urlscan.io logo urlscan.io
SecurityTrails logo

user.shadowfs.click Open in urlscan Pro
5.78.40.153  Public Scan

Go To Rescan Add Verdict Report
URL: https://user.shadowfs.click/
Submission: On May 04 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 22 IPs in 8 countries across 25 domains to perform 77 HTTP transactions. The main IP is 5.78.40.153, located in Portland, United States and belongs to HETZNER-CLOUD3-AS, DE. The main domain is user.shadowfs.click.
TLS certificate: Issued by R3 on May 4th 2023. Valid for: 3 months.
This is the only time user.shadowfs.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 5.78.40.153 212317 (HETZNER-C...)
10 207.38.103.240 5693 (DATABANK-...)
3 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
2 104.20.218.77 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
2 6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 27 2606:4700::68... 13335 (CLOUDFLAR...)
2 23.215.22.18 16625 (AKAMAI-AS)
1 104.18.13.14 13335 (CLOUDFLAR...)
2 89.207.16.210 41041 (VCLK-EU-SE)
2 63.215.202.140 41041 (VCLK-EU-SE)
1 1 18.157.250.25 16509 (AMAZON-02)
1 34.250.66.43 16509 (AMAZON-02)
2 2 99.81.121.200 16509 (AMAZON-02)
1 1 2.23.197.190 16625 (AKAMAI-AS)
2 2 185.80.39.216 27381 (CASALE-MEDIA)
1 35.244.159.8 15169 (GOOGLE)
2 2 185.64.189.115 62713 (AS-PUBMATIC)
1 1 185.64.189.110 62713 (AS-PUBMATIC)
1 188.65.124.66 41690 (DAILYMOTI...)
1 69.173.144.165 26667 (RUBICONPR...)
2 2 3.75.62.37 16509 (AMAZON-02)
1 1 142.250.185.226 15169 (GOOGLE)
2 2 185.94.180.125 35220 (SPOTX-AMS)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
77 22
1    5.78.40.153 (Portland, United States)

ASN212317 (HETZNER-CLOUD3-AS, DE)
PTR: static.153.40.78.5.clients.your-server.de
user.shadowfs.click
10    207.38.103.240 (Whittier, United States)

ASN5693 (DATABANK-LATISYS, US)
translation2.paralink.com
3    2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
7    2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    104.20.218.77 (None, )

ASN13335 (CLOUDFLARENET, US)
www.statcounter.com
c.statcounter.com
3    2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
6    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
partner.googleadservices.com
googleads.g.doubleclick.net
2    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
2    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
2    2606:4700::6812:ddb (United States)

ASN13335 (CLOUDFLARENET, US)
tags.expo9.exponential.com
27    2606:4700::6812:18ad (United States)

ASN13335 (CLOUDFLARENET, US)
s.tribalfusion.com
a.tribalfusion.com
2    23.215.22.18 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-22-18.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    104.18.13.14 (None, )

ASN13335 (CLOUDFLARENET, US)
a4.tribalfusion.com
2    89.207.16.210 (Amsterdam, Netherlands)

ASN41041 (VCLK-EU-SE, US)
PTR: ams04-convex-float1.dotomi.com
direct.ad.cpe.dotomi.com
2    63.215.202.140 (Amsterdam, Netherlands)

ASN41041 (VCLK-EU-SE, US)
PTR: ams01-nessy-float2.dotomi.com
ads.dotomi.com
1    18.157.250.25 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-250-25.eu-central-1.compute.amazonaws.com
aa.agkn.com
1    34.250.66.43 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-66-43.eu-west-1.compute.amazonaws.com
beacon.krxd.net
2    99.81.121.200 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-121-200.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    2.23.197.190 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-23-197-190.deploy.static.akamaitechnologies.com
tags.bluekai.com
2    185.80.39.216 (Canada)

ASN27381 (CASALE-MEDIA, CA)
dsum-sec.casalemedia.com
1    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
2    185.64.189.115 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
1    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
1    188.65.124.66 (Paris, France)

ASN41690 (DAILYMOTION For peering related business, please mail peering@dailymotion.com, FR)
PTR: ingress-03-pub-prod-ix7.vip.dailymotion.com
public-prod-dspcookiematching.dmxleo.com
1    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    3.75.62.37 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
1    142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net
cm.g.doubleclick.net
2    185.94.180.125 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
3    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
Apex Domain
Subdomains		 Transfer
28 tribalfusion.com
s.tribalfusion.com — Cisco Umbrella Rank: 2774
a4.tribalfusion.com — Cisco Umbrella Rank: 25834
a.tribalfusion.com — Cisco Umbrella Rank: 1248
18 KB
10 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 129
tpc.googlesyndication.com — Cisco Umbrella Rank: 177
234 KB
10 paralink.com
translation2.paralink.com
49 KB
6 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 67
cm.g.doubleclick.net — Cisco Umbrella Rank: 313
6 KB
4 dotomi.com
direct.ad.cpe.dotomi.com — Cisco Umbrella Rank: 18351
cookie.sync.ad.cpe.dotomi.com Failed
ads.dotomi.com — Cisco Umbrella Rank: 96903
113 KB
3 pubmatic.com
image6.pubmatic.com — Cisco Umbrella Rank: 1037
simage2.pubmatic.com — Cisco Umbrella Rank: 976
1 KB
3 google.com
adservice.google.com — Cisco Umbrella Rank: 130
www.google.com — Cisco Umbrella Rank: 16
2 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 91
21 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 114
91 KB
2 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 1061
1 KB
2 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 402
563 B
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 876
2 KB
2 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 277
2 KB
2 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1680
8 KB
2 exponential.com
tags.expo9.exponential.com — Cisco Umbrella Rank: 20492
28 KB
2 google.de
adservice.google.de — Cisco Umbrella Rank: 5261
698 B
2 statcounter.com
www.statcounter.com — Cisco Umbrella Rank: 16929
c.statcounter.com — Cisco Umbrella Rank: 11467
15 KB
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 447
239 B
1 dmxleo.com
public-prod-dspcookiematching.dmxleo.com — Cisco Umbrella Rank: 3562
123 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 707
305 B
1 bluekai.com
tags.bluekai.com — Cisco Umbrella Rank: 822
473 B
1 krxd.net
beacon.krxd.net — Cisco Umbrella Rank: 807
339 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 775
481 B
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 1132
607 B
1 shadowfs.click
user.shadowfs.click
49 KB
77 25
Domain Requested by
16 s.tribalfusion.com tags.expo9.exponential.com
translation2.paralink.com
11 a.tribalfusion.com 3 redirects s.tribalfusion.com
10 translation2.paralink.com user.shadowfs.click
translation2.paralink.com
pagead2.googlesyndication.com
7 pagead2.googlesyndication.com user.shadowfs.click
pagead2.googlesyndication.com
tpc.googlesyndication.com
5 googleads.g.doubleclick.net 2 redirects pagead2.googlesyndication.com
3 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 www.googletagmanager.com user.shadowfs.click
www.googletagmanager.com
2 sync.search.spotxchange.com 2 redirects
2 ups.analytics.yahoo.com 2 redirects
2 image6.pubmatic.com 2 redirects
2 dsum-sec.casalemedia.com 2 redirects
2 dpm.demdex.net 2 redirects
2 ads.dotomi.com translation2.paralink.com
2 direct.ad.cpe.dotomi.com secure.cdn.fastclick.net
2 secure.cdn.fastclick.net s.tribalfusion.com
2 tags.expo9.exponential.com translation2.paralink.com
2 adservice.google.com pagead2.googlesyndication.com
2 adservice.google.de pagead2.googlesyndication.com
1 www.google.com tpc.googlesyndication.com
1 cm.g.doubleclick.net 1 redirects
1 pixel.rubiconproject.com s.tribalfusion.com
1 public-prod-dspcookiematching.dmxleo.com s.tribalfusion.com
1 simage2.pubmatic.com 1 redirects
1 us-u.openx.net s.tribalfusion.com
1 tags.bluekai.com 1 redirects
1 beacon.krxd.net s.tribalfusion.com
1 aa.agkn.com 1 redirects
1 a4.tribalfusion.com translation2.paralink.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 c.statcounter.com www.statcounter.com
1 www.statcounter.com user.shadowfs.click
1 user.shadowfs.click
0 cookie.sync.ad.cpe.dotomi.com Failed secure.cdn.fastclick.net
77 34
Subject Issuer Validity Valid
user.shadowfs.click
R3		 2023-05-04 -
2023-08-02		 3 months crt.sh
*.smartlinkcorp.com
R3		 2023-04-29 -
2023-07-28		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
statcounter.com
Sectigo RSA Domain Validation Secure Server CA		 2022-11-24 -
2023-12-24		 a year crt.sh
*.googleadservices.com
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
*.google.de
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
exponential.com
Cloudflare Inc ECC CA-3		 2023-02-19 -
2024-02-19		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-07 -
2023-06-06		 a year crt.sh
secure.cdn.fastclick.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-02 -
2023-12-02		 a year crt.sh
ad.cpe.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2022-05-31 -
2023-07-02		 a year crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2022-08-09 -
2023-09-10		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2022-07-21 -
2023-08-21		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-04-17 -
2023-07-10		 3 months crt.sh

This page contains 20 frames:

Primary Page: https://user.shadowfs.click/
Frame ID: 76A03EDE4F19BECC053632543C8A95BE
Requests: 28 HTTP requests in this frame

Frame: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Frame ID: 2CB0DF6D2E8C001B7AB040E277079875
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177611512099267&output=html&h=60&slotname=9482378846&adk=2700236837&adf=111965227&pi=t.ma~as.9482378846&w=468&lmt=1683179515&url=https%3A%2F%2Fuser.shadowfs.click%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179515690&bpp=13&bdt=813&idt=257&shv=r20230502&mjsv=m202305010101&ptt=5&saldr=sa&abxe=1&prev_slotnames=3835126996&correlator=8045199016870&frm=20&pv=2&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=135&ady=208&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Dfef3qZ383&p=https%3A//user.shadowfs.click&dtd=266
Frame ID: 2EBD5BA5D1C574B049D4450DD5F93982
Requests: 1 HTTP requests in this frame

