpePQbG4Frn1XsMEhI3xEWjkUzt6iMJ_eV8k

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 9249 2 KB
1 KB 15ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 13:31:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 13:31:56 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9249 125 KB
38 KB 16ms
15ms Script
text/javascript 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 38649
x-xss-protection: 0
expires: Mon, 13 Sep 2021 11:58:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 9249 14 KB
6 KB 14ms
13ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 07:47:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 07:47:43 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9249 0
0 16ms
14ms Image
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTK55t08sg8AVMpVbHt44WY2g-rdoDBOOT7Kio-co9N6OiO8xasFIm_UeLCS1rxw2zxQ0oGonbtslxUeMMszbe3FIbUZQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.110.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wf-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2F13 645 B
306 B 19ms
18ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCnlAEQj8-UARjT0oezATAB&v=APEucNXnO0M4Nn_JuMIlyzlqaUJwXZsKHkIxjt_aiXq3LD90bOGRXhV-Fyq4lSGT0xYlCdk8TeVTTD_H4Og1VE0s3qwGZpE42VC877nAbYVBi31C_019Nnw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKCnlAEQj8-UARjT0oezATAB&v=APEucNXnO0M4Nn_JuMIlyzlqaUJwXZsKHkIxjt_aiXq3LD90bOGRXhV-Fyq4lSGT0xYlCdk8TeVTTD_H4Og1VE0s3qwGZpE42VC877nAbYVBi31C_019Nnw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUl0VXww5jnEHq0JJhFVIfudryV1ABy8DANKEBrWwrHC-PQM6uaJMA0sBTRr6-w
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 13 Sep 2021 11:58:18 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9249 53 KB
25 KB 42ms
41ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C84yX_EY0bnpoRPE2_gq9eepEAS55T3gzaQDMEhIsOypddUwY3ls4TEXd3Bln_Jo_S7HLdHpSbbYNgLYrBRHUUfxvvW2Zlnedofg_FdNkT-qD8XdJJg85tM-WqCC3FEfpbaD7INLhhXZFUVcemsNkAVgAxNw&dbm_d=AKAmf-AcgFwqqZmsnTmV4f2tocxaawOnPEmcAlnY9NOHTzW79p3KlB3mgHabKfaPUHxJf-CjK0f1Aq1GR0KQO_Rx6k1W3-Rfcl1OlD85Zx_EI2OKoBM_KRBVZ5C9uvRG0GZmGU3ie4VLYEvVjyxa7Lpy0BKtoIebazMUTjbwP-l5mSC_ljETH6i3IBFihpaDOlOfbpeUTTqxpQRKX02B7C8FXlSPWQZ9im4kwg_aGCtfOY_fexFeg2z06ahFYgA2mA23OcIx7AcByKH0haCTyDnBXt096KovJKCb-Et9uSlqNQTHGQfwzMAPUvBAHarM0NMD62P44Ksc5CVsx_29LAd1zKxod9Oje0mlRgeQIOZNHE9JRZHmtypEMrwA8R3yhBJWv87OhfLOJOPtKowsfBuVo07-R_wIbZhXA5pLZ0QsBWEKSJa_KTNDYnH8jruckA3HqCpO1leK1khcAEHxAYWZdbJbknWA9VdHXZSkEuuIm5j8Q7pYtyiYZXdKAr7T2uukg7N7SlhGsOKSzILPp5CVLm4PdRfDt4UyuzXNrZyGLIRCUaMNym9FTPwl-8kWLUVlFUkzxF2j9UTrYiXESzlUlsU6jaqQh5dPPkURXzecmhNQvSy3iE5Bw0TW3BRs8Rovuew3F0KDoyFp_4gBXAm_7zyOMGLHbMXxxNrdGoQtwKL3hLQJh3v7EAnIoPnU_wYLf4SEbjfdM5MhtBXjDwlWioRJ33durUZdWivSuk6FnMT7ordc41vmaWH_pw1_hgw3Cpkow5_nF-6fV6jcoXlM-Lzp4HtxnNYlluX9ZWBmq9ky2wzO9gBUiN1APRsfULqTmPWCXm5YkhzQwDYvsZuLs192xH7O55FSsU0yTML5gqAQZq4aoMORqNydSSl2BanvGX6Lbea8zK6jYL_2zqxGAmVlpieYRoO_rXe5l4htnch0UsJ1eZGMgonG60V3m2h9RhVI7uy6FiWWd-7u2tz_11NtZ1Br0UXjSpulVLC65y4BT3g5QyHdHEhowIdgB_N8KlXGUpYnkxw6Pl0ck7LpsP2zp9aoYw6SMqwAR3GbqVGReCK-APr8gOW1fCby15ck2nImA5uy9fWOXmpI4v1LQ0m8ZBjeSKW9S5qL42Xxtg64ly1c4Z6eTWLOktwisVWwMfvBp5LXsqHH0tD0ZQ0vzBBpITMnTuk2DKHZkEDaoA3sbEWOkfKYwVJLBLv7IiDrEi3MvhPA0Tfsi4HrRJaED-w7SYilOIPqaIWK4ruNQarn-EmysUnVMAeL98KnAR6UeCJdgAap9zbMmYnja5708pjl9gBqnu2bvfY7iur_J86ao8SWF_88Itur8tDoDDneLPkICRdAbGX8pJlFMxpqFfktdPEPaDvj_ytnNyKaoXAwTYXAYgdFSI4_Mj69rzcbNb7VCZ0ivPvb1OVoi3k_OCyc4h6R15grVB9KXm7ZCVkqB0FU2u9xAGj94L6-N4N98_ManbrVG_D5tt_XlC-PsLOmFqRcxLpqcejx3xIQoi5bLFNtv7AN-REkNonWQEhz3I7Zmj_fKGOsHdf9sLbiypuxvb4w4VqQZk1on3NGMajzUj8z_ieaSZm3wBTMRPGpTM0i33M7MHPYendQtSqs4cgHvWp_UXWvBP1zqtBLd0-MYvQcJMxt0a75pEoHO91Xj9VAE3EIQOmuBHGPfW_77mxhzCj3qOsc7vmUyplkIj8UP2hZOd18TJRWV8kgnOtnqXhXT5iCBEfB-iHYr9Cfa3_hnqIUTpfGxO5vsE3i6XJV9hPNdLlm3DlsINp4rKQe-5cPNA05dQuJLIU4VWNjgtbDPS4a8EVByNxW6-sObjRoefrmp0B5iLwjziM1Kgtcw8u8Y9zxuqggU4EaZC6BJZlMppCJIuhpROczZ1a6RaJvcpcWpJmML5UFwBp8QAURjmO74ij3ZKS9Cbw4dTpumwM0noPO7Jt9EMGDyS1T6RHzRN7-2Q4SHEkMekSZU8mIpjJp3Gtw3mcgIE68T_DUHleUshXZH7ptuER_KGc0ZAc_Fuu_OxTN8rwSxzkb4gtzq9qKKwGPdMk1GgxbnpAWt3KuVaEL5QsYUwba1sg9ANSbyKV0ckaXoPAd6kkaejdC46vNqb3DD-n3h7OYR7JffefbLaBvscpJSUliWtK-yUsGi2kGF8A5ECYVN5fTPFirR97EsXr0_2mqU0dokZ8_5kW1cvRyu-irCmIjYDzKqZErkcNxIymTBH8Fan92aEsbCu-tnfm6JlmXLobbiJJWFW-sFKSQzMaXaVM48379qKnb5reKoD75PJVZv-8k6S1jVbsjeGCPW59eyv93oHwgAJq8qCxE66-22SZChYv9dTWh3OvhUYuva578TzMyf-PdeA3Q-de3pI7WVX12ub-zjxCYWuxGCmwbZDnGh3ffzLx4rvXQN52k4mTUUjVTtlVUX9WX5ddF1e4GGdHbAm6sp7Yjbqhkwz2gmvAQLJXqjUBCjBzHZ1ZtZbn8zMb2-kIsOOU5lDHaVgbKO3rJoUYPeda2AGR-1Yjhj0r9-fGLotR7eJ9LJvsfyaY3e-t_BuJsc5HT7eU_OG23FhtU7DdqEtePh_YLlfGF8FtKTkcZZNnaU6kJTotEezpE6FAH0NxDiLYXrHCpjfWPiifKf_1RlXH26UYnzoUqCh69uzfW0KBBnYwnwEEXTLO1zvZWeEl0GW8Kc_m4kIpxr6KoNGy5CVhs7ckptuwD4FSt5FpBVoBlqYS-IECI44IbcYp5GJKPIFlj60iGO0VjPt_nFbyWdbe8_yeYbhCYL25uh7nnG9nP2-kpDo1Y48Pbmc9RjT3QEukhaJJ9dZyDKcvW8ZMu2mbQDNnPq9WO9-rLZvdM9Xw5HK6ggJibyW_5wnjDiy_uNMVodYELfmy9Vbm9srNSd93kEcsZHJkffthWpvVeLY2zkO9ZbzEEwmrUrV_pvo9KqmEbSuBX&cid=CAASEuRoOPoelrCmfEmrx6c5BkQKZg&rfl=1%2Chttps%253A%252F%252Fcl.login-vp.com%252F%240

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

224adb60f47b115b44eb4ca945e510c0d388a4dc13b36bd7c7fa14f775b51f13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25460
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4DE9 143 B
163 B 13ms
13ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com
URL: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUl0VXww5jnEHq0JJhFVIfudryV1ABy8DANKEBrWwrHC-PQM6uaJMA0sBTRr6-w
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://24ff25db578cb4c6b131e8f427a742df.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 13 Sep 2021 11:04:30 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3228
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 965F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bf3455b9c1665cdd2ddef8d7ec113200d0af4396cfe4dfa80591d286fbabb4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1FBE 0
20 B 17ms
17ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BS-iS2jw_YfHfBd3xnsEPssCO4AQAAAAAOAHgBAI&bg=!hYalhsLNAAYT0U73E9E7ACkAdvg8Wic2PQwnxKh6QiY6QtGSmCZ4ppOtF18H5GqcfimnhSEBR590TwIAAAEmUgAAACdoAQcKAJqtqQSpzmG4qNWjZvyGuI02iqKlkR8Gdpe94b0vrA-vfA6UUaIM38PWihT8qN0aX7p3f7lXWNNkeaUQYBkggsENL6HGZdisE-r7nRvDpN3rJq1j18V-YaU3X0FbC-asr6bKXfw7J5HkuaLiEUoESNlSC4nmEqxOzIs-9JRU4mtr29Vtkz-yoF0dGspjn0huPqBxxXOGp3QRQiHjmQLQOiAfTyHVZR2-MPwY6OSw2yIVqwkoz4r9lkBETd1ioPcmY7QqmT13EHaZ4--EPgfO0rKIog_3mgjBlu0_1CUEcRlVZRm9YNMpYMG7Ld-TXpU0vglQUECmNn1UnaX19tkv5S9wzRu1tBi5NcrOzQj2jED6aoziRbWZdcxBhBbOCAUO5kAMc0WYhyeU1e9yK8xcqmjV0pvs_t2I5z9wV2zHemOteYM0thUy7RogA7KOH0rOM0HFnaVsppRN9_YnB6FDKZ1trleN11CP6a_jiE4evkY5d_U6Hur88yd36zdNMpDVOmMEXBhu_rBfMHwmor78UVczfyue6FSgE4MRkxuTgzgmJ93IsGbodpoCAnAbfEflL-hR9y3ZrEsjnXfarNIal6_UzzJdcfP0c5f80k68Ic2Bz5gBlNKHM9HWU7gdrOUU_TbTeD9YDZEGLfVzzmhcZDRIXp264iL8hb5-lNr1JyoBQY-bKU2Cb4H93VD4AIAeoCP9ZqaiHROGIYb1eqYYidpeVEr5dTT7qBeLudmshcARtQLUB0BFXaNXRHcqdVphRlb-ypmlWxNsx04bTq4N4nxEYgdBE0xDRKvwl7g5bqJu0wZbElfGiHo69xtKQaEQ6L44PkX7aZZ-4FdYx2fpntBJViqfemhgYJY6Z8egdLO94gQ636lxVrggo9mVb_8EIwhwuIjka82uVy-X2gASM_Jc4O6O154IF-60HV9M3GtZYETcQ-oxj0euDt1Fku_CHybk0r4VpXq0U-aOYDaj9AWqJbJCQYSou2DKuFu_NaqEtE8n54M7yyTZWWUfoZnPiLhN_4tjvSGaVUHJyDTewjMetj4wudzTjDoD0t_eEgOaCLr1M6p4eKBzlKYbF-gRNsnK_9QLqqcHB84jixKO3H3dymoUIjZJBu9ArPJUYMMFjARcb6disxiVEYcRZVdYOE13TFzw6xW_RpsacCD6