Frame: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Frame ID: 7150ECFAE4C754EF3F256A23BF478417
Requests: 9 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aRmVRCmHnA5EUh3WEy46nZdprrZdYs3V1VMV0GjMnTb45FvUWFfZcVA35QafRQVZbqSd3O1dfuVAjn2cY30UUZcTPmq26U9RmBK4HnO1dBZbmt2u36UQ5Vv6TGrjWVMfPP3xWW33UUb22UeuWEjsWa3dPTUFSsjZcPFqsRdfaUVM54U6nodeOYTew3dMHPGbB2mrZcmd6pVd7eYrvcXrUh0aqMPbJZbWU3sVHJWWPeqnPTtOEEFu6iKm7umyd7psv9nou&mediaDataID=2713736&mediaName=frame.html
Frame ID: FE3F57723AAC62300A09C181F79329C0
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aSmW0L4dMGSGjD4AFZapterVWfdYUbbXF790a6nRbUZbWFM0WtQWnrjmQrvMYqFr3E3k4qnRmqrKYbZb7WHbUm6rZdpsvnmWQJ5Tn72Hmp4PvZaprrIYGUSYcvV0crMpaJ25bFPVF7AVAQTPTnRQsZbqQdbw0WvpT6Yy2VQYXrZbKUA2n26n7RmjK2HZbrXWYAnW2O36vW4s78UVMjVVf8SAvnTdJSUrj35UZamUqjvTTJlQbbZcQVPdr7FrrDqZaUQymvArUyTeE9Ag1Qq&mediaDataID=5578346&mediaName=frame.html
Frame ID: 31851F103212E019A81FCA70D7AAFDC1
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aUmUKl5EUe5teq56ZbZbmr3Zb0G3XXVZb30VBnnTjR3UY2TUZbHVAvTQEY0PGBNQHUyYdnoVmrp2VJWXFULVmqt4mQcRPbB4HvOXHMAmW2O4mBS3sQ7UcY6VVB8R6FvWd3TWFbP3FEqVEYvVaJ6PaUZbRVFCPUErRtj9WsjW2Fuxmtqr0qqp3HbCSsfA5AMKmdarVWfa0UYjXFJh1EurRbJZbWUBSTtUomFQxtmZanuBarvTTTNAXQyd7puBm9Zao&mediaDataID=6807466&mediaName=frame.html
Frame ID: E183CA9D8BCB910C9BC221B98C60C31F
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aVmWCZcSGjF2mQZcmtInVH380bY81Fjj0qZaMRb3BUU3STdr4nrJxQUJrXaJO5aUj2qfXmEjIYU3hUWbPoAnZancMqmtnC5TM75dZaN4mvLmbbZc0GUSYcJ01GFnnavU5U3UTrfZcW6vXQqQQQVZboPHBM0tjuVAYO2GZb0XrFLVmqw4AZb8R67K3tZbp1trZcmWTO36MP3sUbVVvkVsjgSmJwUdF3WrMP5bA3WEjvnnm6mQ6ZarVPtr7BnpoubS7qxvA7YUsfdw7Zb1PTvqv2Xuyt&mediaDataID=7665496&mediaName=frame.html
Frame ID: 05A2B8A837727226635C27FFB12EDEE1
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aWmW8ZaXWYJpdEv3mYP5sM9VcM6VcJeSPMoUdQQUr7P5r6nVqrvWTraPqZbGSGQLRbmpRWniWsj34UupodioXTqM4WMESVvZa26rHpWXnUHQ70bUbYFZbi1aIMRUJGWUY0THQWmUJtQbBNYqFp4aBi5arRmqBEYFYcUdrPoAnBnV7mmHrJ2aZbi2d6r3PfLprYZb0GQU1VrU1VfvmqrV3UF2TFnZcUAMnPqbQsDqomoqyMtuKnFX3NH2jOPi9obTQsTEZbq97nuaPNWn&mediaDataID=6530936&mediaName=frame.html
Frame ID: 3728A441CA5037C1BE9A464DC5D9999F
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aXmW8Za5tet3A7ZbpbnI0VbS1cn1XV7ymTB43UQPVFjZcUP33QEMQPcnsPWYs1dvnTmjv2cQUXrFBT6qo2PUbPA7E4dUqXHJApt6o4PBT4cj6VcrcWsFlPAvoUWFVWrbY5UEuWTrrWaMlQaBKRcFKQrivRd36WcfP4bepodiOXaev4dvZdPcrB56rKptPnVWj80bQ71bf61qarSFFFUUBSTtJWorZb4PbrNN7ypNQqjua6cP7EjpEIQoC2uVUQgYCe5VErowqBV2y&mediaDataID=6546596&mediaName=frame.html
Frame ID: C83FDC771C50E31DF2C9B4226150DF59
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aYmWCZc2mQZcmdAqTWfcYrbd1U7k0qaqSrnZbUUU5VtUWobjoQUjNXEvt4qYd4T71oErCYbFfUdr0mPnJpGvtodrH5qUh3HiN3PFGmFbJYVfP1cU00cZbxnEF43bFWTFfHUmvTPaM3PVvMQHUw0HjmW6np2VMYXbBZaTPao2PUePmMA4WQO1tBZcmWZaO4PUT3sQ9Vcn8UVZb7SAUwTHJUUrMP5b2uUqn2VaJlsnuKoSmLsrv6pRqZcpSEw0on5W8r3MbrhNoAd3rftNPkAjJ&mediaDataID=5436426&mediaName=frame.html
Frame ID: 1067290AE23F3049CF619014FB846AFC
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a0mWKZdpdEx36YS5cY9UGraUcJ7SmQMTWM3Urf23bAuUaQmWTQlPTMZcRs3BPbumPWfcWGr54bevmtit0qmN2HvBSsjG4AQHmtayUdQcYrfa1Ube1qZapRFrZbUbBXTtQ4oFJxPrjoXqny5aUh5Tr0nTfIYUfbUtnWm67JpGvwoWfD5EQ72Wmp4A7EmrYJ0GUS1cMYXsJomEfV2rJTVFnZcUA7TREvqQVZbMsRiwwoXnm6aeM9TpyBm7mnnCvUiIsrF7qSE0NT3xN35do6&mediaDataID=6719746&mediaName=frame.html
Frame ID: A5A837F2BBFB294B22469CE1F712AE20
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a2mYpumdArVWJ80rv8YFjgXautSFrHTbvSVt31mrZbxRFJtXE3y4Tfl5EjQmEMB1b39UWjXm67DnVvomHnE3aQl5Heq5mjGpbYEYsfWXsF2XGFvnaFQ3rv2VrnFUAv3RqMQQGUnPH7r1HvtWPnx3sUUXrnZdTA6r4mF6R6bK2HZbrXW3AmH2n5PQ14cYdVcraUcFjP6rnTtUUTUnX3b2uUqjvTTUKQaBFqpeZbnmYmqH6SpDiuyPJ5QRM1OSZbxwoTimteqvredTo6WySXZcycrUlLhQdG&mediaDataID=8039566&mediaName=frame.html
Frame ID: A319151980368981E753FD84A9EE0A02
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=anmX9qRr6mPHvaVsMP2UqoodysYEXx3d3ZdQG7A4mUHmtarUWJhYbUbXrU60TqqPrBHUFQSVWBUmbJpRUjpYaYo3aZbf5arRoEBIXFUaTWMRoAUZcpsrpmtUJ3qZbg5tet3m7GnUMIYs30YVFY1sjvmTj43rvPVrMBW6f2REMQQsZbtStJr0WvwVmYm4GUX0UnKVmTr26MhQmjC3tBt0WBApd2o363y5GjgpDm8s92hqPEgrRaRQCESv6QRmQ2WR9XLsQAdsHZa0o63Q4qMWn2t5DE&mediaDataID=9148826&mediaName=frame.html
Frame ID: 0965A500547CAE7F7C73A93FAA65D992
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aomWgZbT6Mw4sY4YrFITmup2PvdRmFC3drO0WUZandAo3mMP4srgUcrcVGn7R6FxWtZbWUbjP3FTwWarnTTQ8Qq3LQcJZdQrEvPW3iVcbR5U6nodaMYqyM2HYZdQsrH2mQZcmWAyTtJdYU3kYbYi1T6rSb3ZbUrM5VHFXmUYpRUjNYTFs3TJa5E75mTBEYbFaWHBQoAQZcpsQvpWvB2aBf3tmN3AvGprv7Xsf0NDyYxDXuWTuau62WOpFbxFAmsBiOUP2OsRFZconFVNd&mediaDataID=6347136&mediaName=frame.html
Frame ID: 66A0A83B7E54F6F1E4905F8D8A145142
Requests: 2 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=apmVgFoTbB1rZb8UHb1om3IpG3oodYL2Er73tao5AbGpbYZbYGn0Xcv31cronavW5FZbVVU7ZcW6fVPTMYScUmQWJxYH7rW63p4cMUYbZbZcU6im2P37QmrA3tnO0dBLpdEx3PYY5VrcUVMjWVMjS6QwTdQ3UUB23UPtWTbnTTQlQEBZdQVZbCQUusRtY7WVjR2F2oodZam0EXm3trHPcvE4mJHmdXyVWZbZcXUfkNm6ix7UqqbInoP6OnCny26ie2cfF0bLv3i&mediaDataID=4056396&mediaName=frame.html
Frame ID: B33CDE33A6304A9A4AFA437BF5E30DEB
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230502/r20190131/zrt_lookup.html
Frame ID: BC1A41D5D5F800E616B2DBAEB2E24CBB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&adk=1812271804&adf=3025194257&lmt=1683179518&plat=3%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x1080_r&format=0x0&url=https%3A%2F%2Fuser.shadowfs.click%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179518527&bpp=8&bdt=3650&idt=9&shv=r20230502&mjsv=m202305010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D11b64bd122092486-22169a2db8dd00f1%3AT%3D1683179515%3ART%3D1683179515%3AS%3DALNI_MYmjh4x3r47BWpGQJAvuZrR_Uwhng&gpic=UID%3D00000bf52f6b54be%3AT%3D1683179515%3ART%3D1683179515%3AS%3DALNI_MbuuN3o48mUqntlTqGplOigWMOtNw&prev_slotnames=3835126996%2C9482378846%2C8684128999&nras=1&correlator=8045199016870&frm=20&pv=1&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&tmod=314072632&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=m202304270101&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=100
Frame ID: 4C0EBE8C033FE4A67D1D69B3043F914D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 99C3F04FAE37BC6478389A2627312C0A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 3AE60E13DD36A33388CE5D6FBBB0DED0
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Free Translation Online

Detected technologies

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/pagead/show_ads\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • statcounter\.com/counter/counter

Page Statistics

77
Requests

83 %
HTTPS

33 %
IPv6

25
Domains

34
Subdomains

22
IPs

8
Countries

634 kB
Transfer

1360 kB
Size

30
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&h=90&slotname=3835126996&adk=694708807&adf=192984970&pi=t.ma~as.3835126996&w=728&lmt=1683179515&url=https%3A%2F%2Fuser.shadowfs.click%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179515666&bpp=16&bdt=789&idt=242&shv=r20230502&mjsv=m202305010101&ptt=5&saldr=sa&abxe=1&correlator=8045199016870&frm=20&pv=2&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=103&ady=8&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=0BjVnikp87&p=https%3A//user.shadowfs.click&dtd=273 HTTP 302
  • https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Request Chain 23
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&h=250&slotname=8684128999&adk=420014537&adf=3304480808&pi=t.ma~as.8684128999&w=300&lmt=1683179515&url=https%3A%2F%2Fuser.shadowfs.click%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179515728&bpp=14&bdt=851&idt=231&shv=r20230502&mjsv=m202305010101&ptt=5&saldr=sa&abxe=1&prev_slotnames=3835126996%2C9482378846&correlator=8045199016870&frm=20&pv=1&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=610&ady=208&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Xomq15odmW&p=https%3A//user.shadowfs.click&dtd=248 HTTP 302
  • https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Request Chain 51
  • https://aa.agkn.com/adscores/g.pixel?sid=9212295768&_puid=18072662258724981996 HTTP 302
  • https://a.tribalfusion.com/i.match?p=b23&u=216613104506000539082
Request Chain 52
  • https://a.tribalfusion.com/i.match?p=b22&u=18072662258724981996&redirect=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dexponential%26partner_uid%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=exponential&partner_uid=18072662258724981996
Request Chain 53
  • https://dpm.demdex.net/ibs:dpid=22054&dpuuid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db13%26u%3D%24%7BDD_UUID%7D HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22054&dpuuid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db13%26u%3D%24%7BDD_UUID%7D HTTP 302
  • https://a.tribalfusion.com/i.match?p=b13&u=16317029597586578252517935345373765394
Request Chain 54
  • https://tags.bluekai.com/site/4229?id=18072662258724981996&redir=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db3%26u%3D%24_BK_UUID HTTP 302
  • https://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
Request Chain 55
  • https://dsum-sec.casalemedia.com/rrum?cm_dsp_id=131&external_user_id=18072662258724981996&cb=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db20%26u%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db20%26u%3D&cm_dsp_id=131&external_user_id=18072662258724981996&C=1 HTTP 302
  • https://a.tribalfusion.com/i.match?p=b20&u=ZFNH-QmWdO5DTPYQOK2kxQAA
Request Chain 57
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%253A//simage2.pubmatic.com/AdServer/Pug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%2526piggybackCookie%253D18072662258724981996%2526r%253Dhttps%25253A//a.tribalfusion.com/i.match%25253Fp%25253Db11%252526u%25253D%252524%25257BPUBMATIC_UID%25257D HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%253A//simage2.pubmatic.com/AdServer/Pug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%2526piggybackCookie%253D18072662258724981996%2526r%253Dhttps%25253A//a.tribalfusion.com/i.match%25253Fp%25253Db11%252526u%25253D%252524%25257BPUBMATIC_UID%25257D&rdf=1 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=18072662258724981996&r=https%3A//a.tribalfusion.com/i.match%3Fp%3Db11%26u%3D%24%7BPUBMATIC_UID%7D HTTP 302
  • https://a.tribalfusion.com/i.match?p=b11&u=9741A409-6683-4714-85C5-8D781CE69EE8
Request Chain 58
  • https://a.tribalfusion.com/i.match?p=b24&u=18072662258724981996&redirect=https%3A%2F%2Fpublic-prod-dspcookiematching.dmxleo.com%2Fdspreply%3FdspId%3D15%26dspUserId%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=15&dspUserId=18072662258724981996
Request Chain 59
  • https://a.tribalfusion.com/i.match?p=b10&u=18072662258724981996&redirect=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=111756&nid=3856&put=18072662258724981996&expires=180
Request Chain 60
  • https://ups.analytics.yahoo.com/ups/57628/sync?uid=18072662258724981996&_origin=1&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57628/sync?uid=18072662258724981996&_origin=1&redir=true&verify=true HTTP 302
  • https://a.tribalfusion.com/i.match?p=b17&u=y-J7P2To5E2uj8rmAK5QySEYdao09sYrM-~A
Request Chain 61
  • https://cm.g.doubleclick.net/pixel?google_nid=exp&google_cm&google_sc&google_ula=2786954&google_hm=18072662258724981996 HTTP 302
  • https://a.tribalfusion.com/i.match?p=b6&u=adx&google_gid=CAESELfW_ieZW1lCLZVhVszhBGk&google_cver=1&google_ula=2786954,0
Request Chain 62
  • https://sync.search.spotxchange.com/partner?adv_id=8731&uid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db19%26u%3D$SPOTX_USER_ID HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=8731&uid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db19%26u%3D$SPOTX_USER_ID&__user_check__=1&sync_id=c83dbcea-ea3f-11ed-a3f4-1e3504c40106 HTTP 302
  • https://a.tribalfusion.com/i.match?p=b19&u=c83dbc9d-ea3f-11ed-a3f4-1e3504c40106

77 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
user.shadowfs.click/ 		49 KB
49 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://user.shadowfs.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
5.78.40.153 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS
static.153.40.78.5.clients.your-server.de
Software
nginx/1.24.0 / ASP.NET
Resource Hash
92f5bbf071461322a478e811a172def984d73be81483f811078604061cf0dbbc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private
content-length
49916
content-type
text/html
date
Thu, 04 May 2023 05:51:54 GMT
server
nginx/1.24.0
x-powered-by
ASP.NET
styles.css
translation2.paralink.com/css/ 		13 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://translation2.paralink.com/css/styles.css?v=1.4
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
85333a5c85f48ba8562864ee65c09fc66b27bf84f93ee5e211d4037b5d4cbe49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:56:00 GMT
Server
Microsoft-IIS/6.0
ETag
"0e023144c75d91:81963"
X-Powered-By
ASP.NET
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
12807
scripts.js
translation2.paralink.com/js/ 		25 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translation2.paralink.com/js/scripts.js?v=1.4
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
cb82756945488e584e6b5491e0496f2e89b883be641659ce2810e776de55db84

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:58:00 GMT
Server
Microsoft-IIS/6.0
ETag
"06caa5b4c75d91:ad59a"
X-Powered-By
ASP.NET
Content-Type
application/x-javascript
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
25319
js
www.googletagmanager.com/gtag/ 		118 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-93979-3
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a7d8eb6a9fa2148842fe969612f3fe2c3cc71fbff33ab65e976f8646ef9fcee5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
46791
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 04 May 2023 05:51:55 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ 		91 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d01ba5d4a2afaf880810d7234e5fdd7175dd9651a55db850511a02428ab981c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:54 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
32246
x-xss-protection
0
server
cafe
etag
6917898834488732394
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 04 May 2023 05:51:54 GMT
Support-Our-Development-Ko.png
translation2.paralink.com/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/Support-Our-Development-Ko.png
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
14ca4f15c5e4303ffc5f603d34a2111202466af56d0eb54f8d27bc17685a9d98

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:81963"
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2667
ImT-logo.gif
translation2.paralink.com/img/ 		752 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/ImT-logo.gif
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
f49a95f1bd2919438a04dd4bb7257f5467acf0bbe6ec109701a4683be4d68e28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:56 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:ad59a"
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
752
box.gif
translation2.paralink.com/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/box.gif
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
cb524103f938b9db7f4d6ccf41250cd22458f1dfb83701231f018c9f20fea5be

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:81963"
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1024
speaker.gif
translation2.paralink.com/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/speaker.gif
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
4db411de619cc7d9410fef1f170f1ca80d56560fe9ab64820cb386adc462a65b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:56 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:ad59a"
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1774
ImT-logo-big.gif
translation2.paralink.com/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/ImT-logo-big.gif
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
26676486e16da3a08f2deae4f3838148491e0b9cb206d7bc20c17d05b2135f9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:81963"
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1099
counter.js
www.statcounter.com/counter/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.statcounter.com/counter/counter.js
Requested by
Host: user.shadowfs.click
URL: https://user.shadowfs.click/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.218.77 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59ac0476d0a140dcf8bd9874994a790cf6b68609380c1695eb908d26aeece838

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 27 Apr 2023 14:44:22 GMT
server
cloudflare
age
34608
etag
W/"644a8a46-ad2f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7c1e79854c3f92c3-FRA
expires
Thu, 04 May 2023 08:15:07 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/ 		354 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0bb7641448a1967cafe84d0532d67b8eb9c5a52132240910bd5d25df976394b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
122102
x-xss-protection
0
server
cafe
etag
4333446535344921765
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 04 May 2023 05:51:55 GMT
t2-set.png
translation2.paralink.com/img/ 		965 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://translation2.paralink.com/img/t2-set.png
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/css/styles.css?v=1.4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
dd105974ecac0027e187ae1ca2cc3aa4d0ec1d688fb0b2ac26794b46822678f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/css/styles.css?v=1.4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 04 May 2023 05:51:55 GMT
Last-Modified
Sat, 22 Apr 2023 18:57:00 GMT
Server
Microsoft-IIS/6.0
ETag
"026e7374c75d91:81963"
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
965
js
www.googletagmanager.com/gtag/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-L5G253TYHN&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-93979-3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-93979-3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 04 May 2023 05:05:04 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
2811
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Thu, 04 May 2023 07:05:04 GMT
js
www.googletagmanager.com/gtag/ 		115 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-93979-13&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-93979-3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
80a4294a7576b0b6edba6fdd66f658820220b7b37182756e9d9888a154a003b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
45713
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 04 May 2023 05:51:55 GMT
t.php
c.statcounter.com/ 		193 B
473 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.statcounter.com/t.php?sc_project=1124078&u1=DDA4DCB6D06E4F43FCDAED32AD9FBA32&java=1&security=835b2414&sc_snum=1&sess=1aec61&p=0&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//user.shadowfs.click/&t=Free%20Translation%20Online&invisible=1&sc_rum_e_s=1756&sc_rum_e_e=1765&sc_rum_f_s=0&sc_rum_f_e=1723&get_config=true
Requested by
Host: www.statcounter.com
URL: https://www.statcounter.com/counter/counter.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.218.77 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f62edd4d137ec20dfecec1bc8b0baade5c633956bd1cff9db4f4614e7085f425

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
content-type
application/json
access-control-allow-origin
https://user.shadowfs.click
p3p
policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-credentials
true
cf-ray
7c1e7985dcbd92c3-FRA
expires
Mon, 26 Jul 1997 05:00:00 GMT
collect
www.google-analytics.com/j/ 		1 B
210 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=999137728&t=pageview&_s=1&dl=https%3A%2F%2Fuser.shadowfs.click%2F&ul=en-us&de=UTF-8&dt=Free%20Translation%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1733956544&gjid=1286597408&cid=1701536409.1683179516&tid=UA-93979-3&_gid=1054311209.1683179516&_r=1&gtm=457e3510&jsscut=1&z=422502436
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://user.shadowfs.click/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:55 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://user.shadowfs.click
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=999137728&t=pageview&_s=1&dl=https%3A%2F%2Fuser.shadowfs.click%2F&ul=en-us&de=UTF-8&dt=Free%20Translation%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAUABAAAAACAAI~&jid=1398206393&gjid=1646391165&cid=1701536409.1683179516&tid=UA-93979-13&_gid=1054311209.1683179516&_r=1&gtm=457e3510&jsscut=1&z=1075025916
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://user.shadowfs.click/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:55 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://user.shadowfs.click
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookie.js
partner.googleadservices.com/gampad/ 		395 B
607 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=user.shadowfs.click&callback=_gfp_s_&client=ca-pub-5683423891543025
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f8be69f1a240e2d70cd9f04af0f4349b090bee3da831a47fdf605f39020e961
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
254
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		107 B
532 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=user.shadowfs.click
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
457 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=user.shadowfs.click
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
TF_PROMTOnline_ROSB_728x90.asp
translation2.paralink.com/BANNERS/Ad_networks/TF/ Frame 2CB0
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&h=90&slotname=3835126996&adk=694708807&adf=192984970&pi=t.ma~as.3835126996&w=728&lmt=1683179515&url=https%3...
  • https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
262 B
560 B 		Document
General
Check archive.org
Download Go to
Full URL
https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
bee43429a2bfeecd51d6e8cd109936eb2131580c631fa7110d71b9e2fec24a09

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-control
private
Connection
Keep-Alive
Content-Length
262
Content-Type
text/html
Date
Thu, 04 May 2023 05:51:56 GMT
Keep-Alive
timeout=5, max=99
Server
Microsoft-IIS/6.0
X-Powered-By
ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 04 May 2023 05:51:56 GMT
location
https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 2EBD 		603 B
508 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177611512099267&output=html&h=60&slotname=9482378846&adk=2700236837&adf=111965227&pi=t.ma~as.9482378846&w=468&lmt=1683179515&url=https%3A%2F%2Fuser.shadowfs.click%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179515690&bpp=13&bdt=813&idt=257&shv=r20230502&mjsv=m202305010101&ptt=5&saldr=sa&abxe=1&prev_slotnames=3835126996&correlator=8045199016870&frm=20&pv=2&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=135&ady=208&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Dfef3qZ383&p=https%3A//user.shadowfs.click&dtd=266
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 04 May 2023 05:51:55 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
TF_PROMTOnline_ROSB_300x250.asp
translation2.paralink.com/BANNERS/Ad_networks/TF/ Frame 7150
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&h=250&slotname=8684128999&adk=420014537&adf=3304480808&pi=t.ma~as.8684128999&w=300&lmt=1683179515&url=https...
  • https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
264 B
562 B 		Document
General
Check archive.org
Download Go to
Full URL
https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.38.103.240 Whittier, United States, ASN5693 (DATABANK-LATISYS, US),
Reverse DNS
Software
Microsoft-IIS/6.0 / ASP.NET
Resource Hash
7550f8b99af7bb456f19ae659dd656fba05043249af4c7bc7b2e95b0877de1b1

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-control
private
Connection
Keep-Alive
Content-Length
264
Content-Type
text/html
Date
Thu, 04 May 2023 05:51:56 GMT
Keep-Alive
timeout=5, max=96
Server
Microsoft-IIS/6.0
X-Powered-By
ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 04 May 2023 05:51:56 GMT
location
https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
tags.js
tags.expo9.exponential.com/tags/PROMTOnline/ROSB/ Frame 2CB0 		59 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ddb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4bf029421b50e472cc3d8680b0f4d8c28e87f3cbaa7e829cba0e9f636612307