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Sep 2021 11:58:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E36C 143 B
163 B 15ms
15ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUl0VXww5jnEHq0JJhFVIfudryV1ABy8DANKEBrWwrHC-PQM6uaJMA0sBTRr6-w
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1999195670&adf=2116733728&pi=t.aa~a.3879375043~rp.4&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2230&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280&nras=6&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4100&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=13&uci=a!d&btvi=5&fsb=1&xpc=0oLA1pSCsl&p=https%3A//cl.login-vp.com&dtd=33

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 13 Sep 2021 11:04:30 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3228
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame ECC5 247 B
807 B 82ms
15ms Document
text/html 108.177.15.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f94.1e100.net

Software

sffe /

Resource Hash

edd55218ed2f423f9e4880b112aec6152e87db38dd78d29d844fd068239fb300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/redir.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-oqOVOLHZ13vXm7OkjI3e1A' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 205
date: Mon, 13 Sep 2021 11:58:18 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 74A3 1 KB
749 B 13ms
13ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 12 Sep 2021 13:21:35 GMT
expires: Mon, 13 Sep 2021 13:21:35 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 81403
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5C00 143 B
163 B 13ms
13ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUl0VXww5jnEHq0JJhFVIfudryV1ABy8DANKEBrWwrHC-PQM6uaJMA0sBTRr6-w
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=90&adk=1414120600&adf=3471499128&pi=t.aa~a.3879372586~rp.1&w=730&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=730x90&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=0&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280%2C350x280%2C730x280&nras=7&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=245&ady=4464&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=14&uci=a!e&btvi=6&fsb=1&xpc=SpDLA2y9Xp&p=https%3A//cl.login-vp.com&dtd=36

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 13 Sep 2021 11:04:30 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3228
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CDA4 1 KB
749 B 14ms
14ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 12 Sep 2021 13:21:35 GMT
expires: Mon, 13 Sep 2021 13:21:35 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 81403
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 0B08 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b480d7d88511671f2b5fd1ba3f7f8e12504d49686e6dc361bee008c7d5642362

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4C56 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 74a12607f8178d3a48c05199c331a162c66cf2afe61957baac078a750ff2be9d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 9249 23 KB
9 KB 13ms
13ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C84yX_EY0bnpoRPE2_gq9eepEAS55T3gzaQDMEhIsOypddUwY3ls4TEXd3Bln_Jo_S7HLdHpSbbYNgLYrBRHUUfxvvW2Zlnedofg_FdNkT-qD8XdJJg85tM-WqCC3FEfpbaD7INLhhXZFUVcemsNkAVgAxNw&dbm_d=AKAmf-AcgFwqqZmsnTmV4f2tocxaawOnPEmcAlnY9NOHTzW79p3KlB3mgHabKfaPUHxJf-CjK0f1Aq1GR0KQO_Rx6k1W3-Rfcl1OlD85Zx_EI2OKoBM_KRBVZ5C9uvRG0GZmGU3ie4VLYEvVjyxa7Lpy0BKtoIebazMUTjbwP-l5mSC_ljETH6i3IBFihpaDOlOfbpeUTTqxpQRKX02B7C8FXlSPWQZ9im4kwg_aGCtfOY_fexFeg2z06ahFYgA2mA23OcIx7AcByKH0haCTyDnBXt096KovJKCb-Et9uSlqNQTHGQfwzMAPUvBAHarM0NMD62P44Ksc5CVsx_29LAd1zKxod9Oje0mlRgeQIOZNHE9JRZHmtypEMrwA8R3yhBJWv87OhfLOJOPtKowsfBuVo07-R_wIbZhXA5pLZ0QsBWEKSJa_KTNDYnH8jruckA3HqCpO1leK1khcAEHxAYWZdbJbknWA9VdHXZSkEuuIm5j8Q7pYtyiYZXdKAr7T2uukg7N7SlhGsOKSzILPp5CVLm4PdRfDt4UyuzXNrZyGLIRCUaMNym9FTPwl-8kWLUVlFUkzxF2j9UTrYiXESzlUlsU6jaqQh5dPPkURXzecmhNQvSy3iE5Bw0TW3BRs8Rovuew3F0KDoyFp_4gBXAm_7zyOMGLHbMXxxNrdGoQtwKL3hLQJh3v7EAnIoPnU_wYLf4SEbjfdM5MhtBXjDwlWioRJ33durUZdWivSuk6FnMT7ordc41vmaWH_pw1_hgw3Cpkow5_nF-6fV6jcoXlM-Lzp4HtxnNYlluX9ZWBmq9ky2wzO9gBUiN1APRsfULqTmPWCXm5YkhzQwDYvsZuLs192xH7O55FSsU0yTML5gqAQZq4aoMORqNydSSl2BanvGX6Lbea8zK6jYL_2zqxGAmVlpieYRoO_rXe5l4htnch0UsJ1eZGMgonG60V3m2h9RhVI7uy6FiWWd-7u2tz_11NtZ1Br0UXjSpulVLC65y4BT3g5QyHdHEhowIdgB_N8KlXGUpYnkxw6Pl0ck7LpsP2zp9aoYw6SMqwAR3GbqVGReCK-APr8gOW1fCby15ck2nImA5uy9fWOXmpI4v1LQ0m8ZBjeSKW9S5qL42Xxtg64ly1c4Z6eTWLOktwisVWwMfvBp5LXsqHH0tD0ZQ0vzBBpITMnTuk2DKHZkEDaoA3sbEWOkfKYwVJLBLv7IiDrEi3MvhPA0Tfsi4HrRJaED-w7SYilOIPqaIWK4ruNQarn-EmysUnVMAeL98KnAR6UeCJdgAap9zbMmYnja5708pjl9gBqnu2bvfY7iur_J86ao8SWF_88Itur8tDoDDneLPkICRdAbGX8pJlFMxpqFfktdPEPaDvj_ytnNyKaoXAwTYXAYgdFSI4_Mj69rzcbNb7VCZ0ivPvb1OVoi3k_OCyc4h6R15grVB9KXm7ZCVkqB0FU2u9xAGj94L6-N4N98_ManbrVG_D5tt_XlC-PsLOmFqRcxLpqcejx3xIQoi5bLFNtv7AN-REkNonWQEhz3I7Zmj_fKGOsHdf9sLbiypuxvb4w4VqQZk1on3NGMajzUj8z_ieaSZm3wBTMRPGpTM0i33M7MHPYendQtSqs4cgHvWp_UXWvBP1zqtBLd0-MYvQcJMxt0a75pEoHO91Xj9VAE3EIQOmuBHGPfW_77mxhzCj3qOsc7vmUyplkIj8UP2hZOd18TJRWV8kgnOtnqXhXT5iCBEfB-iHYr9Cfa3_hnqIUTpfGxO5vsE3i6XJV9hPNdLlm3DlsINp4rKQe-5cPNA05dQuJLIU4VWNjgtbDPS4a8EVByNxW6-sObjRoefrmp0B5iLwjziM1Kgtcw8u8Y9zxuqggU4EaZC6BJZlMppCJIuhpROczZ1a6RaJvcpcWpJmML5UFwBp8QAURjmO74ij3ZKS9Cbw4dTpumwM0noPO7Jt9EMGDyS1T6RHzRN7-2Q4SHEkMekSZU8mIpjJp3Gtw3mcgIE68T_DUHleUshXZH7ptuER_KGc0ZAc_Fuu_OxTN8rwSxzkb4gtzq9qKKwGPdMk1GgxbnpAWt3KuVaEL5QsYUwba1sg9ANSbyKV0ckaXoPAd6kkaejdC46vNqb3DD-n3h7OYR7JffefbLaBvscpJSUliWtK-yUsGi2kGF8A5ECYVN5fTPFirR97EsXr0_2mqU0dokZ8_5kW1cvRyu-irCmIjYDzKqZErkcNxIymTBH8Fan92aEsbCu-tnfm6JlmXLobbiJJWFW-sFKSQzMaXaVM48379qKnb5reKoD75PJVZv-8k6S1jVbsjeGCPW59eyv93oHwgAJq8qCxE66-22SZChYv9dTWh3OvhUYuva578TzMyf-PdeA3Q-de3pI7WVX12ub-zjxCYWuxGCmwbZDnGh3ffzLx4rvXQN52k4mTUUjVTtlVUX9WX5ddF1e4GGdHbAm6sp7Yjbqhkwz2gmvAQLJXqjUBCjBzHZ1ZtZbn8zMb2-kIsOOU5lDHaVgbKO3rJoUYPeda2AGR-1Yjhj0r9-fGLotR7eJ9LJvsfyaY3e-t_BuJsc5HT7eU_OG23FhtU7DdqEtePh_YLlfGF8FtKTkcZZNnaU6kJTotEezpE6FAH0NxDiLYXrHCpjfWPiifKf_1RlXH26UYnzoUqCh69uzfW0KBBnYwnwEEXTLO1zvZWeEl0GW8Kc_m4kIpxr6KoNGy5CVhs7ckptuwD4FSt5FpBVoBlqYS-IECI44IbcYp5GJKPIFlj60iGO0VjPt_nFbyWdbe8_yeYbhCYL25uh7nnG9nP2-kpDo1Y48Pbmc9RjT3QEukhaJJ9dZyDKcvW8ZMu2mbQDNnPq9WO9-rLZvdM9Xw5HK6ggJibyW_5wnjDiy_uNMVodYELfmy9Vbm9srNSd93kEcsZHJkffthWpvVeLY2zkO9ZbzEEwmrUrV_pvo9KqmEbSuBX&cid=CAASEuRoOPoelrCmfEmrx6c5BkQKZg&rfl=1%2Chttps%253A%252F%252Fcl.login-vp.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f19df5f3569b83172adf37e884e0e4add74a23c3e057cf60336a1fddcb87ab79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 14:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78689
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9258
x-xss-protection: 0
server: cafe
etag: 9058358164849487988
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 14:06:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/elements/html/ Frame 9249 8 KB
3 KB 14ms
14ms Script
text/javascript 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 17:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65815
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 17:41:23 GMT