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
p3p
CP="NOI DEVo TAIa OUR BUS"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
14134
x-function
151
last-modified
Fri, 17 Feb 2023 18:05:21 GMT
server
cloudflare
x-reuse-index
7
etag
7225909275064877723
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=3600, private
cf-ray
7c1e798a2f0fbb3b-FRA
expires
Thu, 04 May 2023 06:51:57 GMT
tags.js
tags.expo9.exponential.com/tags/PROMTOnline/ROSB/ Frame 7150 		59 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ddb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4bf029421b50e472cc3d8680b0f4d8c28e87f3cbaa7e829cba0e9f636612307

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:56 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
p3p
CP="NOI DEVo TAIa OUR BUS"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
14134
x-function
151
last-modified
Fri, 17 Feb 2023 18:05:21 GMT
server
cloudflare
x-reuse-index
1
etag
7225909275064877723
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=3600, private
cf-ray
7c1e798acfa9bb3b-FRA
expires
Thu, 04 May 2023 06:51:56 GMT
displayAd.js
s.tribalfusion.com/ Frame 7150 		677 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.9&th=9452953186
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e212a9cf3950541b1d5d2536cc58355d29082ba98f4459e78fa7373c18296cf2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:56 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-function
153
last-modified
Fri, 17 Feb 2023 18:04:49 GMT
server
cloudflare
x-reuse-index
12
vary
Accept-Encoding
content-type
application/x-javascript
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
private
cf-ray
7c1e798c296830c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
328
expires
Wed, 02 Aug 2023 05:51:56 GMT
j.ad
s.tribalfusion.com/ Frame 7150 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.29&th=9452953186&tagKey=284174728&site=promtonline&adSpace=rosb&center=1&size=300x250&env=display&url=https%3A%2F%2Fuser.shadowfs.click%2F&f=1&p=19441210&tKey=admneM1VFomTrP3UUQTr7G1pMlPMb2tr&a=1&adContainerId=richmedia_2&rnd=19439299
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f33f11d7af780a7b01d7f5ac6957862261cfd844b784dca4875d26bf5d7c79d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-function
101
server
cloudflare
x-reuse-index
54
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
private, no-cache, no-store, proxy-revalidate
cf-ray
7c1e798d2a8330c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2549
expires
0
displayAd.js
s.tribalfusion.com/ Frame 2CB0 		679 B
884 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.9&th=9452953186
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
637b6c2e02478ff3a9a9c6d4073749ae843f7d59c565e35e9496b17b86c57ed2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-function
153
last-modified
Fri, 17 Feb 2023 18:04:49 GMT
server
cloudflare
x-reuse-index
21
vary
Accept-Encoding
content-type
application/x-javascript
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
private
cf-ray
7c1e798e28299bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
331
expires
Wed, 02 Aug 2023 05:51:57 GMT
pubcode.min.js
secure.cdn.fastclick.net/js/adcodes/ Frame 7150 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/adcodes/pubcode.min.js?sid=25418&placement_id=ee56d712-b0ff-4180-edc0-26516b03e619&version=1.4&exc=1
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.29&th=9452953186&tagKey=284174728&site=promtonline&adSpace=rosb&center=1&size=300x250&env=display&url=https%3A%2F%2Fuser.shadowfs.click%2F&f=1&p=19441210&tKey=admneM1VFomTrP3UUQTr7G1pMlPMb2tr&a=1&adContainerId=richmedia_2&rnd=19439299
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-22-18.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
aeb4e91ace2fa32384064caa3eb3d1355e938bbb7d0a86b0b5280ee649d24544

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
last-modified
Wed, 10 Jun 2020 22:08:18 GMT
server
Apache
etag
"269f-5a7c214d0c865-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
3788
ipg
a4.tribalfusion.com/ Frame 7150 		43 B
311 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a4.tribalfusion.com/ipg?ip6=2001:ac8:20:271::1e&kv=%7B%22ord%22%3A%201620581093%2C%20%22clientID%22%3A%20223253%7D
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.13.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e798e8d333813-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT
get.media
direct.ad.cpe.dotomi.com/w/ Frame 7150 		228 B
334 B 		Script
General
Check archive.org
Download Go to
Full URL
https://direct.ad.cpe.dotomi.com/w/get.media?sid=25418&d=j&t=n&vcm_acv=1.4&version=1.12&c=0.6214551785603155&vcm_ifr=1&vcm_xy=-1..-1&vcm_vv=true&vcm_vm=false&vcm_pr=https%3A//translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp&vcm_tr=&vcm_cr=&mo=0&placement_id=ee56d712-b0ff-4180-edc0-26516b03e619
Requested by
Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/adcodes/pubcode.min.js?sid=25418&placement_id=ee56d712-b0ff-4180-edc0-26516b03e619&version=1.4&exc=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
89.207.16.210 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
ams04-convex-float1.dotomi.com
Software
nginx /
Resource Hash
6afe4d57f148c96c3b70941422938d146318305c00d50bb1f7cd20c97c3743cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
cache-control
no-cache
server
nginx
content-length
228
expires
0
cookie_sync
cookie.sync.ad.cpe.dotomi.com/w/ Frame 7150 		0
0
j.ad
s.tribalfusion.com/ Frame 2CB0 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.29&th=9452953186&tagKey=284174728&site=promtonline&adSpace=rosb&center=1&size=728x90&env=display&url=https%3A%2F%2Fuser.shadowfs.click%2F&f=1&p=19434899&tKey=aomneMWmYm3sZb1XU3ZcVAyoR9QSPMbcjy&a=1&adContainerId=richmedia_2&rnd=19434953
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/PROMTOnline/ROSB/tags.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
864596a16ec945a8cf78c29b868ad759c3bf9e1b90d1c77c606222410a842e94

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-function
101
server
cloudflare
x-reuse-index
21
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
private, no-cache, no-store, proxy-revalidate
cf-ray
7c1e798f59749bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1157
expires
0
pubcode.min.js
secure.cdn.fastclick.net/js/adcodes/ Frame 2CB0 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/adcodes/pubcode.min.js?sid=25418&placement_id=48e12fda-6e23-40cd-9806-87de6911b0f8&version=1.4&exc=1
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.29&th=9452953186&tagKey=284174728&site=promtonline&adSpace=rosb&center=1&size=728x90&env=display&url=https%3A%2F%2Fuser.shadowfs.click%2F&f=1&p=19434899&tKey=aomneMWmYm3sZb1XU3ZcVAyoR9QSPMbcjy&a=1&adContainerId=richmedia_2&rnd=19434953
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-215-22-18.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
aeb4e91ace2fa32384064caa3eb3d1355e938bbb7d0a86b0b5280ee649d24544

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
last-modified
Wed, 10 Jun 2020 22:08:18 GMT
server
Apache
etag
"269f-5a7c214d0c865-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
3788
get.media
direct.ad.cpe.dotomi.com/w/ Frame 2CB0 		226 B
331 B 		Script
General
Check archive.org
Download Go to
Full URL
https://direct.ad.cpe.dotomi.com/w/get.media?sid=25418&d=j&t=n&vcm_acv=1.4&version=1.12&c=0.18626489593062456&vcm_ifr=1&vcm_xy=-1..-1&vcm_vv=true&vcm_vm=false&vcm_pr=https%3A//translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp&vcm_tr=&vcm_cr=&mo=0&placement_id=48e12fda-6e23-40cd-9806-87de6911b0f8
Requested by
Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/adcodes/pubcode.min.js?sid=25418&placement_id=48e12fda-6e23-40cd-9806-87de6911b0f8&version=1.4&exc=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
89.207.16.210 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
ams04-convex-float1.dotomi.com
Software
nginx /
Resource Hash
682e1a29c31f2cd945c2b587525f11f2274308d64fb4fdafbb10b7d6fd66277b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
cache-control
no-cache
server
nginx
content-length
226
expires
0
cookie_sync
cookie.sync.ad.cpe.dotomi.com/w/ Frame 2CB0 		0
0
300x250_default.jpg
ads.dotomi.com/banners/fia/ Frame 7150 		61 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.dotomi.com/banners/fia/300x250_default.jpg
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.215.202.140 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
ams01-nessy-float2.dotomi.com
Software
nginx /
Resource Hash
55e0d9358cb60205eff06d2ce1215f07b5945abd16d4fda876519421c850ca46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
last-modified
Thu, 25 Jan 2018 03:01:12 GMT
server
nginx
etag
"5a694878-f542"
content-type
image/jpeg
access-control-allow-origin
*
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
accept-ranges
bytes
content-length
62786
p.media
s.tribalfusion.com/ Frame FE3F 		259 B
492 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aRmVRCmHnA5EUh3WEy46nZdprrZdYs3V1VMV0GjMnTb45FvUWFfZcVA35QafRQVZbqSd3O1dfuVAjn2cY30UUZcTPmq26U9RmBK4HnO1dBZbmt2u36UQ5Vv6TGrjWVMfPP3xWW33UUb22UeuWEjsWa3dPTUFSsjZcPFqsRdfaUVM54U6nodeOYTew3dMHPGbB2mrZcmd6pVd7eYrvcXrUh0aqMPbJZbWU3sVHJWWPeqnPTtOEEFu6iKm7umyd7psv9nou&mediaDataID=2713736&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b43256e464e52861b2655acd6a7644046e6e428fc40e872bf1ca0a485b67abe0

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911be69bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
14
p.media
s.tribalfusion.com/ Frame 3185 		264 B
494 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aSmW0L4dMGSGjD4AFZapterVWfdYUbbXF790a6nRbUZbWFM0WtQWnrjmQrvMYqFr3E3k4qnRmqrKYbZb7WHbUm6rZdpsvnmWQJ5Tn72Hmp4PvZaprrIYGUSYcvV0crMpaJ25bFPVF7AVAQTPTnRQsZbqQdbw0WvpT6Yy2VQYXrZbKUA2n26n7RmjK2HZbrXWYAnW2O36vW4s78UVMjVVf8SAvnTdJSUrj35UZamUqjvTTJlQbbZcQVPdr7FrrDqZaUQymvArUyTeE9Ag1Qq&mediaDataID=5578346&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aeeffe54b428aecc63e886a7551610bdaf53cb77e1818c0b6ce28d038d9bdc9e

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911be79bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
20
p.media
s.tribalfusion.com/ Frame E183 		302 B
520 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aUmUKl5EUe5teq56ZbZbmr3Zb0G3XXVZb30VBnnTjR3UY2TUZbHVAvTQEY0PGBNQHUyYdnoVmrp2VJWXFULVmqt4mQcRPbB4HvOXHMAmW2O4mBS3sQ7UcY6VVB8R6FvWd3TWFbP3FEqVEYvVaJ6PaUZbRVFCPUErRtj9WsjW2Fuxmtqr0qqp3HbCSsfA5AMKmdarVWfa0UYjXFJh1EurRbJZbWUBSTtUomFQxtmZanuBarvTTTNAXQyd7puBm9Zao&mediaDataID=6807466&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d74c46e2342b1219dfc005675253d1ca07a5d0540e2732ffaaf31a76ac7b6900

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911beb9bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
16
p.media
s.tribalfusion.com/ Frame 05A2 		201 B
443 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aVmWCZcSGjF2mQZcmtInVH380bY81Fjj0qZaMRb3BUU3STdr4nrJxQUJrXaJO5aUj2qfXmEjIYU3hUWbPoAnZancMqmtnC5TM75dZaN4mvLmbbZc0GUSYcJ01GFnnavU5U3UTrfZcW6vXQqQQQVZboPHBM0tjuVAYO2GZb0XrFLVmqw4AZb8R67K3tZbp1trZcmWTO36MP3sUbVVvkVsjgSmJwUdF3WrMP5bA3WEjvnnm6mQ6ZarVPtr7BnpoubS7qxvA7YUsfdw7Zb1PTvqv2Xuyt&mediaDataID=7665496&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c052797bf33ae51138a6ea6c40bf6bfa354afb596f996db5123131873a327e9

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911bef9bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
16
p.media
s.tribalfusion.com/ Frame 3728 		275 B
500 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aWmW8ZaXWYJpdEv3mYP5sM9VcM6VcJeSPMoUdQQUr7P5r6nVqrvWTraPqZbGSGQLRbmpRWniWsj34UupodioXTqM4WMESVvZa26rHpWXnUHQ70bUbYFZbi1aIMRUJGWUY0THQWmUJtQbBNYqFp4aBi5arRmqBEYFYcUdrPoAnBnV7mmHrJ2aZbi2d6r3PfLprYZb0GQU1VrU1VfvmqrV3UF2TFnZcUAMnPqbQsDqomoqyMtuKnFX3NH2jOPi9obTQsTEZbq97nuaPNWn&mediaDataID=6530936&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11e188f48eaa897489508837d7c4149bec7d83ae8cecc1efcd3c03e1d2ec6c6a

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911bf59bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
18
p.media
s.tribalfusion.com/ Frame C83F 		381 B
557 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aXmW8Za5tet3A7ZbpbnI0VbS1cn1XV7ymTB43UQPVFjZcUP33QEMQPcnsPWYs1dvnTmjv2cQUXrFBT6qo2PUbPA7E4dUqXHJApt6o4PBT4cj6VcrcWsFlPAvoUWFVWrbY5UEuWTrrWaMlQaBKRcFKQrivRd36WcfP4bepodiOXaev4dvZdPcrB56rKptPnVWj80bQ71bf61qarSFFFUUBSTtJWorZb4PbrNN7ypNQqjua6cP7EjpEIQoC2uVUQgYCe5VErowqBV2y&mediaDataID=6546596&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6338dc7ac8b0b7c57001b977906b354877dfc61ef80c5a813fd7287dd88fdea3

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79911bf89bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
15
p.media
s.tribalfusion.com/ Frame 1067 		324 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aYmWCZc2mQZcmdAqTWfcYrbd1U7k0qaqSrnZbUUU5VtUWobjoQUjNXEvt4qYd4T71oErCYbFfUdr0mPnJpGvtodrH5qUh3HiN3PFGmFbJYVfP1cU00cZbxnEF43bFWTFfHUmvTPaM3PVvMQHUw0HjmW6np2VMYXbBZaTPao2PUePmMA4WQO1tBZcmWZaO4PUT3sQ9Vcn8UVZb7SAUwTHJUUrMP5b2uUqn2VaJlsnuKoSmLsrv6pRqZcpSEw0on5W8r3MbrhNoAd3rftNPkAjJ&mediaDataID=5436426&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81afba79cc0a63b8e3847a8d79313484056a636255f3ae3f7652210daa9bc515

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79912bff9bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
13
p.media
s.tribalfusion.com/ Frame A5A8 		447 B
586 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=a0mWKZdpdEx36YS5cY9UGraUcJ7SmQMTWM3Urf23bAuUaQmWTQlPTMZcRs3BPbumPWfcWGr54bevmtit0qmN2HvBSsjG4AQHmtayUdQcYrfa1Ube1qZapRFrZbUbBXTtQ4oFJxPrjoXqny5aUh5Tr0nTfIYUfbUtnWm67JpGvwoWfD5EQ72Wmp4A7EmrYJ0GUS1cMYXsJomEfV2rJTVFnZcUA7TREvqQVZbMsRiwwoXnm6aeM9TpyBm7mnnCvUiIsrF7qSE0NT3xN35do6&mediaDataID=6719746&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5738f1cfe318c106548eb2df59a41861acbe9243031dbea2f7ef0cd45efd70d0

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79912c019bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
21
728x90_default.jpg
ads.dotomi.com/banners/fia/ Frame 2CB0 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.dotomi.com/banners/fia/728x90_default.jpg
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.215.202.140 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
ams01-nessy-float2.dotomi.com
Software
nginx /
Resource Hash
d7960a5629a02fe2b69570bf38169acaa0ad2576acdeead81921ea03253df7ac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translation2.paralink.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:57 GMT
last-modified
Thu, 25 Jan 2018 03:04:26 GMT
server
nginx
etag
"5a69493a-c9ec"
content-type
image/jpeg
access-control-allow-origin
*
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
accept-ranges
bytes
content-length
51692
p.media
s.tribalfusion.com/ Frame A319 		309 B
527 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=a2mYpumdArVWJ80rv8YFjgXautSFrHTbvSVt31mrZbxRFJtXE3y4Tfl5EjQmEMB1b39UWjXm67DnVvomHnE3aQl5Heq5mjGpbYEYsfWXsF2XGFvnaFQ3rv2VrnFUAv3RqMQQGUnPH7r1HvtWPnx3sUUXrnZdTA6r4mF6R6bK2HZbrXW3AmH2n5PQ14cYdVcraUcFjP6rnTtUUTUnX3b2uUqjvTTUKQaBFqpeZbnmYmqH6SpDiuyPJ5QRM1OSZbxwoTimteqvredTo6WySXZcycrUlLhQdG&mediaDataID=8039566&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50c41b4d4d525d40f1afb9588f2b093cd8a547f9480a752e83abeada0ff90aed

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79912c069bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
12
p.media
s.tribalfusion.com/ Frame 0965 		279 B
507 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=anmX9qRr6mPHvaVsMP2UqoodysYEXx3d3ZdQG7A4mUHmtarUWJhYbUbXrU60TqqPrBHUFQSVWBUmbJpRUjpYaYo3aZbf5arRoEBIXFUaTWMRoAUZcpsrpmtUJ3qZbg5tet3m7GnUMIYs30YVFY1sjvmTj43rvPVrMBW6f2REMQQsZbtStJr0WvwVmYm4GUX0UnKVmTr26MhQmjC3tBt0WBApd2o363y5GjgpDm8s92hqPEgrRaRQCESv6QRmQ2WR9XLsQAdsHZa0o63Q4qMWn2t5DE&mediaDataID=9148826&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a6071b6f540c8843363a0b2e0e9074eb51c96d142b2f530a95ab3a8af1ca947

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79912c099bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:58 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
26
p.media
s.tribalfusion.com/ Frame 66A0 		213 B
450 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=aomWgZbT6Mw4sY4YrFITmup2PvdRmFC3drO0WUZandAo3mMP4srgUcrcVGn7R6FxWtZbWUbjP3FTwWarnTTQ8Qq3LQcJZdQrEvPW3iVcbR5U6nodaMYqyM2HYZdQsrH2mQZcmWAyTtJdYU3kYbYi1T6rSb3ZbUrM5VHFXmUYpRUjNYTFs3TJa5E75mTBEYbFaWHBQoAQZcpsQvpWvB2aBf3tmN3AvGprv7Xsf0NDyYxDXuWTuau62WOpFbxFAmsBiOUP2OsRFZconFVNd&mediaDataID=6347136&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb447029f17a299ebfbb15c5aa0b654fea909d7ff430b03e3df70d74818df1fa

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79912c0d9bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:57 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
23
p.media
s.tribalfusion.com/ Frame B33C 		242 B
458 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/p.media?clickID=apmVgFoTbB1rZb8UHb1om3IpG3oodYL2Er73tao5AbGpbYZbYGn0Xcv31cronavW5FZbVVU7ZcW6fVPTMYScUmQWJxYH7rW63p4cMUYbZbZcU6im2P37QmrA3tnO0dBLpdEx3PYY5VrcUVMjWVMjS6QwTdQ3UUB23UPtWTbnTTQlQEBZdQVZbCQUusRtY7WVjR2F2oodZam0EXm3trHPcvE4mJHmdXyVWZbZcXUfkNm6ix7UqqbInoP6OnCny26ie2cfF0bLv3i&mediaDataID=4056396&mediaName=frame.html
Requested by
Host: translation2.paralink.com
URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
698679f700ef18b6c63aee3558305a2f85791068631dca8f67f357c193516bb5

Request headers

Referer
https://translation2.paralink.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, no-cache, no-store, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
7c1e79913c109bee-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 04 May 2023 05:51:58 GMT
expires
0
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
vary
Accept-Encoding
x-function
102
x-reuse-index
20
i.match
a.tribalfusion.com/ Frame 05A2
Redirect Chain
  • https://aa.agkn.com/adscores/g.pixel?sid=9212295768&_puid=18072662258724981996
  • https://a.tribalfusion.com/i.match?p=b23&u=216613104506000539082
43 B
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b23&u=216613104506000539082
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aVmWCZcSGjF2mQZcmtInVH380bY81Fjj0qZaMRb3BUU3STdr4nrJxQUJrXaJO5aUj2qfXmEjIYU3hUWbPoAnZancMqmtnC5TM75dZaN4mvLmbbZc0GUSYcJ01GFnnavU5U3UTrfZcW6vXQqQQQVZboPHBM0tjuVAYO2GZb0XrFLVmqw4AZb8R67K3tZbp1trZcmWTO36MP3sUbVVvkVsjgSmJwUdF3WrMP5bA3WEjvnnm6mQ6ZarVPtr7BnpoubS7qxvA7YUsfdw7Zb1PTvqv2Xuyt&mediaDataID=7665496&mediaName=frame.html
Protocol
H2
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e7993790630c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
server
AAWebServer
access-control-allow-methods
GET, POST, OPTIONS
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location
https://a.tribalfusion.com/i.match?p=b23&u=216613104506000539082
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires
0
usermatch.gif
beacon.krxd.net/ Frame E183
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b22&u=18072662258724981996&redirect=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dexponential%26partner_uid%3D%24TF_USER_ID_ENC%24
  • https://beacon.krxd.net/usermatch.gif?partner=exponential&partner_uid=18072662258724981996
0
339 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=exponential&partner_uid=18072662258724981996
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aUmUKl5EUe5teq56ZbZbmr3Zb0G3XXVZb30VBnnTjR3UY2TUZbHVAvTQEY0PGBNQHUyYdnoVmrp2VJWXFULVmqt4mQcRPbB4HvOXHMAmW2O4mBS3sQ7UcY6VVB8R6FvWd3TWFbP3FEqVEYvVaJ6PaUZbRVFCPUErRtj9WsjW2Fuxmtqr0qqp3HbCSsfA5AMKmdarVWfa0UYjXFJh1EurRbJZbWUBSTtUomFQxtmZanuBarvTTTNAXQyd7puBm9Zao&mediaDataID=6807466&mediaName=frame.html
Protocol
H2
Server
34.250.66.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-250-66-43.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
beacon-n015-dub-prod.krxd.net
date
Thu, 04 May 2023 05:51:58 GMT
cache-control
private, no-cache, no-store
x-request-time
D=24 t=1683179518
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
76
content-type
text/html
location
https://beacon.krxd.net/usermatch.gif?partner=exponential&partner_uid=18072662258724981996
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e799328b030c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
i.match
a.tribalfusion.com/ Frame 3185
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22054&dpuuid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db13%26u%3D%24%7BDD_UUID%7D
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22054&dpuuid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db13%26u%3D%24%7BDD_UUID%7D
  • https://a.tribalfusion.com/i.match?p=b13&u=16317029597586578252517935345373765394
43 B
603 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b13&u=16317029597586578252517935345373765394
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aSmW0L4dMGSGjD4AFZapterVWfdYUbbXF790a6nRbUZbWFM0WtQWnrjmQrvMYqFr3E3k4qnRmqrKYbZb7WHbUm6rZdpsvnmWQJ5Tn72Hmp4PvZaprrIYGUSYcvV0crMpaJ25bFPVF7AVAQTPTnRQsZbqQdbw0WvpT6Yy2VQYXrZbKUA2n26n7RmjK2HZbrXWYAnW2O36vW4s78UVMjVVf8SAvnTdJSUrj35UZamUqjvTTJlQbbZcQVPdr7FrrDqZaUQymvArUyTeE9Ag1Qq&mediaDataID=5578346&mediaName=frame.html
Protocol
H3
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e79945fcf9bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

DCS
dcs-prod-irl1-2-v048-077362add.edge-irl1.demdex.com 4 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
tQtNKNkkTA4=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://a.tribalfusion.com/i.match?p=b13&u=16317029597586578252517935345373765394
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
i.match
a.tribalfusion.com/ Frame FE3F
Redirect Chain
  • https://tags.bluekai.com/site/4229?id=18072662258724981996&redir=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db3%26u%3D%24_BK_UUID
  • https://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
43 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aRmVRCmHnA5EUh3WEy46nZdprrZdYs3V1VMV0GjMnTb45FvUWFfZcVA35QafRQVZbqSd3O1dfuVAjn2cY30UUZcTPmq26U9RmBK4HnO1dBZbmt2u36UQ5Vv6TGrjWVMfPP3xWW33UUb22UeuWEjsWa3dPTUFSsjZcPFqsRdfaUVM54U6nodeOYTew3dMHPGbB2mrZcmd6pVd7eYrvcXrUh0aqMPbJZbWU3sVHJWWPeqnPTtOEEFu6iKm7umyd7psv9nou&mediaDataID=2713736&mediaName=frame.html
Protocol
H3
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e79944fc09bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
date
Thu, 04 May 2023 05:51:58 GMT
content-length
0
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
i.match
a.tribalfusion.com/ Frame 3728
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?cm_dsp_id=131&external_user_id=18072662258724981996&cb=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db20%26u%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db20%26u%3D&cm_dsp_id=131&external_user_id=18072662258724981996&C=1
  • https://a.tribalfusion.com/i.match?p=b20&u=ZFNH-QmWdO5DTPYQOK2kxQAA
43 B
406 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b20&u=ZFNH-QmWdO5DTPYQOK2kxQAA
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aWmW8ZaXWYJpdEv3mYP5sM9VcM6VcJeSPMoUdQQUr7P5r6nVqrvWTraPqZbGSGQLRbmpRWniWsj34UupodioXTqM4WMESVvZa26rHpWXnUHQ70bUbYFZbi1aIMRUJGWUY0THQWmUJtQbBNYqFp4aBi5arRmqBEYFYcUdrPoAnBnV7mmHrJ2aZbi2d6r3PfLprYZb0GQU1VrU1VfvmqrV3UF2TFnZcUAMnPqbQsDqomoqyMtuKnFX3NH2jOPi9obTQsTEZbq97nuaPNWn&mediaDataID=6530936&mediaName=frame.html
Protocol
H2
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e7993992230c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 04 May 2023 05:51:58 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://a.tribalfusion.com/i.match?p=b20&u=ZFNH-QmWdO5DTPYQOK2kxQAA
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
0
Expires
0
cm
us-u.openx.net/w/1.0/ Frame C83F 		43 B
305 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/cm?id=b9f5c7de-85f6-48cc-ba86-351b90373b6b&r=https%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db12%26redirect%3Dhttps%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537141727%2526val%253D%2524TF_USER_ID_ENC%2524%26u%3D
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aXmW8Za5tet3A7ZbpbnI0VbS1cn1XV7ymTB43UQPVFjZcUP33QEMQPcnsPWYs1dvnTmjv2cQUXrFBT6qo2PUbPA7E4dUqXHJApt6o4PBT4cj6VcrcWsFlPAvoUWFVWrbY5UEuWTrrWaMlQaBKRcFKQrivRd36WcfP4bepodiOXaev4dvZdPcrB56rKptPnVWj80bQ71bf61qarSFFFUUBSTtJWorZb4PbrNN7ypNQqjua6cP7EjpEIQoC2uVUQgYCe5VErowqBV2y&mediaDataID=6546596&mediaName=frame.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:57 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56
expires
Mon, 26 Jul 1997 05:00:00 GMT
i.match
a.tribalfusion.com/ Frame A5A8
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%253A//simage2.pubmatic.com/AdServer/Pug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%2526piggybackCookie%253D180726622587...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%253A//simage2.pubmatic.com/AdServer/Pug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%2526piggybackCookie%253D180726622587...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=18072662258724981996&r=https%3A//a.tribalfusion.com/i.match%3Fp%3Db11%26u%3D%24%7BPUBMATIC_U...
  • https://a.tribalfusion.com/i.match?p=b11&u=9741A409-6683-4714-85C5-8D781CE69EE8
43 B
457 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b11&u=9741A409-6683-4714-85C5-8D781CE69EE8
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=a0mWKZdpdEx36YS5cY9UGraUcJ7SmQMTWM3Urf23bAuUaQmWTQlPTMZcRs3BPbumPWfcWGr54bevmtit0qmN2HvBSsjG4AQHmtayUdQcYrfa1Ube1qZapRFrZbUbBXTtQ4oFJxPrjoXqny5aUh5Tr0nTfIYUfbUtnWm67JpGvwoWfD5EQ72Wmp4A7EmrYJ0GUS1cMYXsJomEfV2rJTVFnZcUA7TREvqQVZbMsRiwwoXnm6aeM9TpyBm7mnnCvUiIsrF7qSE0NT3xN35do6&mediaDataID=6719746&mediaName=frame.html
Protocol
H2
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e7994198b30c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://a.tribalfusion.com/i.match?p=b11&u=9741A409-6683-4714-85C5-8D781CE69EE8
date
Thu, 04 May 2023 05:51:57 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
dspreply
public-prod-dspcookiematching.dmxleo.com/ Frame A319
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b24&u=18072662258724981996&redirect=https%3A%2F%2Fpublic-prod-dspcookiematching.dmxleo.com%2Fdspreply%3FdspId%3D15%26dspUserId%3D%24TF_USER_ID_ENC%24
  • https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=15&dspUserId=18072662258724981996
0
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=15&dspUserId=18072662258724981996
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=a2mYpumdArVWJ80rv8YFjgXautSFrHTbvSVt31mrZbxRFJtXE3y4Tfl5EjQmEMB1b39UWjXm67DnVvomHnE3aQl5Heq5mjGpbYEYsfWXsF2XGFvnaFQ3rv2VrnFUAv3RqMQQGUnPH7r1HvtWPnx3sUUXrnZdTA6r4mF6R6bK2HZbrXW3AmH2n5PQ14cYdVcraUcFjP6rnTtUUTUnX3b2uUqjvTTUKQaBFqpeZbnmYmqH6SpDiuyPJ5QRM1OSZbxwoTimteqvredTo6WySXZcycrUlLhQdG&mediaDataID=8039566&mediaName=frame.html
Protocol
H2
Server
188.65.124.66 Paris, France, ASN41690 (DAILYMOTION For peering related business, please mail peering@dailymotion.com, FR),
Reverse DNS
ingress-03-pub-prod-ix7.vip.dailymotion.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-dm-lb-name
ingress-nginx-nginx-in-cluster-mt7bz
date
Thu, 04 May 2023 05:51:58 GMT
strict-transport-security
max-age=15724800; includeSubDomains
content-length
0

Redirect headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
257
content-type
text/html
location
https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=15&dspUserId=18072662258724981996
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e799328b530c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 1067
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b10&u=18072662258724981996&redirect=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D111756%26nid%3D3856%26put%3D%24TF_USER_ID_ENC%24%26expires%3D180
  • https://pixel.rubiconproject.com/tap.php?v=111756&nid=3856&put=18072662258724981996&expires=180
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=111756&nid=3856&put=18072662258724981996&expires=180
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aYmWCZc2mQZcmdAqTWfcYrbd1U7k0qaqSrnZbUUU5VtUWobjoQUjNXEvt4qYd4T71oErCYbFfUdr0mPnJpGvtodrH5qUh3HiN3PFGmFbJYVfP1cU00cZbxnEF43bFWTFfHUmvTPaM3PVvMQHUw0HjmW6np2VMYXbBZaTPao2PUePmMA4WQO1tBZcmWZaO4PUT3sQ9Vcn8UVZb7SAUwTHJUUrMP5b2uUqn2VaJlsnuKoSmLsrv6pRqZcpSEw0on5W8r3MbrhNoAd3rftNPkAjJ&mediaDataID=5436426&mediaName=frame.html
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
e06182bf224d96e6550f4595601cdb0b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
499
content-type
text/html
location
https://pixel.rubiconproject.com/tap.php?v=111756&nid=3856&put=18072662258724981996&expires=180
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e799328b330c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
i.match
a.tribalfusion.com/ Frame 66A0
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/57628/sync?uid=18072662258724981996&_origin=1&redir=true
  • https://ups.analytics.yahoo.com/ups/57628/sync?uid=18072662258724981996&_origin=1&redir=true&verify=true
  • https://a.tribalfusion.com/i.match?p=b17&u=y-J7P2To5E2uj8rmAK5QySEYdao09sYrM-~A
43 B
411 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b17&u=y-J7P2To5E2uj8rmAK5QySEYdao09sYrM-~A
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=aomWgZbT6Mw4sY4YrFITmup2PvdRmFC3drO0WUZandAo3mMP4srgUcrcVGn7R6FxWtZbWUbjP3FTwWarnTTQ8Qq3LQcJZdQrEvPW3iVcbR5U6nodaMYqyM2HYZdQsrH2mQZcmWAyTtJdYU3kYbYi1T6rSb3ZbUrM5VHFXmUYpRUjNYTFs3TJa5E75mTBEYbFaWHBQoAQZcpsQvpWvB2aBf3tmN3AvGprv7Xsf0NDyYxDXuWTuau62WOpFbxFAmsBiOUP2OsRFZconFVNd&mediaDataID=6347136&mediaName=frame.html
Protocol
H2
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e7993b93f30c4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://a.tribalfusion.com/i.match?p=b17&u=y-J7P2To5E2uj8rmAK5QySEYdao09sYrM-~A
date
Thu, 04 May 2023 05:51:58 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
i.match
a.tribalfusion.com/ Frame B33C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=exp&google_cm&google_sc&google_ula=2786954&google_hm=18072662258724981996
  • https://a.tribalfusion.com/i.match?p=b6&u=adx&google_gid=CAESELfW_ieZW1lCLZVhVszhBGk&google_cver=1&google_ula=2786954,0
43 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b6&u=adx&google_gid=CAESELfW_ieZW1lCLZVhVszhBGk&google_cver=1&google_ula=2786954,0
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=apmVgFoTbB1rZb8UHb1om3IpG3oodYL2Er73tao5AbGpbYZbYGn0Xcv31cronavW5FZbVVU7ZcW6fVPTMYScUmQWJxYH7rW63p4cMUYbZbZcU6im2P37QmrA3tnO0dBLpdEx3PYY5VrcUVMjWVMjS6QwTdQ3UUB23UPtWTbnTTQlQEBZdQVZbCQUusRtY7WVjR2F2oodZam0EXm3trHPcvE4mJHmdXyVWZbZcXUfkNm6ix7UqqbInoP6OnCny26ie2cfF0bLv3i&mediaDataID=4056396&mediaName=frame.html
Protocol
H3
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e79946fdb9bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://a.tribalfusion.com/i.match?p=b6&u=adx&google_gid=CAESELfW_ieZW1lCLZVhVszhBGk&google_cver=1&google_ula=2786954,0
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
i.match
a.tribalfusion.com/ Frame 0965
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=8731&uid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db19%26u%3D$SPOTX_USER_ID
  • https://sync.search.spotxchange.com/partner?adv_id=8731&uid=18072662258724981996&redir=https%3A//a.tribalfusion.com/i.match%3Fp%3Db19%26u%3D$SPOTX_USER_ID&__user_check__=1&sync_id=c83dbcea-ea3f-11e...
  • https://a.tribalfusion.com/i.match?p=b19&u=c83dbc9d-ea3f-11ed-a3f4-1e3504c40106
43 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.tribalfusion.com/i.match?p=b19&u=c83dbc9d-ea3f-11ed-a3f4-1e3504c40106
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/p.media?clickID=anmX9qRr6mPHvaVsMP2UqoodysYEXx3d3ZdQG7A4mUHmtarUWJhYbUbXrU60TqqPrBHUFQSVWBUmbJpRUjpYaYo3aZbf5arRoEBIXFUaTWMRoAUZcpsrpmtUJ3qZbg5tet3m7GnUMIYs30YVFY1sjvmTj43rvPVrMBW6f2REMQQsZbtStJr0WvwVmYm4GUX0UnKVmTr26MhQmjC3tBt0WBApd2o363y5GjgpDm8s92hqPEgrRaRQCESv6QRmQ2WR9XLsQAdsHZa0o63Q4qMWn2t5DE&mediaDataID=9148826&mediaName=frame.html
Protocol
H3
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.tribalfusion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 May 2023 05:51:58 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
content-type
image/gif; charset=utf-8
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7c1e7994b84e9bee-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Thu, 04 May 2023 05:51:58 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Location
https://a.tribalfusion.com/i.match?p=b19&u=c83dbc9d-ea3f-11ed-a3f4-1e3504c40106
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
1
Connection
keep-alive
Content-Length
43
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		136 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ae60418ed3053361eee6ef25ce3238ddeb547e9eeebec7001515427f9ab0031
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
47083
x-xss-protection
0
server
cafe
etag
3741122687222385065
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 04 May 2023 05:51:58 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230502&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e4241faf7eeb127bc22d69ce42e0bdc9cdaa2b86ab89cb16b487a59febcf6899
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11306
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 04 May 2023 05:51:58 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230502/r20190131/ Frame BC1A 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20230502/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
29286
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4540
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 03 May 2023 21:43:52 GMT
etag
15057649708203361565
expires
Wed, 17 May 2023 21:43:52 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		107 B
166 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=user.shadowfs.click
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
166 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=user.shadowfs.click
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 4C0E 		0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5683423891543025&output=html&adk=1812271804&adf=3025194257&lmt=1683179518&plat=3%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x1080_r&format=0x0&url=https%3A%2F%2Fuser.shadowfs.click%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179518527&bpp=8&bdt=3650&idt=9&shv=r20230502&mjsv=m202305010101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D11b64bd122092486-22169a2db8dd00f1%3AT%3D1683179515%3ART%3D1683179515%3AS%3DALNI_MYmjh4x3r47BWpGQJAvuZrR_Uwhng&gpic=UID%3D00000bf52f6b54be%3AT%3D1683179515%3ART%3D1683179515%3AS%3DALNI_MbuuN3o48mUqntlTqGplOigWMOtNw&prev_slotnames=3835126996%2C9482378846%2C8684128999&nras=1&correlator=8045199016870&frm=20&pv=1&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&tmod=314072632&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&alvm=m202304270101&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=100
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305010101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5683423891543025&plah=user.shadowfs.click&bust=31074266
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 04 May 2023 05:51:58 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 99C3 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
36217
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 03 May 2023 19:48:21 GMT
expires
Thu, 02 May 2024 19:48:21 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 3AE6 		783 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
fb35d5065f7e9830354fd449e849fae824709fe0d00c4bb413b0e3e85b17000b
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-AYlGPuiYpCXn1OcyA9ypbw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://user.shadowfs.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
511
content-security-policy
script-src 'report-sample' 'nonce-AYlGPuiYpCXn1OcyA9ypbw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 04 May 2023 05:51:58 GMT
expires
Thu, 04 May 2023 05:51:58 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
WGW0ljRHHlLJrtXsuRq4GtWylHJljqnzeCv2B2VFxAk.js
pagead2.googlesyndication.com/bg/ Frame 99C3 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/WGW0ljRHHlLJrtXsuRq4GtWylHJljqnzeCv2B2VFxAk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5865b49634471e52c9aed5ecb91ab81ad5b29472658ea9f3782bf6076545c409
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 02 May 2023 17:59:19 GMT
content-encoding
br
x-content-type-options
nosniff
age
129159
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14616
x-xss-protection
0
last-modified
Mon, 01 May 2023 14:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 01 May 2024 17:59:19 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 3AE6 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230502&jk=3493227098988243&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers
generate_204
tpc.googlesyndication.com/ Frame 99C3 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?foVoHw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 05:51:58 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230502&jk=3493227098988243&bg=!FhWlFUHNAAYV_mUANf47ADkAdvg8WuBPORMALQTx6MQ1W1ZaYhEREbYYzrOoOTGOWDJO0INtwq32skAcPc6lhDcVNxdnYchGaJYCAAAAZVIAAAALaAEHCgCBlY3jURyTjnckRZjcBd5d42uoXKTGgP5JHsWapODxF0fe4XuWAMc26bOrD1OYNPJZH6eF4x1Inlev_kn-F_hTJPzKoHNinl7v2_WCQr8sByVbQLrkXnRzYtJkuBwpypf3blzvDXkZl_dQwUfuKFK8lUJ-iEKaNbwLsNTBPhWNRjlTmQLd1JYg7s-bnX3uAIh0ax_Yq1MPHTd1v3VZUEVtvGfRKOBHKBa_nQn6cAL33bBpGlOW5Fzcw5S9Y1V9tzSTY0CboV3lxz9tKy1tcHKwCnDxrtV2xfHarK5mkMo1XpxVKypZ2W73GBo5q3Yj1BMuhmfYWOiCZhbdojMmRCTgPxyJhnFWZQsbyQBxaW0Tb7UQF4RjRVoGlzm3mkm04xZKAa9YNfDmdDrj0ng8Rhb7Np2GC8woSezddGiPqktGOdN5YURBVXsE8PFZpXPo2PQUijmpnnG1gH8cEoPvcSW2N1gg3GhsZQ8rvVM2IvE2eT2xbuRFdzamal3xBtZuDo3gS14lSvrM4XYFyIjFnpHoAh9b-PpCvIdwPgw6tbMPjOQ4jYpepU0tJvQV6mbeI54Dg-GY7JaaHTTFxavPhjTs-CTbaMUaNmoY3px3nor8Pe2A9-jv0y80akluOVqdp9w3MyBG3AAe1O2CMQhkqO1thIJ5xibT_s5qvfvkhOq5xMDnoYxQxisiT58w3rFwNL9JQJohVJ9VTvKJqZi8ZLSSJAmkepc4Qix66PMQ5gn9dRimMgqpAOGxZ4NIbd8LTIK-nK6BDc_4YC0ij2e5sbtmRk9kivWj4-B0EKZaJZsJuEsw8-0qTyMEXkx0v2r7LbPO_ZoolbzkoRa_VGcvopo0Xp7yXB3bD-DkJSGE_JrlWv5yWqNzG3baisjzjzWLQudMxnUnfu8N3xZ5MFcHcLWmXDsOzNcDHiokEmbN9wLFL21vC3CVhphoFxIym4mKTdcCxff0ZqVi7PR2mMDonZukvL5PZeiWycpKkBNIAU076u6XU1gI1oOj_hyYDuWtbq79e01LbV9JaoET-XSHNLq_cfw315G_BrGzXBeVxYA-HjKiOSm9Ifsw87NVGWGK4EUTz5WTLmform9Fd4hYYtcZp9dR72e1P6crfgC4lFQkIL7Yp9AbnGjzO3GyKTQrZ9EMdA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.shadowfs.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cookie.sync.ad.cpe.dotomi.com
URL
https://cookie.sync.ad.cpe.dotomi.com/w/cookie_sync?sid=25418&cb=0.9416799788463495
Domain
cookie.sync.ad.cpe.dotomi.com
URL
https://cookie.sync.ad.cpe.dotomi.com/w/cookie_sync?sid=25418&cb=0.6221338966132

Verdicts & Comments Add Verdict or Comment

270 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 boolean| credentialless object| PAIRS object| CODES string| PROMTpairs string| MSpairs string| listPR string| Compare string| LOCAL number| PPBflag string| dmn string| TTS string| spellDirs string| PROVIDER number| STOPback string| CTRL number| MAXTEXT string| DETECTED function| ActiveTranslation function| SetLanguage function| PPBcntr function| Init function| ShowHideBack function| GEBI function| txtclear function| Myalert function| AC function| accent function| StartTrans function| DETECT function| TwoLangs function| IfExist function| getLongName function| saveText function| GetBr function| DOWNLOAD_ function| APPS function| DoTrans function| TrimText function| Ok function| getCookie function| setCookie function| setCookieEx function| PRINT function| DOCompare function| LocRedir function| Loader function| COMPARE function| getNewSubmitForm function| createNewFormElement function| DetBox function| BanBuilder function| getCode function| setProvider function| painter function| VerifyProvider function| VerifyProvider_______ function| DoNotSupport function| AvailableServices function| Switch function| IsTTSready function| TTSResult function| PPBalert function| showPPBalert function| DOWNLOAD_COMPARE function| CONTACT function| SaveAllCookies function| gtag object| dataLayer object| google_ad_client object| google_ad_slot object| google_ad_width object| google_ad_height object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state object| google_tag_data object| google_sa_queue function| google_process_slots number| google_unique_id object| google_ad_block object| google_ad_channel object| google_ad_format object| google_ad_host object| google_ad_host_channel object| google_ad_host_tier_id object| google_ad_layout object| google_ad_layout_key object| google_ad_output object| google_ad_region object| google_ad_section object| google_ad_type object| google_ad_unit_key object| google_ad_dom_fingerprint object| google_ad_semantic_area object| google_placement_id object| google_daaos_ts object| google_erank object| google_adtest object| google_allow_expandable_ads object| google_alternate_ad_url object| google_alternate_color object| google_apsail object| google_captcha_token object| google_city object| google_color_bg object| google_color_border object| google_color_line object| google_color_link object| google_color_text object| google_color_url object| google_container_id object| google_content_recommendation_ad_positions object| google_content_recommendation_columns_num object| google_content_recommendation_rows_num object| google_content_recommendation_ui_type object| google_content_recommendation_use_square_imgs object| google_contents object| google_country object| google_cpm object| google_ctr_threshold object| google_cust_age object| google_cust_ch object| google_cust_criteria object| google_cust_gender object| google_cust_id object| google_cust_interests object| google_cust_job object| google_cust_l object| google_cust_lh object| google_cust_u_url object| google_disable_video_autoplay object| google_enable_content_recommendations object| google_enable_ose object| google_encoding object| google_font_face object| google_font_size object| google_frame_id object| google_full_width_responsive_allowed object| efwr object| google_full_width_responsive object| gfwroh object| gfwrow object| gfwroml object| gfwromr object| gfwroz object| gfwrnh object| gfwrnwer object| gfwrnher object| google_gl object| google_hints object| google_image_size object| google_kw object| google_kw_type object| google_language object| google_loeid object| google_max_num_ads object| google_max_radlink_len object| google_max_responsive_height object| google_ml_rank object| google_mtl object| google_native_ad_template object| google_native_settings_key object| google_num_radlinks object| google_num_radlinks_per_unit object| google_override_format object| google_page_url object| google_pgb_reactive object| google_pucrd object| google_referrer_url object| google_region object| google_resizing_allowed object| google_resizing_height object| google_resizing_width object| rpe object| google_responsive_formats object| google_responsive_auto_format object| armr object| google_rl_dest_url object| google_rl_filtering object| google_rl_mode object| google_rt object| google_safe object| google_safe_for_responsive_override object| google_video_play_muted object| google_source_type object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_tag_origin object| google_tag_partner object| google_targeting object| google_tfs object| google_video_doc_id object| google_video_product_type object| google_webgl_support object| google_package object| google_debug_params object| dash object| google_restrict_data_processing object| google_ad_public_floor object| google_ad_private_floor object| google_traffic_source object| easpi object| easpa object| asntp object| asntpv object| asntpl object| asntpm object| asntpc object| asna object| asnd object| asnp object| asns object| asmat object| asptt object| asro object| ascet object| asrc object| easppi object| asbu object| aseb object| asla object| asaa object| google_shadow_mode boolean| google_apltlad object| google_sv_map object| google_tag_manager string| google_user_agent_client_hint string| GoogleAnalyticsObject function| ga number| sc_project number| sc_invisible string| sc_security number| sc_https number| sc_remove_link function| _statcounter object| gaplugins object| gaGlobal object| gaData function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages number| gp number| pp object| st1 number| mp number| Mflag string| code object| adsbygoogle object| GoogleGcLKhOms number| tmod function| google_spfd number| google_rum_task_id_counter object| google_image_requests

30 Cookies

Domain/Path Name / Value
user.shadowfs.click/ Name: ASPSESSIONIDSSRCSSRD
Value: LHNDODKBGHGEPFCMJALEMMHO
.user.shadowfs.click/ Name: backbox
Value: 1
.user.shadowfs.click/ Name: provider
Value: google
.user.shadowfs.click/ Name: sc_is_visitor_unique
Value: rx1124078.1683179516.DDA4DCB6D06E4F43FCDAED32AD9FBA32.1.1.1.1.1.1.1.1.1
.shadowfs.click/ Name: _ga
Value: GA1.2.1701536409.1683179516
.shadowfs.click/ Name: _gid
Value: GA1.2.1054311209.1683179516
.shadowfs.click/ Name: _gat_gtag_UA_93979_3
Value: 1
.shadowfs.click/ Name: _gat_gtag_UA_93979_13
Value: 1
.statcounter.com/ Name: is_unique
Value: sc1124078.1683179515.0
.shadowfs.click/ Name: __gads
Value: ID=11b64bd122092486-22169a2db8dd00f1:T=1683179515:RT=1683179515:S=ALNI_MYmjh4x3r47BWpGQJAvuZrR_Uwhng
.shadowfs.click/ Name: __gpi
Value: UID=00000bf52f6b54be:T=1683179515:RT=1683179515:S=ALNI_MbuuN3o48mUqntlTqGplOigWMOtNw
.user.shadowfs.click/ Name: dirs
Value: es/en
.agkn.com/ Name: ab
Value: 0001%3AVkx0vT76tw6vS%2FxnjfmDO5TG8XdgGKA%2F
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.casalemedia.com/ Name: CMID
Value: ZFNH-QmWdO5DTPYQOK2kxQAA
.casalemedia.com/ Name: CMPS
Value: 2178
.casalemedia.com/ Name: CMPRO
Value: 2178
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 9741A409-6683-4714-85C5-8D781CE69EE8
.yahoo.com/ Name: A3
Value: d=AQABBP5HU2QCEG6KX-UPFA1Ds-c36QBQWX8FEgEBAQGZVGRdZOANyiMA_eMAAA&S=AQAAAiNfnSUNunYpQif6HUDpC1s
.analytics.yahoo.com/ Name: IDSYNC
Value: 18gs~2bg5
.pubmatic.com/ Name: KRTBCOOKIE_1051
Value: 22884-18072662258724981996
.pubmatic.com/ Name: PugT
Value: 1683179517
.demdex.net/ Name: demdex
Value: 16317029597586578252517935345373765394
.bluekai.com/ Name: bku
Value: CH999w8cDtuj9uzF
.bluekai.com/ Name: bkpa
Value: KJy9qQYHd02pSUHknpx01MAdSVx21EQyBp/tBM/0BEQl1Mx8meW8mERZzZPASU/2ScH6zc1k16Wk1ARk1AjCn7H0SVJCqsjNztkFqi8Mqt6k1AjonZNC5sBGJEBszYDpHs/pJE/t5uDpHYD0Ba2YuN2PPDkW9yeUMu91
.dpm.demdex.net/ Name: dpm
Value: 16317029597586578252517935345373765394
.doubleclick.net/ Name: IDE
Value: AHWqTUmCCudYSxA8VrLddm6klOtmrEujJf7dUqPeuXCeYyWjiM5WrbrzRDVye-x4DhQ
.spotxchange.com/ Name: audience
Value: c83dbc9d-ea3f-11ed-a3f4-1e3504c40106
.krxd.net/ Name: _kuid_
Value: PiKDQBl1
.tribalfusion.com/ Name: ANON_ID
Value: aRnufrPME78QmKvCiAh609ZbajpsMqPBgD2ubZaGZbds7isOhYk2UVhix2kmIaryPNHMkcnJZbOOUZaJ7RZbAU3GSVreshUF5D7bqqfEAYSDjY

6 Console Messages

Source Level URL
Text
network error URL: https://www.googletagmanager.com/gtag/js?id=G-L5G253TYHN&l=dataLayer&cx=c
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177611512099267&output=html&h=60&slotname=9482378846&adk=2700236837&adf=111965227&pi=t.ma~as.9482378846&w=468&lmt=1683179515&url=https%3A%2F%2Fuser.shadowfs.click%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1683179515690&bpp=13&bdt=813&idt=257&shv=r20230502&mjsv=m202305010101&ptt=5&saldr=sa&abxe=1&prev_slotnames=3835126996&correlator=8045199016870&frm=20&pv=2&ga_vid=1701536409.1683179516&ga_sid=1683179516&ga_hid=999137728&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=135&ady=208&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42532089%2C44759927%2C44759876%2C42532185%2C44759837%2C44773810%2C31074266%2C44788441%2C44790154%2C44789816&oid=2&pvsid=3493227098988243&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Dfef3qZ383&p=https%3A//user.shadowfs.click&dtd=266
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://cookie.sync.ad.cpe.dotomi.com/w/cookie_sync?sid=25418&cb=0.9416799788463495
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://cookie.sync.ad.cpe.dotomi.com/w/cookie_sync?sid=25418&cb=0.6221338966132
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security warning URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp
Message:
Mixed Content: The page at 'https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_300x250.asp' was loaded over HTTPS, but requested an insecure element 'http://ads.dotomi.com/banners/fia/300x250_default.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp
Message:
Mixed Content: The page at 'https://translation2.paralink.com/BANNERS/Ad_networks/TF/TF_PROMTOnline_ROSB_728x90.asp' was loaded over HTTPS, but requested an insecure element 'http://ads.dotomi.com/banners/fia/728x90_default.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
a4.tribalfusion.com
aa.agkn.com
ads.dotomi.com
adservice.google.com
adservice.google.de
beacon.krxd.net
c.statcounter.com
cm.g.doubleclick.net
cookie.sync.ad.cpe.dotomi.com
direct.ad.cpe.dotomi.com
dpm.demdex.net
dsum-sec.casalemedia.com
googleads.g.doubleclick.net
image6.pubmatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
public-prod-dspcookiematching.dmxleo.com
s.tribalfusion.com
secure.cdn.fastclick.net
simage2.pubmatic.com
sync.search.spotxchange.com
tags.bluekai.com
tags.expo9.exponential.com
tpc.googlesyndication.com
translation2.paralink.com
ups.analytics.yahoo.com
us-u.openx.net
user.shadowfs.click
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.statcounter.com
cookie.sync.ad.cpe.dotomi.com
104.18.13.14
104.20.218.77
142.250.185.226
18.157.250.25
185.64.189.110
185.64.189.115
185.80.39.216
185.94.180.125
188.65.124.66
2.23.197.190
207.38.103.240
23.215.22.18
2606:4700::6812:18ad
2606:4700::6812:ddb
2a00:1450:4001:80b::2002
2a00:1450:4001:810::2002
2a00:1450:4001:812::2002
2a00:1450:4001:827::2002
2a00:1450:4001:827::200e
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2008
2a00:1450:4001:831::2004
3.75.62.37
34.250.66.43
35.244.159.8
5.78.40.153
63.215.202.140
69.173.144.165
89.207.16.210
99.81.121.200
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0bb7641448a1967cafe84d0532d67b8eb9c5a52132240910bd5d25df976394b3
0c052797bf33ae51138a6ea6c40bf6bfa354afb596f996db5123131873a327e9
11e188f48eaa897489508837d7c4149bec7d83ae8cecc1efcd3c03e1d2ec6c6a
14ca4f15c5e4303ffc5f603d34a2111202466af56d0eb54f8d27bc17685a9d98
26676486e16da3a08f2deae4f3838148491e0b9cb206d7bc20c17d05b2135f9d
2f8be69f1a240e2d70cd9f04af0f4349b090bee3da831a47fdf605f39020e961
4db411de619cc7d9410fef1f170f1ca80d56560fe9ab64820cb386adc462a65b
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50c41b4d4d525d40f1afb9588f2b093cd8a547f9480a752e83abeada0ff90aed
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55e0d9358cb60205eff06d2ce1215f07b5945abd16d4fda876519421c850ca46
5738f1cfe318c106548eb2df59a41861acbe9243031dbea2f7ef0cd45efd70d0
5865b49634471e52c9aed5ecb91ab81ad5b29472658ea9f3782bf6076545c409
59ac0476d0a140dcf8bd9874994a790cf6b68609380c1695eb908d26aeece838
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6338dc7ac8b0b7c57001b977906b354877dfc61ef80c5a813fd7287dd88fdea3
637b6c2e02478ff3a9a9c6d4073749ae843f7d59c565e35e9496b17b86c57ed2
682e1a29c31f2cd945c2b587525f11f2274308d64fb4fdafbb10b7d6fd66277b
698679f700ef18b6c63aee3558305a2f85791068631dca8f67f357c193516bb5
6a6071b6f540c8843363a0b2e0e9074eb51c96d142b2f530a95ab3a8af1ca947
6afe4d57f148c96c3b70941422938d146318305c00d50bb1f7cd20c97c3743cb
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7550f8b99af7bb456f19ae659dd656fba05043249af4c7bc7b2e95b0877de1b1
80a4294a7576b0b6edba6fdd66f658820220b7b37182756e9d9888a154a003b2
81afba79cc0a63b8e3847a8d79313484056a636255f3ae3f7652210daa9bc515
85333a5c85f48ba8562864ee65c09fc66b27bf84f93ee5e211d4037b5d4cbe49
864596a16ec945a8cf78c29b868ad759c3bf9e1b90d1c77c606222410a842e94
92f5bbf071461322a478e811a172def984d73be81483f811078604061cf0dbbc
9ae60418ed3053361eee6ef25ce3238ddeb547e9eeebec7001515427f9ab0031
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a7d8eb6a9fa2148842fe969612f3fe2c3cc71fbff33ab65e976f8646ef9fcee5
aeb4e91ace2fa32384064caa3eb3d1355e938bbb7d0a86b0b5280ee649d24544
aeeffe54b428aecc63e886a7551610bdaf53cb77e1818c0b6ce28d038d9bdc9e
b43256e464e52861b2655acd6a7644046e6e428fc40e872bf1ca0a485b67abe0
bee43429a2bfeecd51d6e8cd109936eb2131580c631fa7110d71b9e2fec24a09
c4bf029421b50e472cc3d8680b0f4d8c28e87f3cbaa7e829cba0e9f636612307
cb447029f17a299ebfbb15c5aa0b654fea909d7ff430b03e3df70d74818df1fa
cb524103f938b9db7f4d6ccf41250cd22458f1dfb83701231f018c9f20fea5be
cb82756945488e584e6b5491e0496f2e89b883be641659ce2810e776de55db84
d01ba5d4a2afaf880810d7234e5fdd7175dd9651a55db850511a02428ab981c8
d74c46e2342b1219dfc005675253d1ca07a5d0540e2732ffaaf31a76ac7b6900
d7960a5629a02fe2b69570bf38169acaa0ad2576acdeead81921ea03253df7ac
dd105974ecac0027e187ae1ca2cc3aa4d0ec1d688fb0b2ac26794b46822678f9
e212a9cf3950541b1d5d2536cc58355d29082ba98f4459e78fa7373c18296cf2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4241faf7eeb127bc22d69ce42e0bdc9cdaa2b86ab89cb16b487a59febcf6899
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
f33f11d7af780a7b01d7f5ac6957862261cfd844b784dca4875d26bf5d7c79d6
f49a95f1bd2919438a04dd4bb7257f5467acf0bbe6ec109701a4683be4d68e28
f62edd4d137ec20dfecec1bc8b0baade5c633956bd1cff9db4f4614e7085f425
fb35d5065f7e9830354fd449e849fae824709fe0d00c4bb413b0e3e85b17000b