POST view
googleads4.g.doubleclick.net/pcs/ Frame 9249 0
0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9249 41 KB
15 KB 14ms
14ms Script
text/javascript 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 12:14:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 517421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 12:14:37 GMT

GET LookbookBackAtIt-Kids-300x250.jpg
s0.2mdn.net/4834926/ Frame 9249 0
0

GET pixel
cm.g.doubleclick.net/ Frame 2F13 0
0

GET rrum
dsum-sec.casalemedia.com/ Frame 2F13 0
0

GET pixel
cm.g.doubleclick.net/ Frame 2F13 0
0

GET getuid
ib.adnxs.com/ Frame 2F13 0
0

GET
H3 200 iframe.html
p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame ECC5 0
0 29ms
15ms Document
text/html 108.177.15.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f94.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com
:scheme: https
:path: /v6exp3/iframe.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://p4-a6u56ubemddke-pqfartxgl2klyt4v-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-Gtn2P-8QTZ7WII1zM2XARQ' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
content-length: 1864
date: Mon, 13 Sep 2021 11:58:18 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame FE47 0
0 13ms
13ms Document
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-6983341711079297&output=html&h=280&adk=1414751727&adf=2469088672&pi=t.aa~a.3790863795~rp.3&w=350&fwrn=4&fwrnh=100&lmt=1631534297&rafmt=1&to=qs&pwprc=5000380890&psa=0&format=350x280&url=https%3A%2F%2Fcl.login-vp.com%2Froblox-facebook&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631534297938&bpp=1&bdt=2231&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D969d35120a4624aa-22a91c862ccb00f2%3AT%3D1631534297%3ART%3D1631534297%3AS%3DALNI_MbZ9TOYseeOSU6JIw5oJ6z1mKXJqg&prev_fmts=0x0%2C378x280%2C730x280%2C730x280&nras=5&correlator=7097293150838&frm=20&pv=1&ga_vid=1282964859.1631534297&ga_sid=1631534297&ga_hid=1839197286&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=1005&ady=2618&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062423%2C31062297&oid=3&pvsid=596249320331672&pem=912&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=12&uci=a!c&btvi=4&fsb=1&xpc=btW9D3jIO5&p=https%3A//cl.login-vp.com&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 12 Sep 2021 13:21:35 GMT
expires: Mon, 13 Sep 2021 13:21:35 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 81403
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9249 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb6d0537b52609e1352657b02af8b8bd9b9a70f4eb5ac96dd8df3b3e936808d1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST event.png
tps20234.doubleverify.com/ Frame 697D 0
0

POST bsevent.gif
tps20511.doubleverify.com/ Frame 84B5 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 84B5 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 0B08 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 965F 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 4C56 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 9249 0
0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012108302037000/ 189 KB
55 KB 105ms
14ms Script
text/javascript 74.125.133.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108302037000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17a98c3a25d9fd399347ac5d2a961ef3d614fb16ee9ea5b8eb1b3e0c71020839

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 309055
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55349
x-xss-protection: 0
server: sffe
date: Thu, 09 Sep 2021 22:07:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0eac791049ec30cd"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 22:07:24 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012108302037000/v0/ 13 KB
5 KB 128ms
37ms Script
text/javascript 74.125.133.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108302037000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

406a56550c0b340121333c0eadf8f659cf194b2a39c656104e4de08915f4841e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 311657
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4999
x-xss-protection: 0
server: sffe
date: Thu, 09 Sep 2021 21:24:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e8df1836486da3b4"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 21:24:02 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012108302037000/v0/ 89 KB
28 KB 129ms
38ms Script
text/javascript 74.125.133.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108302037000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7805b83ba0d102b16fc4aee78be0a14a5214523f324fe5a8fdc8f8e264360d40

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 499865
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28502
x-xss-protection: 0
server: sffe
date: Tue, 07 Sep 2021 17:07:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "76def82bacc9cde5"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 17:07:14 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012108302037000/v0/ 4 KB
2 KB 137ms
46ms Script
text/javascript 74.125.133.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108302037000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd277b479bb821c52d95118a17fb1529671d81106fc011675c4912491f06f147

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 499865
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1636
x-xss-protection: 0
server: sffe
date: Tue, 07 Sep 2021 17:07:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c23f720ccc1ab13e"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 17:07:14 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012108302037000/v0/ 40 KB
13 KB 135ms
44ms Script
text/javascript 74.125.133.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012108302037000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021090701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97d66c75b11c855491b00fc9433a6bdf0d6b59dda36321842b1530c19154e9bd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 314571
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12821
x-xss-protection: 0
server: sffe
date: Thu, 09 Sep 2021 20:35:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "3720e45e7e363a69"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 20:35:28 GMT

GET
DATA 200
OK truncated
/ 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e5d6ebec8fc61adc8f53eca6acbf5e3250e4637ebb20d4d7d3c745b17ce8810

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 535046552063115369
tpc.googlesyndication.com/simgad/ 8 KB
8 KB 57ms
56ms Image
image/png 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/535046552063115369?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkn0XYvBE63SIJ3p5mlAcBgTfumBA

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5a6c96a25546852c40847019b0f19534215da478d2a7c962a236597d96d2045

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 11:58:19 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 13:06:20 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8089
x-xss-protection: 0
expires: Tue, 13 Sep 2022 11:58:19 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ 2 KB
2 KB 15ms
14ms Image
image/png 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 12:14:54 GMT
x-content-type-options: nosniff
server: cafe
age: 85404
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 13 Sep 2021 12:14:54 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ 295 B
319 B 14ms
13ms Image
image/png 108.177.15.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

108.177.15.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-196-21-34.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 22:03:02 GMT
x-content-type-options: nosniff
server: cafe
age: 50116
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 13 Sep 2021 22:03:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ 0
0 15ms
14ms Image
text/html 142.250.110.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTvn7FwYD3DWjCY0b-6JbRFnzzd9bNtIAJkImrJGaYdsXXNGkHD1ssk67vkzsc05bMWnn4tj569a2XofiKGmJv6uyhhng
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.110.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wf-in-f147.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ 0
0 18ms
17ms Image
text/html 74.125.206.157
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CZNhi2jw_YfH6HNGCxwKGjpfoC_yVuN1kiZK76_0N4-G6kpIOEAEgueiOTmDJBqAB8Zqg0AHIAQLgAgCoAwHIAwiqBOsBT9BkYUa6F0ml97g00cnhSgitDXFnvNzC-4wLB5dyfmRMCS4BxHdZIRh0HoFcewrGFUqhUmTBjgHshLheqofrqwCJ0y5luYZ-2UZe53eUOFmzEi0q2_5j9-p3cPaHzKHmvx6-hdZFMdMXoJtDf8L0dAecuZotmVFnjNz39HsY3nmmmZq1Cwpri5bofY876h5Y7NbgBqt3GCTrQ9Nr4KN8ujyKBzuyxQGOsUfrSA2jEg6zUgGNjh1ZnarCwiIwZK5IeL-Mh6gpZH27qrwb1dzQm39ztO2a6Ym6X0hcLHYRySmFcij9f-RDTuPLQ8AE0OfpzNYD4AQBkgUECAQYAZIFBAgFGASgBgKAB_fk368CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAfIHBBDQ0CjSCAcIiGEQARgdgAoDyAsB2BMM0BUBgBcBshceChwIABIUcHViLTUyNzg5NzM4ODg3ODYzMzQYqd0Y&sigh=IhqCGLPvRO4
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.206.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wk-in-f157.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl.login-vp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

15ms
15ms

Image
text/html

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 66.102.1.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wb-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

date: Mon, 13 Sep 2021 11:58:19 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

POST
H2 200 stream Show response
a3.pubguru.net/ 2 B
352 B 12ms
11ms XHR
text/plain 18.196.21.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a3.pubguru.net/stream?beacon=arinterval

Requested by

Host: m2d.m2.ai
URL: https://m2d.m2.ai/pg.login-vp.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.21.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cl.login-vp.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 13 Sep 2021 11:58:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
access-control-allow-origin: https://cl.login-vp.com
x-frame-options: DENY
content-type: text/plain
x-m2: 1
access-control-expose-headers: X-M2, X-Duration
access-control-allow-credentials: true
x-duration: 4
vary: Origin,Accept-Encoding
x-xss-protection: 1; mode=block

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ 42 B
71 B 17ms
17ms Image
image/gif 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstxb2QiUkX5gs3FU2EhTw2wTLohS5S_4Q2v5z2eEKc_UMQQSVSjeoHPsipNSvWUU72hZ89sEi2wb6RHTJZ_tKFJlMpP9QY6ZV2ppQtwFzx0jvdAqCE2m9apIts&sai=AMfl-YRpRmkJkQrGcBkjyxZ8yrwlL5QgVKD9YdgxNTFZiSUObDYWmDAZbC4RjFqw14uVmoZc0cIHCMHRg63p7MQQV0Pmruzpt6MyGVz84mb74vsRp1ta1JvoRQxR2M17C49R&sig=Cg0ArKJSzDkViJ6zYOKSEAE&id=ampim&o=0,0&d=1600,1200&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=55&tls=1055&g=100&h=100&tt=1055&r=v&avms=ampa&adk=2757179949

Requested by

Host: cl.login-vp.com
URL: https://cl.login-vp.com/roblox-facebook

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS