www.ensonhaber.com Open in urlscan Pro
89.187.169.43 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ensonhaber.com/
Effective URL:
https://www.ensonhaber.com/
Submission: On June 21 via api (June 21st 2023, 7:33:31 pm UTC) from DE — Scanned from DE

Summary HTTP 362 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 38 IPs in 11 countries across 45 domains to perform 362 HTTP transactions. The main IP is 89.187.169.43, located in Frankfurt am Main, Germany and belongs to CDN77 ^_^, GB. The main domain is www.ensonhaber.com. The Cisco Umbrella rank of the primary domain is 147427.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on March 31st 2023. Valid for: a year.

This is the only time www.ensonhaber.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 77	2606:4700:10:... 2606:4700:10::6816:3f4e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	89.187.169.43 89.187.169.43	60068 (CDN77 ^_^) (CDN77 ^_^)
9	2606:4700:10:... 2606:4700:10::ac43:28c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
90	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::200d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	172.64.152.222 172.64.152.222	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
25	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
5	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:d::d 2a02:2638:d::d	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
15 51	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
6 16	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
6 11	37.252.171.53 37.252.171.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	178.250.1.11 178.250.1.11	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	52.215.105.179 52.215.105.179	16509 (AMAZON-02) (AMAZON-02)
39	2a00:1450:400... 2a00:1450:4001:82a::2006	15169 (GOOGLE) (GOOGLE)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 1	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
3 3	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 3	99.81.190.73 99.81.190.73	16509 (AMAZON-02) (AMAZON-02)
1	185.86.139.94 185.86.139.94	201081 (SMARTADSE...) (SMARTADSERVER)
2	3.76.139.6 3.76.139.6	16509 (AMAZON-02) (AMAZON-02)
10	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	74.125.133.155 74.125.133.155	15169 (GOOGLE) (GOOGLE)
1	2600:9000:245... 2600:9000:2450:6200:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
9	2600:1f18:1ac... 2600:1f18:1aca:4280:59b6:98e9:4469:e059	14618 (AMAZON-AES) (AMAZON-AES)
2	2620:116:800d... 2620:116:800d:21:93ca:31d8:d86e:38f6	16509 (AMAZON-02) (AMAZON-02)
2 2	2a05:d018:d29... 2a05:d018:d29:3601:8d68:cedd:2fd4:de35	16509 (AMAZON-02) (AMAZON-02)
3 3	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
3 3	213.155.156.164 213.155.156.164	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1 1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	18.203.5.185 18.203.5.185	16509 (AMAZON-02) (AMAZON-02)
1 1	124.146.215.46 124.146.215.46	2514 (INFOSPHER...) (INFOSPHERE NTT PC Communications)
1 1	185.29.134.248 185.29.134.248	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 1	35.204.158.49 35.204.158.49	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
3 3	35.156.203.47 35.156.203.47	16509 (AMAZON-02) (AMAZON-02)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	51.89.9.254 51.89.9.254	16276 (OVH) (OVH)
5 5	46.228.174.117 46.228.174.117	56396 (AMOBEE) (AMOBEE)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
2 2	18.156.187.34 18.156.187.34	16509 (AMAZON-02) (AMAZON-02)
1	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1 1	20.127.253.7 20.127.253.7	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	141.95.33.111 141.95.33.111	16276 (OVH) (OVH)
1	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
362	38

77 2606:4700:10::6816:3f4e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
icdn.ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 89.187.169.43 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-89-187-169-43.cdn77.com

www.ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:10::ac43:28c4 (United States)

ASN13335 (CLOUDFLARENET, US)

s.ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api-stg.ensonhaber.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

90 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.152.222 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:d::d (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

51 142.250.185.98 (United States) 15 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 185.80.39.216 (Canada) 6 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 37.252.171.53 (Frankfurt am Main, Germany) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.215.105.179 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-105-179.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a00:1450:4001:82a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.220.150 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.78 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.81.190.73 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-190-73.eu-west-1.compute.amazonaws.com

match.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.139.94 (France)

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.76.139.6 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-76-139-6.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.133.155 (Nashville, United States)

ASN15169 (GOOGLE, US)
PTR: wo-in-f155.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2450:6200:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2600:1f18:1aca:4280:59b6:98e9:4469:e059 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:93ca:31d8:d86e:38f6 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:d29:3601:8d68:cedd:2fd4:de35 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.4.29 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.155.156.164 (Sweden) 3 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.5.185 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-5-185.eu-west-1.compute.amazonaws.com

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 124.146.215.46 (Japan) 1 redirects

ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)

tg.socdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.134.248 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.158.49 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.158.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.0.66 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.156.203.47 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-203-47.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Bad Durrheim, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.254 (London, United Kingdom) 1 redirects

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 46.228.174.117 (United Kingdom) 5 redirects

ASN56396 (AMOBEE, GB)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.187.34 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-187-34.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.111.18 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.127.253.7 (Tappahannock, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sync.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.33.111 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203177.ip-141-95-33.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
100	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 133 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 155 ade.googlesyndication.com — Cisco Umbrella Rank: 321	557 KB
91	ensonhaber.com 1 redirects ensonhaber.com — Cisco Umbrella Rank: 102678 www.ensonhaber.com — Cisco Umbrella Rank: 147427 s.ensonhaber.com — Cisco Umbrella Rank: 259491 icdn.ensonhaber.com — Cisco Umbrella Rank: 153780 api-stg.ensonhaber.com — Cisco Umbrella Rank: 236648	2 MB
84	doubleclick.net 15 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219 googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 cm.g.doubleclick.net — Cisco Umbrella Rank: 244 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 359 bid.g.doubleclick.net — Cisco Umbrella Rank: 807	413 KB
39	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 338	1 MB
16	casalemedia.com 6 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621	12 KB
12	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 957 static.adsafeprotected.com — Cisco Umbrella Rank: 628 dt.adsafeprotected.com — Cisco Umbrella Rank: 557	105 KB
11	adnxs.com 6 redirects ib.adnxs.com — Cisco Umbrella Rank: 249	12 KB
11	google.com accounts.google.com — Cisco Umbrella Rank: 59 adservice.google.com — Cisco Umbrella Rank: 107 www.google.com — Cisco Umbrella Rank: 3	78 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 207	279 KB
3	1rx.io 3 redirects sync.1rx.io — Cisco Umbrella Rank: 618	2 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 361	1 KB
3	de17a.com 3 redirects d5p.de17a.com — Cisco Umbrella Rank: 4988	963 B
3	adform.net 3 redirects c1.adform.net — Cisco Umbrella Rank: 635	2 KB
3	360yield.com 3 redirects match.360yield.com — Cisco Umbrella Rank: 2458	1 KB
3	pubmatic.com 3 redirects image6.pubmatic.com — Cisco Umbrella Rank: 822	2 KB
3	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 407 mug.criteo.com — Cisco Umbrella Rank: 2114	7 KB
2	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 421	1 KB
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 1012	2 KB
2	unrulymedia.com 2 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281	1 KB
2	travelaudience.com 2 redirects ads.travelaudience.com — Cisco Umbrella Rank: 6896	978 B
2	yahoo.com 2 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468	1 KB
2	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 846	929 B
2	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 572	719 B
2	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 1538	315 B
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 1832	301 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	146 KB
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 434	1 KB
1	inmobi.com 1 redirects sync.inmobi.com — Cisco Umbrella Rank: 1487	744 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2376	173 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 422	6 KB
1	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 874	379 B
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1651	626 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 976	749 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 566	773 B
1	socdm.com 1 redirects tg.socdm.com — Cisco Umbrella Rank: 1091	1021 B
1	yieldmo.com 1 redirects ads.yieldmo.com — Cisco Umbrella Rank: 689	606 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 381	457 B
1	smartadserver.com ssbsync.smartadserver.com — Cisco Umbrella Rank: 867	45 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 375	265 B
1	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 778	542 B
1	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 3231	104 B
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 583	13 KB
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 1408	2 KB
1	google.de www.google.de — Cisco Umbrella Rank: 4835	455 B
1	33across.com cdn-ima.33across.com — Cisco Umbrella Rank: 3582	4 KB
362	45

	Domain	Requested by
68	pagead2.googlesyndication.com	www.ensonhaber.com securepubads.g.doubleclick.net tpc.googlesyndication.com 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com pagead2.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net fw.adsafeprotected.com www.googletagservices.com
51	cm.g.doubleclick.net	15 redirects googleads.g.doubleclick.net 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
44	icdn.ensonhaber.com	www.ensonhaber.com
40	s.ensonhaber.com	www.ensonhaber.com s.ensonhaber.com
39	s0.2mdn.net	www.ensonhaber.com s0.2mdn.net 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
25	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com www.ensonhaber.com googleads.g.doubleclick.net s0.2mdn.net
16	dsum-sec.casalemedia.com	6 redirects googleads.g.doubleclick.net
11	ib.adnxs.com	6 redirects googleads.g.doubleclick.net
11	googleads.g.doubleclick.net	www.googletagmanager.com 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com pagead2.googlesyndication.com
11	securepubads.g.doubleclick.net	www.ensonhaber.com securepubads.g.doubleclick.net
10	googleads4.g.doubleclick.net	www.ensonhaber.com fw.adsafeprotected.com googleads.g.doubleclick.net
9	dt.adsafeprotected.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
7	www.google.com	www.ensonhaber.com tpc.googlesyndication.com 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
6	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	www.googletagservices.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
5	www.ensonhaber.com	s.ensonhaber.com www.ensonhaber.com
3	sync.1rx.io	3 redirects
3	x.bidswitch.net	3 redirects
3	d5p.de17a.com	3 redirects
3	c1.adform.net	3 redirects
3	match.360yield.com	3 redirects
3	image6.pubmatic.com	3 redirects
2	eb2.3lift.com	2 redirects
2	pm.w55c.net	2 redirects
2	sync.targeting.unrulymedia.com	2 redirects
2	ads.travelaudience.com	2 redirects
2	pr-bh.ybp.yahoo.com	2 redirects
2	cms.quantserve.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
2	match.sharethrough.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
2	fw.adsafeprotected.com	1 redirects 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
2	gum.criteo.com	1 redirects static.criteo.net
2	esp.rtbhouse.com	invstatic101.creativecdn.com
2	adservice.google.com	securepubads.g.doubleclick.net
2	region1.google-analytics.com	www.googletagmanager.com
2	www.googletagmanager.com	www.ensonhaber.com www.googletagmanager.com
2	accounts.google.com	www.ensonhaber.com accounts.google.com
1	ade.googlesyndication.com
1	id5-sync.com
1	sync.inmobi.com	1 redirects
1	tr.blismedia.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	ajax.googleapis.com	s0.2mdn.net
1	onetag-sys.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	um.simpli.fi	1 redirects
1	sync.mathtag.com	1 redirects
1	tg.socdm.com	1 redirects
1	ads.yieldmo.com	1 redirects
1	pixel.rubiconproject.com	1 redirects
1	static.adsafeprotected.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	bid.g.doubleclick.net	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	ssbsync.smartadserver.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	match.adsrvr.org	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	sync-tm.everesttech.net	1 redirects
1	dclk-match.dotomi.com	6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
1	mug.criteo.com
1	static.criteo.net	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	www.google.de	www.ensonhaber.com
1	cdn-ima.33across.com	securepubads.g.doubleclick.net
1	api-stg.ensonhaber.com	s.ensonhaber.com
1	ensonhaber.com	1 redirects
362	61

This site contains links to these domains. Also see Links.

Domain
videonuz.ensonhaber.com
ensonhaber.me
www.youtube.com
wa.me
youtu.be
t.me
twitter.com
www.instagram.com
www.facebook.com

Subject Issuer	Validity	Valid
*.ensonhaber.com RapidSSL TLS RSA CA G1	`2023-03-31` - `2024-03-30`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-06` - `2023-09-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-04-28` - `2023-07-28`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-27` - `2023-08-27`	3 months	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-05-17` - `2023-08-15`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-12` - `2023-08-10`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2022-08-09` - `2023-09-10`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M01	`2023-02-24` - `2023-09-04`	6 months	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-07`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-06-09` - `2023-09-07`	3 months	crt.sh

This page contains 31 frames:

Primary Page: https://www.ensonhaber.com/
Frame ID: FFEA37E0AD43A343393D2210DB6C8775
Requests: 126 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 6BAA5DCEDB84342CD3F7695108F1E615
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7C12D698CE258EC239CA6078182A12CC
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C550D9CF0FC72D401BC46F02BC69631E
Requests: 2 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 636BB23C00C20D545F9B94308DF7B380
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjV1rLlATAB&v=APEucNWCNDnGTxU6tnd_iu0FPLv8kuOHUBs0HpcWjKqddBFBWLmntCE9P8cNOO29Xct3wYm_5ys-v3vMnlvQumFiRkAXqN6yBv4ikBwTe6oXRMzsYR6cIJzIGNZoWJ8HdH8PNxYcQ07pe1irE6floEuB7WgMW61NdhusXfRyNOwrlNiyHQwqKUeyas0ZUmdnbqiTf5oDsD44
Frame ID: 1DDB1E0901054E12302ED97A462A2517
Requests: 5 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.ensonhaber.com
Frame ID: 44F7243804AC15BDE72B04242A923986
Requests: 2 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0C715238BBAA93FBF28C262ACC12A043
Requests: 31 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJOlvQEQv4LBARik05rsATAB&v=APEucNXqbuZ-9OmQ_RRxkcptNe1dc0KIA_-zi717hOHzpNIRDbqLiCXyd2GJ-aeWssfNGDhcTQg4REqKJEFbbtB8bdpmvpodwii8V3smRxb-mDiQqOMdR6auQk1dgOxlkW9fdxGdOrOfM8l1q_B-jAnfyyBXyIGd8trVo0gFizmh7x5_nYvqvcp57vghMaqFKZhfc6zboDua
Frame ID: 3DA25488204323B6E56C5CD9723C6D02
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 8CE3E146C43F073D1A459F5198AD12A5
Requests: 9 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: FBB09AEB9B09EB907E9D57E81C7376E1
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYlfTiwAEwAQ&v=APEucNUemwfHTdpQrBhATouKpOh925hoM6WSgt2OoA7BKHbShtxAp3XzSWGdiXv1_9kj1bUnGC0VDmYaJuGhIEnWoGpfSa5CuoHNYPJTdYAUEcAqwzYt5LYn8QmtKZBwiCUWBmYXkSz8Ry08GjpV6JBbVQ2ZduQ56lspKaxQP2qIRup1Mp3fW-3goqmZSgGtxws6hz4lM6Mw
Frame ID: C47608589C19A3725571D554CD3553BC
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
Frame ID: 6273EA1D079591A25AF2A3F638FBA2EA
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4A09F16B5A82C60326F483867834A206
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 22BBFDAF4DA3D4C81093F69299536657
Requests: 1 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 24E88FF28C07C8C93B416FE3B77C0CBE
Requests: 20 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9579D11712792561051E815F3D7B3BCD
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAhsHjATAB&v=APEucNWoEfFf8BRSyjL0cohO8YwUzwiAEse1Pa9nCjzNcctPCHSKaxG9i64LSA8eFcsVknqPWuARuHFF-Bo5_8lTNEorYAZhaziNoj7TN-r9iaiofUrOngFJchnwdgmGtDRuJSA2P2kpvzzio505o-XnlE0_dMM6Ec1w38NFLmW4kOAx-5xwC9fWRCczB0DLwShNyL4cbr6F
Frame ID: 63127E0E9CD43705339C3BD750C1D685
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 86203DC3B1D716BF9DD1B00B4E95DB54
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D00ECE7ACA5B22B72A6075C03658E2EA
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
Frame ID: 7118F715FC542F6B28F992F9C4621774
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js
Frame ID: 5D7B4B4E2A1ADB76BDE991780AA45787
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 706145100BA1BAF1FD9DCE7620A11075
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 429A99FF344F0EA89E8602930F065C0B
Requests: 9 HTTP requests in this frame

Frame: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 19D23F71F84C35CD704CB5C2AC0BA8DB
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNCEFBDI4JukAxip5e7sATAB&v=APEucNWy7fyUnWF-ckpzn9gohIOqcT1KdqVlQOv8cmbTWFdw3TdV1DmBdLbf2B-PnyrKaWFjYuojl7cMoiMOsAOm6dF5yn2Z4SWjKXfMYujnRYP_KYDJcrSeXr8GuBMBc3WJaPV2nbCbbdxHFtDMq_Rspv_PD76yP8ATLk3_DiTGe0O2aIC84GjXOeNbEpvMns_qpnmVLpqY
Frame ID: A13AB60ED8256FD623A0B71732029740
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 10DBCB4958DB525824A97504C66EE7D3
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js
Frame ID: 37F5EE64C53EDB227677033DF9E8D1C2
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BDE6A2AFD28C29C14335A0D38B5A9031
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
Frame ID: E7B78B3613448F8899FB2C4AFC43207C
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DA3F3060361F17DD72214A63A8F2946A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ensonhaber – Son Dakika Haber, Güncel Haberler

Page URL History Show full URLs

https://ensonhaber.com/ HTTP 301
https://www.ensonhaber.com/ Page URL

Detected technologies

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

accounts\.google\.com/gsi/client

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

362
Requests

86 %
HTTPS

38 %
IPv6

45
Domains

61
Subdomains

38
IPs

11
Countries

4643 kB
Transfer

8707 kB
Size

47
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://videonuz.ensonhaber.com/
Title: VİDEO

Search URL Search Domain Scan URL

URL: https://ensonhaber.me/v5
Title: bitexen

Search URL Search Domain Scan URL

URL: https://ensonhaber.me/12o
Title: Halkbank Parafly

Search URL Search Domain Scan URL

URL: https://ensonhaber.me/12h
Title: İHH Kurban

Search URL Search Domain Scan URL

URL: https://ensonhaber.me/12z
Title: Veni Vidi Göz Mayıs

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCZHf28-BG2Pz-UFqYJiZBeg

Search URL Search Domain Scan URL

URL: https://wa.me/905333782000

Search URL Search Domain Scan URL

URL: https://youtu.be/2vnzyTtec4w
Title: Sinan Akçıl: İleride Türk gençliğini temsil etmek için siyasete atılabilirim

Search URL Search Domain Scan URL

URL: https://youtu.be/ek6JvpUIAAU
Title: Cumhurbaşkanı Erdoğan Ak Parti Grup Toplantısı'nda konuştu

Search URL Search Domain Scan URL

URL: https://youtu.be/YweY1muIdh8
Title: Sevda Türküsev ve Miyase İlknur arasında Kılıçdaroğlu tartışması: Yayını terk etti

Search URL Search Domain Scan URL

URL: https://youtu.be/d35_kl9UFlc
Title: Ekonomi nereye gidiyor? - Faizler ne olacak? - Dolar düşecek mi?

Search URL Search Domain Scan URL

URL: https://youtu.be/rtUGIfs4f70
Title: Kılıçdaroğlu partisinin TBMM Grup Toplantısı'nda konuştu

Search URL Search Domain Scan URL

URL: https://youtu.be/eIaGVxwBcIc
Title: Devlet Bahçeli MHP grup toplantısında konuştu

Search URL Search Domain Scan URL

URL: https://youtu.be/k9zMlAVwr_A
Title: Kapıdaki tehlike: Kızamık

Search URL Search Domain Scan URL

URL: https://youtu.be/dzSwDTM60YM
Title: Muhalefette sular durulmuyor

Search URL Search Domain Scan URL

URL: https://youtu.be/2qKTVdu9oDI
Title: MKYK'nın ana gündemi deprem bölgesiydi

Search URL Search Domain Scan URL

URL: https://youtu.be/xt9IfnEEGas
Title: Cumhurbaşkanı Erdoğan: Enflasyonu tekrar tek haneli rakamlara düşüreceğiz

Search URL Search Domain Scan URL

URL: https://youtu.be/wSuIa-cY3Ro
Title: Caddebostan'da sorduk: CHP'nin yeni genel başkanı kim olmalı?

Search URL Search Domain Scan URL

URL: https://t.me/ensonhaber
Title: Telegram

Search URL Search Domain Scan URL

URL: https://twitter.com/ensonhaber
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/ensonhaber/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ensonhaber
Title: Facebook

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ensonhaber.com/ HTTP 301
https://www.ensonhaber.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 137

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEONEv3lVPsomav6dpbobJH0&google_cver=1

Request Chain 138

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1

Request Chain 139

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENS0b1sxYdNqbl2adRpnDmc&google_cver=1

Request Chain 140

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Request Chain 141

https://gum.criteo.com/sid/json?origin=publishertagids&domain=ensonhaber.com&sn=ChromeSyncframe&so=0&topUrl=www.ensonhaber.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=jULwDHxsa2FOQlc2dC9IQmlIbVY2NUtlN0FsZ0hwOG4wSUUvQmZOd2VWSHNVMGFpQXBaYUdSbzYyTjhRVHg1T0hORk1wOW45ZXZQRTY4cWtlM2V6YnBucCtyVTVKMkNBY3VDM3lmcUJteUYrcnFoTWVncmdpdkhGL3FJa0JuVmg1Vm81UGpXemFzSXNiRHNxbTJ0NHFwREwyM3dqQTRNUzJLekJLc0FLYlp1NnVhcStEanBpNS82Q0szRnNudHU4cjZlRm9MYnAyQjNzWWdSMUd1a0ZWbXdlQUQ3b2YxYkJHejQ3a1YrQkhuTDJKUWJTcmhCL21FRzdYUk9GWEFxN0xpQkgrblVKdnNSVFlvNDhiOXhuSTg2S0tGdTg3SmZubkJtUDhMUzZINHpjUndwbz18&cppv=2

Request Chain 155

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1

Request Chain 156

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1

Request Chain 157

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGUHq8CJr4Doxz0o5_x2xX0&google_cver=1

Request Chain 158

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Request Chain 178

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEHGquPafL7cB3HS08at6d_o&google_cver=1&google_push=ATf1kGPg2Vx46TyKYnZy73YKOhfubINoOhDvrme8LVDbMyWV7dre12UmDR6-ktGGo5eB0AXZVj5D1WF3YpGIj1v3TRvRA0YEX3OM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHGquPafL7cB3HS08at6d_o&google_push=ATf1kGPg2Vx46TyKYnZy73YKOhfubINoOhDvrme8LVDbMyWV7dre12UmDR6-ktGGo5eB0AXZVj5D1WF3YpGIj1v3TRvRA0YEX3OM

Request Chain 180

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEARlqu-bHvyo4YIg_yZFWJY&google_cver=1&google_push=ATf1kGOQphE0sU8f0-fWCXTIug5mh9gGoclqOhYYnurg6Kfq1lR7PfzImyd0AOfo815WpV8mRn4LlLjfu_I8SARQe0mPdrNC_WlLtg HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEARlqu-bHvyo4YIg_yZFWJY&google_cver=1&google_push=ATf1kGOQphE0sU8f0-fWCXTIug5mh9gGoclqOhYYnurg6Kfq1lR7PfzImyd0AOfo815WpV8mRn4LlLjfu_I8SARQe0mPdrNC_WlLtg&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOQphE0sU8f0-fWCXTIug5mh9gGoclqOhYYnurg6Kfq1lR7PfzImyd0AOfo815WpV8mRn4LlLjfu_I8SARQe0mPdrNC_WlLtg

Request Chain 181

https://match.360yield.com/match/ebda?google_gid=CAESEErXsB7LAp3fp1JWRuJ6N_Q&google_cver=1&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0speF-ueliw HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEErXsB7LAp3fp1JWRuJ6N_Q&google_cver=1&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0speF-ueliw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0speF-ueliw

Request Chain 188

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1

Request Chain 189

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1

Request Chain 190

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENYvBnjOn88NRCSpSqOETcw&google_cver=1

Request Chain 191

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Request Chain 198

https://fw.adsafeprotected.com/rfw/bgd/1316115/71738579/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=&ias_dspID=3&ias_campId=1010526756&ias_pubId=pub-8601585505701947&ias_chanId=1&ias_placementId=20251344649&bidurl=https://www.ensonhaber.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iEqMJypu02CUY8QhI5ejFC&adsafe_url=https%3A%2F%2Fwww.ensonhaber.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.ensonhaber.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:fe83c85e-6a84-4a6f-13aa-cddf127f38ed,c:gcDhzq,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5958d7d477-8zgt5,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,scm:rHRbA1,mtim:6,mot:0,app:0,maw:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:41,oid:7c5b7473-106a-11ee-996b-22b8ddb3ee24,v:19.8.421,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=

Request Chain 225

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1

Request Chain 226

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

Request Chain 227

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

Request Chain 228

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Request Chain 252

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDiWSYuYbYmH1lcDlGQgg14&google_cver=1&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayTWe90F7g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayTWe90F7g&google_hm=eS1nLllEYWJCRTJwSHNZemxSLmxkNUJaUDRhLjc3dUtiRX5B

Request Chain 253

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEJxkjAC0fMykj4wZAXJsZSI&google_cver=1&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLHUKaVNg99CTvgO-boDhWs HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEJxkjAC0fMykj4wZAXJsZSI&google_cver=1&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLHUKaVNg99CTvgO-boDhWs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLHUKaVNg99CTvgO-boDhWs

Request Chain 254

https://d5p.de17a.com/cookies/google?google_gid=CAESEEEds9Q1A5giMFNto6z0Hng&google_cver=1&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEEEds9Q1A5giMFNto6z0Hng&google_cver=1&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw

Request Chain 255

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPevhlU4LD-1NYW6L-XsSsA&google_cver=1&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpgClTHAbgVIMqrjtVObEKEEO7Vt HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo2NDNUS1EtMi1KSURV&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpgClTHAbgVIMqrjtVObEKEEO7Vt

Request Chain 256

https://ads.yieldmo.com/exptsync?google_gid=CAESEPCTfjmLHit5BFeNGrSJRZk&google_cver=1&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w&google_hm=Z2ZkYWUwMjVjZGMxNWE3NDJkZjQ=

Request Chain 257

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESELy5VNKY31HKkyhS7klTJQQ&google_cver=1&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg&google_hm=WkpOUWhNQ284WW9BQUkzVXJqTUFBQUFB

Request Chain 269

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEPWyHPgA9N2Ii-jBBzm5gHk&google_cver=1&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKYa-YGejV_kbVWtBqnK3tfBxtJ_XbJK2b3hxdSxQzaLg4u0-sfW_5soNlb HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKYa-YGejV_kbVWtBqnK3tfBxtJ_XbJK2b3hxdSxQzaLg4u0-sfW_5soNlb

Request Chain 270

https://um.simpli.fi/gp_match?google_gid=CAESENZI9LAmsjVCCYaSYcQaBNQ&google_cver=1&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwzhn4y9qTOJhjwCR-662lk6qw9BLYJsnlRLUgoUMKld52L-yiPxO4ZlOUE- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=93547A5F1B5F4C84A8C184F2B5D4A934&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwzhn4y9qTOJhjwCR-662lk6qw9BLYJsnlRLUgoUMKld52L-yiPxO4ZlOUE-

Request Chain 271

https://ads.travelaudience.com/google_pixel?google_gid=CAESEB7MBqJ6iYs9DnnY5n3A0VU&google_cver=1&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZuCI8vYXba3jy-9weAuEmeqkAcCr7bsrjCnwIxw0wr1KXHDqvRnxL6th4 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZuCI8vYXba3jy-9weAuEmeqkAcCr7bsrjCnwIxw0wr1KXHDqvRnxL6th4

Request Chain 272

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECM1j1ADzWxOky-m6_7UeLM&google_cver=1&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESECM1j1ADzWxOky-m6_7UeLM&google_cver=1&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr&google_hm=7zE2MBDBRmen_U2NK54WDg==

Request Chain 273

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECcYhE3QVswEGXJtcDkeewo&google_cver=1&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uuyLLbibhCUUMHShvbgftPE8riIhoORjc5Lg9jyhy_FMUXfDWU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uuyLLbibhCUUMHShvbgftPE8riIhoORjc5Lg9jyhy_FMUXfDWU&google_hm=eS11d0tvUWJ4RTJwSEk3eUZ5VzM5Y1hpRjAzOTdUbU03YX5B

Request Chain 283

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESELzJVeA83Z9JI3tP0vnoCv0&google_cver=1&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROPMPPnrQJ5mM9LJLCs5m0w9wDgFUSPZWa8Taz5v_kYlke-KtQQ0IjPa_eA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI0NzIyNDc1MzI1Njc5MDE2NQ%3D%3D&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROPMPPnrQJ5mM9LJLCs5m0w9wDgFUSPZWa8Taz5v_kYlke-KtQQ0IjPa_eA

Request Chain 284

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEnEyByKN8prMu-rTiCvgiU&google_cver=1&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZk49UCrmu_udWOE5aYlmDoAuNQWaf1jRUQ-dO8PIidv9IC85JXwFcuA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZk49UCrmu_udWOE5aYlmDoAuNQWaf1jRUQ-dO8PIidv9IC85JXwFcuA

Request Chain 285

https://d5p.de17a.com/cookies/google?google_gid=CAESEA14IPWANbyxVD7HhctFI9k&google_cver=1&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1nsuPv8b84w9BDVVZWNprC7W33oiOhZePUPM9Yh4Wz2VT0Xa8o HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1nsuPv8b84w9BDVVZWNprC7W33oiOhZePUPM9Yh4Wz2VT0Xa8o

Request Chain 286

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENGG6wpNuB03FVcQvIErllE&google_cver=1&google_push=ATf1kGOBZJPtTg7kk_NuHjVYDi3b3_Puo7CE9zboIVKSqZM0ORvVWViQ_YF80rhjQg3IBkLRcZkxdWxKdP6AakK2YMgXWL7F_UfHUBkup5zDtg12i9l0XZXRO5GHQp6LntgLG6Tt7Plkdg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOBZJPtTg7kk_NuHjVYDi3b3_Puo7CE9zboIVKSqZM0ORvVWViQ_YF80rhjQg3IBkLRcZkxdWxKdP6AakK2YMgXWL7F_UfHUBkup5zDtg12i9l0XZXRO5GHQp6LntgLG6Tt7Plkdg

Request Chain 287

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEPnuMVyntzvaBwq0ca8capQ&google_cver=1&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCNykWIyP3Mw3pIVsOmBFid5d0d5sj8-eIHAmJdihYHfZDgYkN2lH2q_cmQJ3A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCNykWIyP3Mw3pIVsOmBFid5d0d5sj8-eIHAmJdihYHfZDgYkN2lH2q_cmQJ3A

Request Chain 288

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEHSCNvjsCfcBSlhZYXey9hc&google_cver=1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1687376004501 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY%26google_hm%3DA8K7p089pEo4onG7tVag138 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY&google_hm=A8K7p089pEo4onG7tVag138

Request Chain 289

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESELNdMnzTGUJ7QmZUPzurToc&google_cver=1&google_push=ATf1kGOCgpW10YOm1XyZEL2yIlGGcq6gSYVUH_dbpdzcDfdBO0Ah3CvDjfMkCY2d1rpFp7u8CVvxWGbk0t0S7rd-OiALAlwg9N140m1tKxHXutf7bWxByaBkurXO81ycGNVvIw2UylWyHYGl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ef313630-10c1-4667-a7fd-4d8d2b9e160e&%%GOOGLE_PUSH_PAIR%%

Request Chain 305

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

Request Chain 306

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

Request Chain 307

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

Request Chain 308

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Request Chain 331

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjxaYYJqRH7h_xB8FaCyoFlyslf0XmZ0i4vA-HW8GoadbFy8RicDxFf4VkwTSMx0eeaYlpiIgDTDXjiVI1nEENsApUzEtrK77jc HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjxaYYJqRH7h_xB8FaCyoFlyslf0XmZ0i4vA-HW8GoadbFy8RicDxFf4VkwTSMx0eeaYlpiIgDTDXjiVI1nEENsApUzEtrK77jc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXBIY2MyZzQxUWMzQTA1&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjxaYYJqRH7h_xB8FaCyoFlyslf0XmZ0i4vA-HW8GoadbFy8RicDxFf4VkwTSMx0eeaYlpiIgDTDXjiVI1nEENsApUzEtrK77jc

Request Chain 333

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMcG0i_h_qt2GhlL9-_hgYI&google_cver=1&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA17BBCRGZ5dAn2EDiGIcVJ4JwLGwklPgoboxuDpP3avnEK-Yt8UgfCbdPGp9DhEZKjs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA17BBCRGZ5dAn2EDiGIcVJ4JwLGwklPgoboxuDpP3avnEK-Yt8UgfCbdPGp9DhEZKjs

Request Chain 334

https://match.360yield.com/match/ebda?google_gid=CAESEOaYCQme2t6C5NX5Q4td-eM&google_cver=1&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZbx38qy4ceq52NMd_mc6Nd-bcGGTXuhSA3_tTtxnBF1NShPZ6yQr51cLQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZbx38qy4ceq52NMd_mc6Nd-bcGGTXuhSA3_tTtxnBF1NShPZ6yQr51cLQ

Request Chain 335

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEPea8C-vfv8FvcuRfF_7hcM&google_cver=1&google_push=ATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn8_ylH54 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn8_ylH54%26google_hm%3DA8K7p089pEo4onG7tVag138 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn8_ylH54&google_hm=A8K7p089pEo4onG7tVag138

Request Chain 336

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBmTAG_TGswhQmxS2PnddiM&google_cver=1&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfmwEWHdFCOpwLPQDIJiiHHz63N6YrzNIi4nAaMEvF3DCoE HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfmwEWHdFCOpwLPQDIJiiHHz63N6YrzNIi4nAaMEvF3DCoE&google_gid=CAESEBmTAG_TGswhQmxS2PnddiM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMDQyOTM4NjEyNzAyMjEzNTM3NA%3D%3D&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfmwEWHdFCOpwLPQDIJiiHHz63N6YrzNIi4nAaMEvF3DCoE

Request Chain 337

https://sync.inmobi.com/gob?google_gid=CAESEFj62qNn1NAEW1nhlK0lCgg&google_cver=1&google_push=ATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3pEJpWvr6aE-FfMLSKELGlNCraJYri-kKqLwuW4Mm3pmUiaN_2z5GWPG1k-nGv5nnl8aIpwVRyUTBWhKRjH1GKWSmiNo5EgY HTTP 302
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3pEJpWvr6aE-FfMLSKELGlNCraJYri-kKqLwuW4Mm3pmUiaN_2z5GWPG1k-nGv5nnl8aIpwVRyUTBWhKRjH1GKWSmiNo5EgY

362 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.ensonhaber.com/
Redirect Chain

https://ensonhaber.com/
https://www.ensonhaber.com/

165 KB
29 KB

95ms
18ms

Document
text/html

89.187.169.43
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.43 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-43.cdn77.com
Software: MerlinCDN / PHP/8.0.25
Resource Hash: c467da3d749a15b2346139e7f9dfb19fe5a819e4345335be1997304e8e4da731

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 27
allow: GET, HEAD, POST
cache-control: max-age=40
caching-type: litespeed
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 21 Jun 2023 19:33:21 GMT
etag: W/"4966999-1687375950;;;"
merlin-is-mobile-desktop: 1
merlin-is-mobile-viewer: 0
server: MerlinCDN
via: HTTP/2.0 Merlin CDN
x-cache-status: HIT
x-edge: de-fra-dp-s01
x-litespeed-cache: hit
x-midtier: de-fra-dp-s02
x-powered-by: PHP/8.0.25

Redirect headers

cache-control: max-age=3600
cf-ray: 7daeaecbd86119ab-FRA
date: Wed, 21 Jun 2023 19:33:21 GMT
expires: Wed, 21 Jun 2023 20:33:21 GMT
location: https://www.ensonhaber.com/
server: cloudflare
vary: Accept-Encoding

GET
H2 200 home.min.css
s.ensonhaber.com/assets/css/ 277 KB
51 KB 55ms
16ms Stylesheet
text/css 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b57c9aa30eb75613091d6753b26caa6b3a56e24b7326ec4512a2ba17678def7d

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 16018
content-length: 52151
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Jun 2023 11:14:28 GMT
server: cloudflare
etag: "454f6-648c4414-1c2131dc75de44c;gz"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced0b30e8-FRA
expires: Thu, 20 Jun 2024 15:05:21 GMT

GET
H2 200 inter-v2-latin-ext_latin-regular.woff2
s.ensonhaber.com/assets/fonts/inter/ 35 KB
35 KB 82ms
43ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-regular.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7b0e537ecabd3d1f81dc4c203a245b706c3cc3eed9089097c5c755a835786aa

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 36104
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "8d08-639c9a83-8a94ee445f24e6c0;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced0f30e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 inter-v2-latin-ext_latin-300.woff2
s.ensonhaber.com/assets/fonts/inter/ 37 KB
37 KB 62ms
24ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-300.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdf77c2e2ee4fce5ccc2a8b4105861708c75bda5ffe264b80ba86d5201aa2aed

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 37584
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "92d0-639c9a83-275355ba44709d0b;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced1230e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 inter-v2-latin-ext_latin-500.woff2
s.ensonhaber.com/assets/fonts/inter/ 38 KB
38 KB 61ms
23ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-500.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd1f0ba991b730edbc9e72f9a6f8a290ef8d852644c9629dc479c7eb18c1ea1b

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 38652
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "96fc-639c9a83-df183364806ed438;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced1530e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 inter-v2-latin-ext_latin-600.woff2
s.ensonhaber.com/assets/fonts/inter/ 38 KB
38 KB 67ms
29ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-600.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 102b58b4e227d81042c84d5eccdb17a607b87d33b01c258c1f820fe9bcc18b61

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 38852
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "97c4-639c9a83-c70c6bcb7fd34262;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced1630e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 inter-v2-latin-ext_latin-700.woff2
s.ensonhaber.com/assets/fonts/inter/ 38 KB
38 KB 62ms
24ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-700.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8ce6f350e90bbf4799d659b4555945cf96010490800a128ef48bcd33ece1b8e

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 38908
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "97fc-639c9a83-82ee2966142daad0;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced1830e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 inter-v2-latin-ext_latin-800.woff2
s.ensonhaber.com/assets/fonts/inter/ 38 KB
38 KB 62ms
24ms Font
font/woff2 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/inter/inter-v2-latin-ext_latin-800.woff2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c287ba7fe796611bb01f2fd3996698167128d05427019e7f97d48b961cba3b1f

Request headers

Referer: https://www.ensonhaber.com/
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4718360
content-length: 38948
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "9824-639c9a83-d47e4f5f26ad6474;;;"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecced1930e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 77 KB
26 KB 321ms
175ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fcdb3fca9bce88c148c41f71a730872366405ae600fbdae89a5439c685a79295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26444
x-xss-protection: 0
server: cafe
etag: 384 / 19529 / 31075507 / config-hash: 13361936451535775382
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H2 200 esh-tag.js Show response
s.ensonhaber.com/assets/js/lib/ 14 KB
4 KB 34ms
17ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/js/lib/esh-tag.js?r=3.14.62_110bdcf-v2
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f43af206870986a648b5db6570c0488ead3ab087202e82168e57a73af4b5124

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
content-encoding: gzip
cf-cache-status: HIT
age: 16067
cf-polished: origSize=25855
x-vtex-cache-status-nginx-thumbor: MISS
cf-bgj: minify
last-modified: Fri, 16 Jun 2023 16:43:44 GMT
server: cloudflare
etag: W/"64ff-648c9140-600d8002f3582cb9;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
cf-ray: 7daeaeccc9aa19ab-FRA
expires: Thu, 20 Jun 2024 15:05:18 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 192 KB
75 KB 236ms
102ms Script
application/javascript 2a00:1450:4001:800::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

914e792e0d03a775a673f70736e89594938337065f4e5bc5906e3b5c3c5acf1a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-nUPhuYXl6tDzHlj0MuMbgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-nUPhuYXl6tDzHlj0MuMbgw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H2 200 logo.png
s.ensonhaber.com/assets/img/ 10 KB
10 KB 27ms
26ms Image
image/webp 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/logo.png
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18716a69ac05e85bcd36f171cf3517c6f86c48d2814cd715b8f212e1f93c845f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948635
cf-polished: origFmt=png, origSize=14744
content-disposition: inline; filename="logo.webp"
content-length: 9952
x-vtex-cache-status-nginx-thumbor: MISS
cf-bgj: imgq:85,h2pri
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "3998-639c9a83-80370abe83dfb67e;;;"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
x-msg-esh: gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a6619ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 config.js Show response
s.ensonhaber.com/assets/js/lib/ 5 KB
2 KB 27ms
26ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/js/lib/config.js?v=3.14.62_110bdcf
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f2688eeeeb6d99e09adc5d8aeea2963fe4034ca8f98f639f24dea4e0d0f7d16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
content-encoding: gzip
cf-cache-status: HIT
age: 16067
cf-polished: origSize=8068
x-vtex-cache-status-nginx-thumbor: MISS
cf-bgj: minify
last-modified: Thu, 27 Apr 2023 01:38:36 GMT
server: cloudflare
etag: W/"1f84-6449d21c-29d76f8c661a4d15;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
cf-ray: 7daeaecd4a6719ab-FRA
expires: Thu, 20 Jun 2024 15:05:19 GMT

GET
H2 200 swiper-bundle.min.js Show response
s.ensonhaber.com/assets/plugins/swiper/ 138 KB
37 KB 22ms
20ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/plugins/swiper/swiper-bundle.min.js
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef7461c0051b325805c887adc6357a464dae3efad3720214b91799a501afb62c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4772810
content-length: 37667
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "227c3-639c9a84-365ff75c50969382;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a6819ab-FRA
expires: Thu, 25 Apr 2024 06:21:45 GMT

GET
H2 200 keen-slider.min.js Show response
s.ensonhaber.com/assets/plugins/keen-slider/ 14 KB
6 KB 43ms
42ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/plugins/keen-slider/keen-slider.min.js
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 127fc5122908ed58f8a0595d3c00f9202b406d774b2b6ecd834bfba408a374da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4772810
content-length: 5950
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Tue, 24 Jan 2023 10:59:25 GMT
server: cloudflare
etag: "391a-63cfba0d-c751872e52ec6ffc;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a6c19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 scrollbooster.min.js Show response
s.ensonhaber.com/assets/plugins/scrollbooster/ 13 KB
4 KB 26ms
25ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/plugins/scrollbooster/scrollbooster.min.js
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34df2cadac0444599fe032eaa1b5d521809cbb2dc76c7368b66405217c7a67e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948651
content-length: 3744
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Mon, 24 Apr 2023 13:24:08 GMT
server: cloudflare
etag: "340b-644682f8-33996e347c569589;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a6f19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 home.min.js Show response
s.ensonhaber.com/assets/js/ 111 KB
30 KB 18ms
17ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/js/home.min.js?v=3.14.62_110bdcf
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c5a4091ad723f5a0ee361cb4ec5ce851d11ed195d220647fe3399e0fa9f570a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 16039
content-length: 30064
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Tue, 20 Jun 2023 13:22:23 GMT
server: cloudflare
etag: "1bdad-6491a80f-8eb2f34356ebea3f;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a7019ab-FRA
expires: Thu, 20 Jun 2024 15:05:22 GMT

GET
H2 200 login.min.js Show response
s.ensonhaber.com/assets/js/ 15 KB
4 KB 20ms
19ms Script
application/x-javascript 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/js/login.min.js?v=3.14.62_110bdcf
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 009d4ceeb1168ae5d225f0898ba84f53743d9051b32b5a016bc7c867f32f0c5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 16067
content-length: 4351
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 28 Apr 2023 14:12:37 GMT
server: cloudflare
etag: "3aa3-644bd455-cc120e5c107645f9;gz"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd4a7219ab-FRA
expires: Thu, 20 Jun 2024 15:05:19 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 125 KB
48 KB 161ms
16ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PL4PL92

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

34ece9c8a41733884a05c03aec9df49856e8c44a93a0960fd20f317a6d8b437b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48908
x-xss-protection: 0
last-modified: Wed, 21 Jun 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H2 200 search.svg
s.ensonhaber.com/assets/img/nav/ 503 B
401 B 15ms
15ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/search.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2302716051f0963269ff25431c4c06772a2fd6fb9ea23f7ad5d5d5eb4f13478e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948617
content-length: 288
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "1f7-639c9a83-7df830a54a0303c3;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9519ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 tv-live.svg
s.ensonhaber.com/assets/img/nav/ 392 B
408 B 21ms
21ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/tv-live.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc041c68a2177f55b4e9ce51c16fbd2c038effbaba704a9627e02e587d1bbc25

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948617
content-length: 286
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "188-639c9a83-32710c5bc2f0f20f;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9919ab-FRA
expires: Wed, 24 Apr 2024 12:55:39 GMT

GET
H2 200 archive.svg
s.ensonhaber.com/assets/img/nav/ 238 B
363 B 19ms
18ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/archive.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: feebe1fce6a2c5b44c30aca519403f048c63e4d0f021a472052065feccefc441

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948617
content-length: 202
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "ee-639c9a83-18325224231ec6ac;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9a19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 theme-dark.svg
s.ensonhaber.com/assets/img/nav/ 545 B
415 B 17ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/theme-dark.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 592726dcd36e27f1287a1ff2e6d14e5e68b928cd4eebed720c267d4633277286

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948617
content-length: 321
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "221-639c9a83-d5d50ee83eb5dfb6;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9b19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 notifications-off.svg
s.ensonhaber.com/assets/img/nav/ 1 KB
883 B 18ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/notifications-off.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b18344098c7beeb17792064f962b0325c6fe6b6b6e2708a521f346b71d4d283

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4772809
content-length: 716
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 10 Mar 2023 13:24:25 GMT
server: cloudflare
etag: "573-640b2f89-b9e1aca0490ef169;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9d19ab-FRA
expires: Wed, 24 Apr 2024 12:55:40 GMT

GET
H2 200 user.svg
s.ensonhaber.com/assets/img/nav/ 379 B
382 B 19ms
18ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/user.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 768382b088c5cb58e4a670880ea33d6926e16ddb5923a937f41f660269c676d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4772809
content-length: 260
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "17b-639c9a83-5a3c1594c91c1939;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9e19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 flag.svg
s.ensonhaber.com/assets/img/nav/ 664 B
491 B 21ms
21ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/flag.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 800532bf9b839ea479ad22d9735b2de456c113e98869f3d63cf92fe1643e469a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948635
content-length: 397
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "298-639c9a83-2532c638c956b99e;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd6a9f19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
DATA 200
OK truncated
/ 295 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe2182626d97612dfb6390dba18118a5f65a65d912fdbe4a9bc2e158f5c13dc3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 hamburger.svg
s.ensonhaber.com/assets/img/nav/ 141 B
233 B 17ms
15ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/hamburger.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b86bb840a36f6a4bd1b1ff4f64f3b62acc8b7b8a868bbdbd9f5a24c6bdb0ddf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 1M
content-encoding: gzip
cf-cache-status: HIT
age: 4774956
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: W/"8d-639c9a83-d5ea281d6f82c105;;;"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
cf-ray: 7daeaecd6aa519ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 53a42cf5d32fb8153b2f58d5ea30404e2c8cdac08e85153df1849682098c1cbb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 296 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b05416d448486b4f4bb414d78be3b4a8f3666c7c51b8e6aa12e74ea35f10018

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60280b8ab4c8d489c74567c55e14945b935c2f5937855f808163ee40a65f065f

Request headers

Referer
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 eshicons.ttf
s.ensonhaber.com/assets/fonts/eshicons/fonts/ 23 KB
12 KB 16ms
16ms Font
application/x-font-ttf 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ensonhaber.com/assets/fonts/eshicons/fonts/eshicons.ttf?ncw6hm
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f273840584f0246670b192fd23e6aac48cdad71d53ab3526d79f9fc90e88bb9

Request headers

Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Origin: https://www.ensonhaber.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948659
content-length: 12530
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "5a5c-639c9a83-56e91538b3845a0f;gz"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd7dc930e8-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 chpde-24-il-baskani-gorevini-birakti_333dc238.jpg
icdn.ensonhaber.com/crop/788x450-85/resimler/diger/kok/2023/06/21/ 123 KB
123 KB 38ms
18ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/788x450-85/resimler/diger/kok/2023/06/21/chpde-24-il-baskani-gorevini-birakti_333dc238.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 492ad43c4dbd6e861f77eb18d1c76f9400ba294eddf6f58cf71946450d10a926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7282
cf-polished: origSize=132632
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 125695
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "0ced3ededc877153ec6a6a697475f683b8299611"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb2019ab-FRA
esh2: 788
expires: Thu, 20 Jun 2024 17:31:26 GMT

GET
H2 200 veni-vidi-goz_1f684123.jpg
icdn.ensonhaber.com/crop/382x450-85/resimler/diger/kok/2023/06/20/ 52 KB
52 KB 42ms
23ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/382x450-85/resimler/diger/kok/2023/06/20/veni-vidi-goz_1f684123.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c49acbce18de283ee4d071ecb179378db91393dbf7ac081da6c321f866eed7b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 81278
cf-polished: origSize=56679
esh: 382
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 53505
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "a1d494578cfa560a440ee74933e732a6f9271b20"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb1c19ab-FRA
expires: Wed, 19 Jun 2024 20:58:11 GMT

GET
H2 200 turistleri-titanikin-enkazina-tasirken-kaybolan-denizalti-icin-arama_34533728.jpg
icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/ 20 KB
20 KB 36ms
17ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/turistleri-titanikin-enkazina-tasirken-kaybolan-denizalti-icin-arama_34533728.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12bcad3deadc62829c01d1c4854713a237a74515c550c48b8cdab9e6e1bc9996

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 2860
cf-polished: origSize=20949
esh: 233
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 20381
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "55076a4e59219f4f0c710e00f5aaca1868f3d1fd"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb2419ab-FRA
expires: Thu, 20 Jun 2024 18:45:19 GMT

GET
H2 200 cevdet-yilmaz-ve-mehmet-simsek-baeyi-ziyarete-gidecek_339c6502.jpg
icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/ 20 KB
20 KB 43ms
25ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/cevdet-yilmaz-ve-mehmet-simsek-baeyi-ziyarete-gidecek_339c6502.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 446252cf4c3b550af3d4d61595d3660595b40a9cf495223b70920f18ff626ff8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 5784
cf-polished: origSize=20842
esh: 233
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 20330
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "c4ca48ef834ee37f1c951a144c5c6606c3c1424d"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb2319ab-FRA
expires: Thu, 20 Jun 2024 17:56:40 GMT

GET
H2 200 nevsehirde-saganak-sele-donustu_339fd565.jpg
icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/ 16 KB
16 KB 44ms
25ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/nevsehirde-saganak-sele-donustu_339fd565.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb0e8e164f8f994c3be7045bd8eb86334380d96b47561956b046592d145d755a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 5678
cf-polished: origSize=16492
esh: 233
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 16102
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "065ed8937b53b8095bcba47c4865acba7e8d5f69"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb2219ab-FRA
expires: Thu, 20 Jun 2024 17:57:35 GMT

GET
H2 200 bm-dunya-genelinde-insani-yardima-muhtac-kisi-sayisi-360-milyona-yu_3347b468.jpg
icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/ 28 KB
28 KB 43ms
25ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/bm-dunya-genelinde-insani-yardima-muhtac-kisi-sayisi-360-milyona-yu_3347b468.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 836b38cdbed3a29dc66669048e7c7f7588fbe2514f32b925a5f677e7c6722f36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7112
cf-polished: origSize=29755
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 28512
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "6069a47cc75e1ecb275849106a641b907a4686e9"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdbb2119ab-FRA
esh2: 233
expires: Thu, 20 Jun 2024 17:33:55 GMT

GET
H2 200 yok-baskani-erol-ozvar-universite-sinavinin-kaldirilmasi-gunde_32803162.jpg
icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/ 20 KB
20 KB 21ms
21ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/233x260-85/resimler/diger/kok/2023/06/21/yok-baskani-erol-ozvar-universite-sinavinin-kaldirilmasi-gunde_32803162.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d652237f8e2a4a8d6db749b8f9be7ebde3372967fb4454887ccf380460c369f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 10313
cf-polished: origSize=20892
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 20296
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "8eb047edeade831f38cba6de28c379e461ae6957"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb2e19ab-FRA
esh2: 233
expires: Thu, 20 Jun 2024 16:41:01 GMT

GET
H2 200 yt-home.svg
s.ensonhaber.com/assets/img/ 31 KB
15 KB 23ms
20ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/yt-home.svg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f97e249d0d02045935033d1bf463910f81ae1fe89a5ed9b61c1dd369f18f06ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948611
content-length: 15522
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Thu, 12 Jan 2023 12:28:36 GMT
server: cloudflare
etag: "7b20-63bffcf4-248980f56cff858b;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd9afc19ab-FRA
expires: Wed, 24 Apr 2024 12:55:39 GMT

GET
H2 200 wp-home.svg
s.ensonhaber.com/assets/img/ 41 KB
21 KB 21ms
18ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/wp-home.svg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d36e747eb562ccce4eb72ec40b80fe06798d30975f4951a04aef2c60def318b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948611
content-length: 20870
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 20 Jan 2023 23:35:42 GMT
server: cloudflare
etag: "a586-63cb254e-3fab314fac59889a;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecd9afe19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 hdpli-meral-danis-bestastan-asgari-ucret-aciklamasi-kabul-etmiyo_2ff82803.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 33 KB
34 KB 16ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/hdpli-meral-danis-bestastan-asgari-ucret-aciklamasi-kabul-etmiyo_2ff82803.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7955e24a04f0f6979b9730697b45921ab3f81b03ba0fcbb7325b668d6bd23da6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 2860
cf-polished: origSize=35348
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 34134
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f3d5c53ef31dc41ec72e33445da6773bec290eec"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecddb6d19ab-FRA
expires: Thu, 20 Jun 2024 18:45:19 GMT

GET
H2 200 abdullah-gul-amcasinin-esinin-cenazesine-katildi_2febd314.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 40 KB
41 KB 26ms
25ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/abdullah-gul-amcasinin-esinin-cenazesine-katildi_2febd314.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01e1caf58394f459b15a0754ea42341ff3c697adc5eb4c077f6d9af374654b0c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 5678
cf-polished: origSize=43396
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 41464
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "15e9a607d940fe72fbf4281410dea4436ea8f824"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdeb7419ab-FRA
expires: Thu, 20 Jun 2024 17:57:34 GMT

GET
H2 200 vladimir-putin-nukleer-gucu-gelistirmek-en-onemli-gorevimiz_3054e774.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 21 KB
21 KB 16ms
15ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/vladimir-putin-nukleer-gucu-gelistirmek-en-onemli-gorevimiz_3054e774.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd0cba1a894b8a9bebd1394cfa675116713f9045497993f05291cd6a0b501f63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7107
cf-polished: origSize=21642
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 21394
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "0e7023d63693bebe4abc7a4afa91bc235a7cd7ea"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdeb7819ab-FRA
esh2: 400
expires: Thu, 20 Jun 2024 17:33:55 GMT

GET
H2 200 yi-partide-kurultay-hazrl-sryor-meral-akener-yeni-yolu-a_2f9f3447.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 29 KB
29 KB 21ms
21ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/yi-partide-kurultay-hazrl-sryor-meral-akener-yeni-yolu-a_2f9f3447.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9de4631fb6802442e80c56133c419f2ce1d5979d17c33b421d5dec1d23468571

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7510
cf-polished: origSize=30509
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 29821
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "287ffe51107c1aa42aaf4481d71b671cc74bfb48"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdeb7b19ab-FRA
esh2: 400
expires: Thu, 20 Jun 2024 17:27:43 GMT

GET
H2 200 mersin-erdemlide-hortum-seralari-yikti_33147455.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 48 KB
48 KB 15ms
14ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/mersin-erdemlide-hortum-seralari-yikti_33147455.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fcc05e8697e4fa1b9af99a987029133c782d8ad781d6251ea097cd2dfc5ee3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7908
cf-polished: origSize=51454
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 48793
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ba29274eb8aae2f6b94f70d24e113fa7730659f1"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdeb7d19ab-FRA
expires: Thu, 20 Jun 2024 17:20:42 GMT

GET
H2 200 yeni-haber-basligi_31821975.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 51 KB
51 KB 17ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/yeni-haber-basligi_31821975.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1f7724ef64a25174ce00e12b55284e5fc652f58ef84a46bb6719d234fdb1e8e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 9161
cf-polished: origSize=54179
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 51920
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "3f2217874725fd6455b86bf2c7f2a0616cad5fbf"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdeb7f19ab-FRA
expires: Thu, 20 Jun 2024 16:59:58 GMT

GET
H2 200 real-madrid-toni-kroosun-sozlesmesini-yeniledi_31774201.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 22 KB
22 KB 17ms
17ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/real-madrid-toni-kroosun-sozlesmesini-yeniledi_31774201.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db8b02e27648c8923b73cb3b9582718641e079897b7bfd4b32e74786e8565200

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 9180
cf-polished: origSize=22735
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 22251
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "84b2f14f7507bd0f07758ce50e78d80b1ea82386"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdfb9119ab-FRA
expires: Thu, 20 Jun 2024 16:59:50 GMT

GET
H2 200 suc-orgutu-lideri-firat-delibas-esenyurtta-yakalandi-1_2f464.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 30 KB
31 KB 24ms
24ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/suc-orgutu-lideri-firat-delibas-esenyurtta-yakalandi-1_2f464.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 345b7b8da6f10a856720fd05570e1caa0e745fded85e2e51d27bd7c2b6da2398

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 17456
cf-polished: origSize=32197
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 31229
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "3aa20af89331ef2f2d7345c10bf95576bdaa7376"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece0ba019ab-FRA
esh2: 400
expires: Thu, 20 Jun 2024 14:41:43 GMT

GET
H2 200 gonul-dagi-103-bolum-2-fragman-taner-gercegi-ogrendi-selma-o_29d7e925.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 30 KB
30 KB 25ms
25ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/gonul-dagi-103-bolum-2-fragman-taner-gercegi-ogrendi-selma-o_29d7e925.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79574e015175b8ea2f0366b354be78ae5be45c89150d0a42b7bfa6c9963dd5cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 33695
cf-polished: origSize=31235
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 30472
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f70a1dba26a0b490f5201110a65bac7d898c857f"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece0ba119ab-FRA
expires: Thu, 20 Jun 2024 10:11:14 GMT

GET
H2 200 yiyen-duz-duvara-tirmaniyor-karpuzun-beyaz-kisimlari-meger_19f28145.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/20/ 24 KB
25 KB 24ms
23ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/20/yiyen-duz-duvara-tirmaniyor-karpuzun-beyaz-kisimlari-meger_19f28145.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00f209e5346c214d363ba40bcb0d7dabfad704152bb606c4c9602e379bd42d0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 102718
cf-polished: origSize=25646
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 25006
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "d41ee5ebfce495bc06f5046b0d10cc6037e932de"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece0baa19ab-FRA
esh2: 400
expires: Wed, 19 Jun 2024 15:00:15 GMT

GET
H2 200 beril-pozamdan-bikinili-poz_2d4e2736.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 22 KB
22 KB 22ms
21ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/beril-pozamdan-bikinili-poz_2d4e2736.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b05c53bea43812b44e419f33dc164c279d0ee87cb23084d657202bca8017bec8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 3340
cf-polished: origSize=23642
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 22673
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "eac9a98864216602d53bc44f1c20a4213387bedd"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece0bad19ab-FRA
esh2: 186
expires: Thu, 20 Jun 2024 18:36:21 GMT

GET
H2 200 abd-polisinden-hapishanedeki-siyahi-tutukluya-siddet_2d984613.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 18 KB
19 KB 21ms
20ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/abd-polisinden-hapishanedeki-siyahi-tutukluya-siddet_2d984613.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a3a58738834d6debdc3f257a5775601741fe7ea062eb48c8eb02ee0ad601f20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 4974
cf-polished: origSize=19408
esh: 186
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 18934
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "42674cf91962f46cb2905becae1d7772a569ca5a"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece0baf19ab-FRA
expires: Thu, 20 Jun 2024 18:09:43 GMT

GET
H2 200 yeni-haber-basligi_2933b861.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 9 KB
9 KB 18ms
18ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/yeni-haber-basligi_2933b861.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 309abe44eb60bb130df184f61f443953cd3fcbc5b909dd005ec72b3b15021c75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 1922
cf-polished: origSize=8986
esh: 160
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 8822
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "b919313b838e4e6f1afe0b257d8fed2600360fa6"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece1bc119ab-FRA
expires: Thu, 20 Jun 2024 19:00:37 GMT

GET
H2 200 yeni-haber-basligi_2e008472.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 9 KB
9 KB 20ms
17ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/yeni-haber-basligi_2e008472.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f989066757a82b34734e6ba6823770f5f1b0f3da11595bf1cb846a91c602ec07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 19530
cf-polished: origSize=8998
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 8829
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "a14d8dbb87a78a5b70bf46e3c5538a0a9d7c5d91"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be019ab-FRA
esh2: 160
expires: Thu, 20 Jun 2024 14:07:42 GMT

GET
H2 200 yeni-haber-basligi_319a9291.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 9 KB
9 KB 17ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/yeni-haber-basligi_319a9291.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3d250710905b1e58c752cfcb0b3a1f35623fd5b86764fbf9e8b0b0392f2ca32

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 9088
cf-polished: origSize=9031
esh: 160
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 8838
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "920e8eb75b620c7553dd2be037b0f7e02905651a"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be119ab-FRA
expires: Thu, 20 Jun 2024 17:01:01 GMT

GET
H2 200 burcu-ozberk-italyaya-gitti_2b84b298.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 19 KB
19 KB 20ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/burcu-ozberk-italyaya-gitti_2b84b298.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44390ffd4b53f31574a15edd86377376b061b7096ef0a5b1ff76da6dc4008ab6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 5784
cf-polished: origSize=19996
esh: 186
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 19330
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "65729474569cfe366552608a9c55ea71387a687c"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be319ab-FRA
expires: Thu, 20 Jun 2024 17:56:12 GMT

GET
H2 200 diyarbakir-havalimani-otoparkinda-ambalaji-uzerinde-sifir-arac-stok_2d30e216.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 25 KB
25 KB 20ms
20ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/diyarbakir-havalimani-otoparkinda-ambalaji-uzerinde-sifir-arac-stok_2d30e216.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c17cf0e01b410087dbe8dc19706c995f4d3b246e64e1db192138dd6fe826cc4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7963
cf-polished: origSize=26468
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 25378
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "a1e576b7200762ddcdd8b97604f54ef70786c22f"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be419ab-FRA
esh2: 186
expires: Thu, 20 Jun 2024 17:19:08 GMT

GET
H2 200 gulusuyle-unlendi-hababam-sinifinin-bacaksizi-tuncay-akca-ba_301d2376.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 6 KB
7 KB 16ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/gulusuyle-unlendi-hababam-sinifinin-bacaksizi-tuncay-akca-ba_301d2376.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a1a47d73652bcc5b2be7cd02ffb055ac5a14d3424d949d1f9232a09d2720db0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 16351
cf-polished: origSize=6591
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 6567
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "edfdde3be4f1f063063202f544ce723ec7c63ad3"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be619ab-FRA
esh2: 160
expires: Thu, 20 Jun 2024 15:00:12 GMT

GET
H2 200 istanbulda-uyusturucu-tacirlerine-operasyon184-gozalti_301b1755.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 7 KB
7 KB 19ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/istanbulda-uyusturucu-tacirlerine-operasyon184-gozalti_301b1755.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 642690da3a34058586de455c174c0ca0ac0cfe90621a06602a60fd94bd204218

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 846
cf-polished: origSize=7219
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 7095
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "5c36962f693c2d746bf3d1ed3b8e5202eede660a"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece3be819ab-FRA
esh2: 160
expires: Thu, 20 Jun 2024 19:18:22 GMT

GET
H2 200 singapurda-intihar-girisimi-ozel-ekipler-tarafindan-onlendi_2f1d7423.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 6 KB
6 KB 21ms
17ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/singapurda-intihar-girisimi-ozel-ekipler-tarafindan-onlendi_2f1d7423.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d3a97eb0de0a03be74334808c5faad0ddb368de9dce18363702d500326f1a78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 7497
cf-polished: origSize=5700
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 5656
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f8c3c2296c65397eee9eb9ab1bedf738ee2d5e2f"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c2619ab-FRA
esh2: 160
expires: Thu, 20 Jun 2024 17:27:27 GMT

GET
H2 200 yeni-haber-basligi_2f8a5367.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 6 KB
6 KB 20ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/yeni-haber-basligi_2f8a5367.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aced13c5cde18af20f9f6d8691609ddd5c748c18e0437e5e887a960977f5c73d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 13154
cf-polished: origSize=6300
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 6274
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "968d785ecd6c4aeda964ab135494babf3561b521"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c2719ab-FRA
esh2: 160
expires: Thu, 20 Jun 2024 15:53:52 GMT

GET
H2 200 yusufelinin-guresci-bogalari-yeni-arenada_2f9c5835.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 8 KB
8 KB 26ms
22ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/yusufelinin-guresci-bogalari-yeni-arenada_2f9c5835.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41a27147fbfef41f281db7f00102b2b4860422aae427740623a145892f477160

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 13417
cf-polished: origSize=8706
esh: 160
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 8422
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f9b5eba4f3acb7ebb421993b488735713a452b29"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c2919ab-FRA
expires: Thu, 20 Jun 2024 15:48:48 GMT

GET
H2 200 ata-ittifakindan-yeni-parti-cikti-iki-partiden-birlesme-karari_2f825524.jpg
icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ 7 KB
7 KB 20ms
18ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/160x90-85/resimler/diger/kok/2023/06/21/ata-ittifakindan-yeni-parti-cikti-iki-partiden-birlesme-karari_2f825524.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 816d252bcef80b84b9ec2c9ca60fa16e4af7fd8dc2932f68c77844a74cd87a55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 4974
cf-polished: origSize=6956
esh: 160
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 6836
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "dc6e9b9473b21247278182c65dd97bee1a080a26"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c2d19ab-FRA
expires: Thu, 20 Jun 2024 18:09:43 GMT

GET
H2 200 besiktasin-muhtemel-rakiplerini-taniyalim_31412422.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 40 KB
40 KB 21ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/besiktasin-muhtemel-rakiplerini-taniyalim_31412422.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dde986d501f11f0aece25ea490512c34f0fdff0104a4858b61eacda34c107d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 15086
cf-polished: origSize=43164
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 41209
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "502de12a0cbf0897ea83b678b0e3bf6ff4b01e80"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c2e19ab-FRA
expires: Thu, 20 Jun 2024 15:21:29 GMT

GET
H2 200 fenerbahcenin-konferans-ligindeki-rakiplerini-taniyalim_31207698.jpg
icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/ 45 KB
45 KB 22ms
20ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/400x225-85/resimler/diger/kok/2023/06/21/fenerbahcenin-konferans-ligindeki-rakiplerini-taniyalim_31207698.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b31b08f5197d4bce6f97586010b2699dd3574d0b5dcb9735aa4b31ebf7a39b77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 15653
cf-polished: origSize=48177
esh: 400
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 46031
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "d15ab880faa5fa043ea6411606ca792ce8124f0f"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece5c3019ab-FRA
expires: Thu, 20 Jun 2024 15:12:26 GMT

GET
H2 200 hatayda-53-saat-sonra-enkazdan-cikan-genc-kurtaricilari-ile-bulustu_2c953824.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 22 KB
23 KB 23ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/hatayda-53-saat-sonra-enkazdan-cikan-genc-kurtaricilari-ile-bulustu_2c953824.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98ce235596c3042bd01d1609085f467f2d3630b54912434289bdf50c329d8c52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 11191
cf-polished: origSize=23776
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 22906
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "91fb119de95432c573b2dd8c04e3b434b7acfa24"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6019ab-FRA
esh2: 186
expires: Thu, 20 Jun 2024 16:25:51 GMT

GET
H2 200 kayseride-alkol-alinan-masada-oynatilan-kiz-cocugu-henuz-bulunamadi_2bfe3220.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 25 KB
25 KB 19ms
15ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/kayseride-alkol-alinan-masada-oynatilan-kiz-cocugu-henuz-bulunamadi_2bfe3220.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c19206c024726a36da0e04d60a41053c3151874c32953bb90c46e79a0908685

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 12009
cf-polished: origSize=26838
esh: 186
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 25619
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ca857d24178fd6f1f9ae1fb451c4caef91ef5a40"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6119ab-FRA
expires: Thu, 20 Jun 2024 16:11:55 GMT

GET
H2 200 tuncelinin-kelebekleri_4357.jpg
icdn.ensonhaber.com/crop/340x191-85/resimler/galeri/kok/2023/06/19/ 12 KB
13 KB 28ms
24ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/340x191-85/resimler/galeri/kok/2023/06/19/tuncelinin-kelebekleri_4357.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13cab061ea47f0fe6c3fd6b37e6728beb40dc447c3086aef9ba1132eb0df6490

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 201847
cf-polished: origSize=12827
esh: 340
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 12671
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "bcf11022c4e4e21f93a1bcc6bfc0d174a64d98bb"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6219ab-FRA
expires: Tue, 18 Jun 2024 11:28:39 GMT

GET
H2 200 boluda-esinin-agabeyi-ve-yegeni-tarafindan-acimasizca-dovuldu_2ba87250.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 25 KB
25 KB 21ms
18ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/boluda-esinin-agabeyi-ve-yegeni-tarafindan-acimasizca-dovuldu_2ba87250.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db14f5793d357dcf51166ba19a5b233cc9d9bbcc059f160e2f0069b23441dca1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 12474
cf-polished: origSize=26304
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 25138
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "361bfca0e8b1b0de95dc7195462d9dd28a7024a5"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6319ab-FRA
esh2: 186
expires: Thu, 20 Jun 2024 16:05:03 GMT

GET
H2 200 izmirde-4-turkmenin-katili-tutuklandi_2b80d606.jpg
icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/ 22 KB
22 KB 18ms
17ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/186x218-85/resimler/diger/kok/2023/06/21/izmirde-4-turkmenin-katili-tutuklandi_2b80d606.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44bd343862046968424f4d9db05d46c1e851bfca9c5005906894c157fde2473f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 16266
cf-polished: origSize=23137
esh: 186
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 22032
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f74f2e40f7c40513c369cdaa169df6267a42cd3e"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6519ab-FRA
expires: Thu, 20 Jun 2024 15:01:23 GMT

GET
H2 200 youtube-white.svg
s.ensonhaber.com/assets/img/svg/ 4 KB
2 KB 20ms
19ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/youtube-white.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32d75b8d9906e4fe046307d507ff6d1893ed34d99a6f28f931301ed5d296728b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948612
content-length: 1754
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "f42-639c9a84-de402b8448af89b4;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb4119ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 youtube-player.svg
s.ensonhaber.com/assets/img/svg/ 1 KB
761 B 17ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/youtube-player.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e92728d3f84f8648d013fffa073f09ffd774aefb957c5bc08b98c9af97c28979

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4774812
content-length: 567
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "431-639c9a84-a968250828655b7a;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb4219ab-FRA
expires: Thu, 25 Apr 2024 06:58:10 GMT

GET
H2 200 logo.svg
s.ensonhaber.com/assets/img/nav/ 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/nav/logo.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65803b3152b8225540cdda2ae8e3a298ba9eb591cc35d9e7fe4b906b0f515ead

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 1038
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:15 GMT
server: cloudflare
etag: "801-639c9a83-2deb684a3979a6f;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb4e19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 telegram.svg
s.ensonhaber.com/assets/img/social/svg/ 393 B
378 B 17ms
16ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/telegram.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0bdf831bc0414f96ebd455a30c1ded4739f659071f0dbb60be94a3d4acd8f4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 277
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "189-639c9a84-96400f8900acc41e;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5019ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 whatsapp.svg
s.ensonhaber.com/assets/img/social/svg/ 3 KB
1 KB 21ms
20ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/whatsapp.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96ad4daa65142f22e17fd212940a4997af6e475206bd70a8da1a4e293f9c2d88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4772809
content-length: 1108
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "acf-639c9a84-20f1ab362ceade15;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5319ab-FRA
expires: Wed, 24 Apr 2024 12:55:39 GMT

GET
H2 200 youtube.svg
s.ensonhaber.com/assets/img/social/svg/ 953 B
518 B 20ms
19ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/youtube.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 416a4c85b488c3fe2ca26298fc13a4fec28626649939aeab1f5862a27e046cf0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 423
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "3b9-639c9a84-92da1d82d3fbff6f;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5519ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 twitter.svg
s.ensonhaber.com/assets/img/social/svg/ 856 B
583 B 19ms
18ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/twitter.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d0a8c318709b662988173b2343311cff1342159884ea66bb2f6a98287ca916f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4774956
content-length: 482
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "358-639c9a84-8f449a611e7de763;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5619ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 instagram.svg
s.ensonhaber.com/assets/img/social/svg/ 2 KB
831 B 20ms
19ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/instagram.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b8da33976e16cb84f8ffe8224b95df6e90a1f81f604b99b0ed1b505c983f68b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 737
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "853-639c9a84-13d92e1e1566001a;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5819ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 facebook.svg
s.ensonhaber.com/assets/img/social/svg/ 656 B
487 B 18ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/social/svg/facebook.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c2d6ce4a7f2a02270cd2693256f756b8ed4e2c64f2eb6b9b33cbadd22cc2140

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 393
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "290-639c9a84-a482b1a13127354d;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecdcb5b19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 dele-alli-sacini-boyadi_34609450.jpg
icdn.ensonhaber.com/crop/700x400-85/resimler/diger/kok/2023/06/21/ 74 KB
74 KB 22ms
22ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/700x400-85/resimler/diger/kok/2023/06/21/dele-alli-sacini-boyadi_34609450.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 586e363f37521dcbfcd7ba32cc2305081db89c33d632f9db1cb95a6eaf092031

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 2616
cf-polished: origSize=78099
esh: 700
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 75456
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "f109357a7dc94430407cd226966fba821ffcaca6"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c6619ab-FRA
expires: Thu, 20 Jun 2024 18:48:52 GMT

GET
H2 200 filenin-efeleri-avrupa-altin-ligi-dortlu-finali-hazirliklarini-tama_33ec1419.jpg
icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/ 13 KB
13 KB 22ms
15ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/filenin-efeleri-avrupa-altin-ligi-dortlu-finali-hazirliklarini-tama_33ec1419.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9c22b1c52421d79788e5590f0b33e9847080e119b367d23f7a3ab8fc793d986

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 4462
cf-polished: origSize=13127
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 12864
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "9fd62aaa8588680799c47d48307cb4978564ec0c"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece9c8f19ab-FRA
esh2: 229
expires: Thu, 20 Jun 2024 18:18:11 GMT

GET
H2 200 danielle-cuttino-galatasaraya-transfer-oldu_31698978.jpg
icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/ 7 KB
7 KB 23ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/danielle-cuttino-galatasaraya-transfer-oldu_31698978.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68c54025d4765832f03ef10c8468ca1d849ee429b51b4f264890e54ce27f66a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 11976
cf-polished: origSize=7620
esh: 229
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 7479
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "58011849923fed1e7211e2f7c13ba9b65abb6812"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceac9219ab-FRA
expires: Thu, 20 Jun 2024 16:13:06 GMT

GET
H2 200 sertac-sanli-sonuna-kadar-hak-ettik_31051940.jpg
icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/ 14 KB
14 KB 19ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/sertac-sanli-sonuna-kadar-hak-ettik_31051940.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 276e17bfb22e4bda39154fcf2fe17921a530e3b7c5697d92c09348e1ba60d042

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 16351
cf-polished: origSize=14628
esh: 229
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 14312
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "9a526c50b3e6c4cf763f955e568298134418df06"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceac9419ab-FRA
expires: Thu, 20 Jun 2024 15:00:23 GMT

GET
H2 200 dursun-ozbekten-transfer-aciklamasi_2f8f8176.jpg
icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/ 10 KB
10 KB 19ms
15ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/229x129-85/resimler/diger/kok/2023/06/21/dursun-ozbekten-transfer-aciklamasi_2f8f8176.jpg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10c2718b5a8f0a342627ce1e4da4ee9ab45fcc24cff760530da5a33d2db6cdf4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 22344
cf-polished: origSize=10306
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 10278
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "d065e2d5c29425e8f79e4c56c71d71e97319ad64"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceac9519ab-FRA
esh2: 229
expires: Thu, 20 Jun 2024 13:20:14 GMT

GET
H2 200 borsaticker Show response
www.ensonhaber.com/dynamic/ 8 KB
2 KB 19ms
19ms Fetch
text/html 89.187.169.43
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://www.ensonhaber.com/dynamic/borsaticker
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/js/home.min.js?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.43 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-43.cdn77.com
Software: MerlinCDN / PHP/8.0.25
Resource Hash: c2d95b13f2805a42b1eae40e7d96574e0d844c0678f412844329038764573c78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
via: HTTP/2.0 Merlin CDN
content-encoding: gzip
server: MerlinCDN
age: 35
x-midtier: nl-naw-ws-s08
x-cache-status: HIT
x-litespeed-cache: hit
x-powered-by: PHP/8.0.25
content-type: text/html; charset=UTF-8
allow: GET, HEAD, POST
etag: W/"4957724-1687374457;;;"
x-edge: de-fra-dp-s01
cache-control: max-age=300
caching-type: litespeed

GET
DATA 200
OK truncated
/ 603 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b7d079bf21e72c5449d5aa75a4916c4556a0fd2b02cadd2a93aa1d1529957722

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 603 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b0b6c2ef65f2486f7be1c3b49a50e88ed2602d29d1f9ecb03ddd4e198c8e5910

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 istanbul.json Show response
api-stg.ensonhaber.com/data/havadurumu/ 3 KB
835 B 57ms
40ms Fetch
application/json 2606:4700:10::ac43:28c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-stg.ensonhaber.com/data/havadurumu/istanbul.json
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/js/home.min.js?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:28c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.25
Resource Hash: f292c72aa85fdfd6d04f159436d8be01f6ca4186fe1442bf68c946a4a37811c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
cache-file: data___istanbul_saatlik_2023-06-21.json
cf-cache-status: HIT
age: 215
x-powered-by: PHP/8.0.25
x-litespeed-cache: miss
content-length: 501
server: cloudflare
etag: "762635-1687375236;gz"
vary: Accept-Encoding
access-control-allow-methods: PUT, GET, POST, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
x-server: api-srv-1
accept-ranges: bytes
x-robots-tag: noindex
access-control-allow-headers: x-requested-with, origin, x-requested-with, content-type
cache3: out-of-memory
cf-ray: 7daeaece8f0230e8-FRA

GET
H2 200 loading-red.svg
www.ensonhaber.com/assets/img/svg/ 1012 B
584 B 25ms
21ms Image
image/svg+xml 89.187.169.43
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ensonhaber.com/assets/img/svg/loading-red.svg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.43 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-43.cdn77.com
Software: MerlinCDN /
Resource Hash: 8ed948e6d6586fc5cfd9284799eb76290f6c6067a481efbb08e1720977b33c33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
via: HTTP/2.0 Merlin CDN
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: MerlinCDN
age: 4946822
etag: W/"3f4-639c9a84-c475a4ec4487325e;;;"
x-midtier: de-fra-dp-s02
x-cache-status: HIT
allow: GET, HEAD, POST
content-type: image/svg+xml
x-edge: de-fra-dp-s01
cache-control: max-age=31536000

GET
H2 200 loading-red.svg
s.ensonhaber.com/assets/img/svg/ 1012 B
479 B 20ms
16ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/loading-red.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ed948e6d6586fc5cfd9284799eb76290f6c6067a481efbb08e1720977b33c33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948634
content-length: 284
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "3f4-639c9a84-c475a4ec4487325e;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaece7c5d19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 down-red.svg
s.ensonhaber.com/assets/img/svg/ 735 B
686 B 14ms
14ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/down-red.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9838cf0fe876be799851d050135c445d90b5bba432de6f60f4fa68ed7d6a0dc5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4774785
content-length: 487
x-vtex-cache-status-nginx-thumbor: HIT
last-modified: Wed, 28 Dec 2022 15:09:42 GMT
server: cloudflare
etag: "2df-63ac5c36-bff6e9315efa01c9;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceeced19ab-FRA
expires: Thu, 25 Apr 2024 06:58:06 GMT

GET
H2 200 up-green.svg
s.ensonhaber.com/assets/img/svg/ 764 B
606 B 16ms
16ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/up-green.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74d5ddb896390fbd0d379431074c833d31f208835ef558dd0ede1264e46a3a5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948608
content-length: 504
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Wed, 28 Dec 2022 15:09:42 GMT
server: cloudflare
etag: "2fc-63ac5c36-8edaee021ef5d882;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceecef19ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 bitexen.svg
s.ensonhaber.com/assets/img/svg/ 9 KB
7 KB 15ms
15ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/bitexen.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d12d07d40ba2f3439d466eba90f27f46581293306f8be3acbb0909a89b4e85a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 2306550
content-length: 7235
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: cloudflare
etag: "2559-639c9a84-eb01bfa43127277e;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaeceecf119ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 crypto-currency-white.svg
s.ensonhaber.com/assets/img/svg/ 777 B
588 B 17ms
17ms Image
image/svg+xml 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ensonhaber.com/assets/img/svg/crypto-currency-white.svg
Requested by: Host: s.ensonhaber.com
URL: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ca8877766a4fcd6665a6fd63e69359eb0d19d47df34e399d34345c12e00db4c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.ensonhaber.com/assets/css/home.min.css?v=3.14.62_110bdcf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-msg-05: fetch: save cache with 1M
cf-cache-status: HIT
age: 4948608
content-length: 473
x-vtex-cache-status-nginx-thumbor: MISS
last-modified: Wed, 28 Dec 2022 15:09:42 GMT
server: cloudflare
etag: "309-63ac5c36-e35f449c24d92fc1;gz"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-msg-esh: js gnc cdn
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaecefcf219ab-FRA
expires: Wed, 24 Apr 2024 12:55:38 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 289 KB
98 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3G92ST5T0Z&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PL4PL92

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a9328fea776122005c824c4e6a1e402ef53ad3ae9d5afe73f91681b0f0ce59e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99872
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H2 200 1.svg
www.ensonhaber.com/assets/img/svg/weather/set1/fill/ 783 B
749 B 20ms
19ms Image
image/svg+xml 89.187.169.43
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ensonhaber.com/assets/img/svg/weather/set1/fill/1.svg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.43 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-43.cdn77.com
Software: MerlinCDN /
Resource Hash: 05ec57e3bf50c723dd83849e24de2ddd91ee49fb7c72c3a80e4061eb723cacde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
via: HTTP/2.0 Merlin CDN
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: MerlinCDN
age: 4945902
etag: W/"30f-639c9a84-6f86531e74315052;;;"
x-midtier: nl-naw-ws-s08
x-cache-status: HIT
allow: GET, HEAD, POST
content-type: image/svg+xml
x-edge: de-fra-dp-s01
cache-control: max-age=31536000

GET
H2 200 33.svg
www.ensonhaber.com/assets/img/svg/weather/set1/fill/ 813 B
724 B 21ms
19ms Image
image/svg+xml 89.187.169.43
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ensonhaber.com/assets/img/svg/weather/set1/fill/33.svg
Requested by: Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.43 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-43.cdn77.com
Software: MerlinCDN /
Resource Hash: 44e47e47c96c54501f577da9294014414a2f716ee0f6fa63a44f981be79337d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
via: HTTP/2.0 Merlin CDN
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 16:19:16 GMT
server: MerlinCDN
age: 4940829
etag: W/"32d-639c9a84-79b8375c1d41a623;;;"
x-midtier: nl-naw-ws-s08
x-cache-status: HIT
allow: GET, HEAD, POST
content-type: image/svg+xml
x-edge: de-fra-dp-s01
cache-control: max-age=31536000

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/ 393 KB
125 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

923ac60ae2b51d9cb2025f34d30e8188c5bdfb61e04f7d5c88908b56800c7ed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:36:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32234
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127691
x-xss-protection: 0
server: cafe
etag: 13681810057703077335
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 20 Jun 2024 10:36:08 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 2 KB
576 B 58ms
43ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.ensonhaber.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88b1258dac80af1416de261b7b1ed0c629ba684d62b2217d6429c3c609c007d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 551
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:22 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
256 B 40ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-3G92ST5T0Z&gtm=45je36e2&_p=829601041&cid=1137403029.1687376003&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1687376002&sct=1&seg=0&dl=https%3A%2F%2Fwww.ensonhaber.com%2F&dt=Ensonhaber%20%E2%80%93%20Son%20Dakika%20Haber%2C%20G%C3%BCncel%20Haberler&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3G92ST5T0Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1065653642/ 3 KB
2 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1065653642/?random=1687376002509&cv=11&fst=1687376002509&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ensonhaber.com%2F&hn=www.googleadservices.com&frm=0&tiba=Ensonhaber%20%E2%80%93%20Son%20Dakika%20Haber%2C%20G%C3%BCncel%20Haberler&auid=789136571.1687376003&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3G92ST5T0Z&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f442f70032b533ebd29611e95f939fe820610aba25a11e776ddea4fe83e283a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1347
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
155 B 42ms
41ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=pp_iris_failure&pvsid=2752916905154317&fnc=9170022&vrg=202306200101&nw_id=9170022&nslots=6&eid=31072019%2C31074947%2C31075507&pub_url=https%3A%2F%2Fwww.ensonhaber.com%2F

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 40ms
17ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.ensonhaber.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 12 KB
4 KB 57ms
14ms Script
application/javascript 172.64.152.222
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.222 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d285ae6755d52c452904f5bdfa4a6c2082186d695304b242e9db2f12461f02e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 15 Jun 2023 16:15:13 GMT
server: cloudflare
age: 84991
etag: W/"648b3911-2e4b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 7daeaed07d6b916b-FRA
expires: Thu, 22 Jun 2023 19:33:22 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
789 B 277ms
277ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d08b4ad7929d3ab1d02b1e60e0b29d4dedcba69a1152a257f92f4fa00213520d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 758
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
12 KB 1049ms
1048ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

084b60049497a98a794e99774a0e6471251120d462fbd6c75c7056ca94b8d4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11920
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 916 B
471 B 1294ms
1293ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d4446663c5bb743f2f22240837118394ada81bae48ac3aa34bdc62a1016d7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 429
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 24 KB
11 KB 456ms
455ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b34b3d2c1002127f4489735b49d53ab7d4a369930f9280cb4a3fef6e89ed439

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11364
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
11 KB 748ms
747ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d7a6b1e7bc960187d4250c7b75e7c892a1169011a55718d6bfdaaf3fae9b2a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11186
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 607ms
607ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

148c107d6580ac011291431566cc22525118c456c7cd6ebf82a6b967787a226e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14354
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6BAA 6 KB
3 KB 87ms
14ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/ 37 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl_page_level_ads.js?cb=31075507

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ab6608273f8d3c48c4080e531a5f99a8365dac7245e362cdb57c59e024b20a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:38:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32080
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13138
x-xss-protection: 0
server: cafe
etag: 11137768676305576577
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 20 Jun 2024 10:38:42 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1065653642/ 42 B
455 B 42ms
19ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1065653642/?random=1687376002509&cv=11&fst=1687374000000&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ensonhaber.com%2F&frm=0&tiba=Ensonhaber%20%E2%80%93%20Son%20Dakika%20Haber%2C%20G%C3%BCncel%20Haberler&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=596972041&rmt_tld=0&ipr=y

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1065653642/ 42 B
455 B 39ms
17ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1065653642/?random=1687376002509&cv=11&fst=1687374000000&bg=ffffff&guid=ON&async=1&gtm=45je36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ensonhaber.com%2F&frm=0&tiba=Ensonhaber%20%E2%80%93%20Son%20Dakika%20Haber%2C%20G%C3%BCncel%20Haberler&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=596972041&rmt_tld=1&ipr=y

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 style
accounts.google.com/gsi/ 533 B
585 B 48ms
47ms Stylesheet
text/css 2a00:1450:4001:800::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/style

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/gsi/client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WTEiet0mYYkFQsY0QqsY7A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-security-policy: script-src 'report-sample' 'nonce-WTEiet0mYYkFQsY0QqsY7A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: text/css; charset=utf-8
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 60ms
59ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306200101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e3adbde6b2b5292f5aa91c15bbaaf9771ca5c2e8d54a61f41837d1a13fa888

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11322
x-xss-protection: 0

GET
H2 200 sinan-akcil-ileride-turk-gencligini-temsil-etmek-icin-siyasete-ati_32d5c246.jpg
icdn.ensonhaber.com/crop/788x450-85/resimler/diger/kok/2023/06/21/ 103 KB
103 KB 16ms
16ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/788x450-85/resimler/diger/kok/2023/06/21/sinan-akcil-ileride-turk-gencligini-temsil-etmek-icin-siyasete-ati_32d5c246.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f73a7c4662797dccfa62e357e6fa213570f595456b540ef9e916ec684162485a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 8957
cf-polished: origSize=109211
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 105102
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "0acc6c7b2495744c6526d47edb1df6814ba25455"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaed1783719ab-FRA
esh2: 788
expires: Thu, 20 Jun 2024 17:03:45 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 108ms
49ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 21 Jun 2023 19:33:22 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7C12 13 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2649
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 18:49:13 GMT
expires: Thu, 20 Jun 2024 18:49:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C550 783 B
952 B 19ms
18ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e71440bc2e2f56dda4e31fa8536c75b43283a87bb158b55484be9e1e23d50f0a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-OtMleDq8UmsVOcAz7fN9Ug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-OtMleDq8UmsVOcAz7fN9Ug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Wed, 21 Jun 2023 19:33:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C12 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

999415a508fe78341a8e9bb9f55abd136a4cbb7dbf615028356efd2c023a40c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 12:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25236
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14716
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Jun 2024 12:32:46 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C550 0
0 41ms
41ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306200101&jk=2752916905154317&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7C12 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?fZ3FPA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 2 KB
2 KB 41ms
7ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:18:18 GMT
via: 1.1 google
age: 905
x-guploader-uploadid: ADPycdvLHovSFAdIU69Lowubtwnb5clUl6MwwDNqd_RzE9QihTl0owkM4Sn_1fJbHllzbZtV9GuvSvfpBvwZ1FcRoGKWYA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1938
last-modified: Thu, 27 Apr 2023 19:53:17 GMT
server: UploadServer
etag: "0a4a90264145ed4c5c647dae5dfb0429"
x-goog-generation: 1682625197861193
x-goog-hash: crc32c=jhvysQ==, md5=CkqQJkFF7UxcZH2uXfsEKQ==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1938
accept-ranges: bytes
expires: Wed, 21 Jun 2023 20:18:18 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 50ms
24ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 31 May 2023 13:09:50 GMT
server: nginx
etag: W/"6477471e-a980"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 22 Jun 2023 19:33:23 GMT

GET
H2 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 636B 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1DDB 624 B
242 B 51ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjV1rLlATAB&v=APEucNWCNDnGTxU6tnd_iu0FPLv8kuOHUBs0HpcWjKqddBFBWLmntCE9P8cNOO29Xct3wYm_5ys-v3vMnlvQumFiRkAXqN6yBv4ikBwTe6oXRMzsYR6cIJzIGNZoWJ8HdH8PNxYcQ07pe1irE6floEuB7WgMW61NdhusXfRyNOwrlNiyHQwqKUeyas0ZUmdnbqiTf5oDsD44

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 636B 78 KB
27 KB 130ms
129ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 636B 42 B
63 B 42ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B7W2CPG6ZtuBtgG-QxbWMUqljgBWB2IihgOoCPUlHG94Eq8l18mm3nJGW5rmjX012fXrEBz9qR5GC1URkwzXEgtLXyjZKjJCuVFiry7S8gzTLg5ZI

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 636B 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9430209476401237127&x=1&ct=76

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 636B 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 18:48:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 636B 19 KB
8 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 636B 0
0 15ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQgZzLuyN7pSfb7DNihCZ87jKb70PehK4CHHY_Ca6O5B4HGV7jkiC-tJfEX_3vkZXbMxrCaBIUk1viGUVOBdejnL50WBw
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 636B 178 KB
56 KB 117ms
72ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57058
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687274360908795"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 59ms
26ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ensonhaber.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://www.ensonhaber.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Wed, 21 Jun 2023 19:33:23 GMT
server: Google Frontend
vary: Origin
via: 1.1 google, 1.1 google
x-cloud-trace-context: a78d077bac6a3f03add78dc4ab7dd9bf

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
315 B 24ms
23ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 13206b0b7ede3e24e8e36376604cb4138487fce06098e85b2254f53083b549f5

Request headers

Referer: https://www.ensonhaber.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: d5f035c24dc91fbbfc773d2a680bce25
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 221

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 44F7 15 KB
6 KB 58ms
18ms Document
text/html 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.ensonhaber.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

645709dcb09b2700fd5a5938dbdf783ac90a88334e5104041db53302441f33e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
server: Kestrel
server-processing-duration-in-ticks: 293357
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1DDB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEONEv3lVPsomav6dpbobJH0&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEONEv3lVPsomav6dpbobJH0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjV1rLlATAB&v=APEucNWCNDnGTxU6tnd_iu0FPLv8kuOHUBs0HpcWjKqddBFBWLmntCE9P8cNOO29Xct3wYm_5ys-v3vMnlvQumFiRkAXqN6yBv4ikBwTe6oXRMzsYR6cIJzIGNZoWJ8HdH8PNxYcQ07pe1irE6floEuB7WgMW61NdhusXfRyNOwrlNiyHQwqKUeyas0ZUmdnbqiTf5oDsD44
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEONEv3lVPsomav6dpbobJH0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1DDB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjV1rLlATAB&v=APEucNWCNDnGTxU6tnd_iu0FPLv8kuOHUBs0HpcWjKqddBFBWLmntCE9P8cNOO29Xct3wYm_5ys-v3vMnlvQumFiRkAXqN6yBv4ikBwTe6oXRMzsYR6cIJzIGNZoWJ8HdH8PNxYcQ07pe1irE6floEuB7WgMW61NdhusXfRyNOwrlNiyHQwqKUeyas0ZUmdnbqiTf5oDsD44
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 1DDB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENS0b1sxYdNqbl2adRpnDmc&google_cver=1

43 B
1 KB

40ms
39ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENS0b1sxYdNqbl2adRpnDmc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjV1rLlATAB&v=APEucNWCNDnGTxU6tnd_iu0FPLv8kuOHUBs0HpcWjKqddBFBWLmntCE9P8cNOO29Xct3wYm_5ys-v3vMnlvQumFiRkAXqN6yBv4ikBwTe6oXRMzsYR6cIJzIGNZoWJ8HdH8PNxYcQ07pe1irE6floEuB7WgMW61NdhusXfRyNOwrlNiyHQwqKUeyas0ZUmdnbqiTf5oDsD44

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
AN-X-Request-Uuid: 8869d754-d6b6-4712-90a5-d4e4025fb6bb
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENS0b1sxYdNqbl2adRpnDmc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1DDB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

170 B
243 B

23ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:23 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 159fea51-838e-4b7c-b5a1-436b78f112c1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 44F7
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=ensonhaber.com&sn=ChromeSyncframe&so=0&topUrl=www.ensonhaber.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=jULwDHxsa2FOQlc2dC9IQmlIbVY2NUtlN0FsZ0hwOG4wSUUvQmZOd2VWSHNVMGFpQXBaYUdSbzYyTjhRVHg1T0hORk1wOW45ZXZQRTY4cWtlM2V6YnBucCtyVTVKMkNBY3VDM3lmcUJteUYrcnFoTWVncmdpdkhGL3FJa0...

444 B
656 B

79ms
15ms

Fetch
application/json

178.250.1.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=jULwDHxsa2FOQlc2dC9IQmlIbVY2NUtlN0FsZ0hwOG4wSUUvQmZOd2VWSHNVMGFpQXBaYUdSbzYyTjhRVHg1T0hORk1wOW45ZXZQRTY4cWtlM2V6YnBucCtyVTVKMkNBY3VDM3lmcUJteUYrcnFoTWVncmdpdkhGL3FJa0JuVmg1Vm81UGpXemFzSXNiRHNxbTJ0NHFwREwyM3dqQTRNUzJLekJLc0FLYlp1NnVhcStEanBpNS82Q0szRnNudHU4cjZlRm9MYnAyQjNzWWdSMUd1a0ZWbXdlQUQ3b2YxYkJHejQ3a1YrQkhuTDJKUWJTcmhCL21FRzdYUk9GWEFxN0xpQkgrblVKdnNSVFlvNDhiOXhuSTg2S0tGdTg3SmZubkJtUDhMUzZINHpjUndwbz18&cppv=2

Protocol

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8c3074afa0c578b83189e58c1adbf72ba45e77903f4fb8cdac3c1e5f4dc668d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1220321
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:22 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=jULwDHxsa2FOQlc2dC9IQmlIbVY2NUtlN0FsZ0hwOG4wSUUvQmZOd2VWSHNVMGFpQXBaYUdSbzYyTjhRVHg1T0hORk1wOW45ZXZQRTY4cWtlM2V6YnBucCtyVTVKMkNBY3VDM3lmcUJteUYrcnFoTWVncmdpdkhGL3FJa0JuVmg1Vm81UGpXemFzSXNiRHNxbTJ0NHFwREwyM3dqQTRNUzJLekJLc0FLYlp1NnVhcStEanBpNS82Q0szRnNudHU4cjZlRm9MYnAyQjNzWWdSMUd1a0ZWbXdlQUQ3b2YxYkJHejQ3a1YrQkhuTDJKUWJTcmhCL21FRzdYUk9GWEFxN0xpQkgrblVKdnNSVFlvNDhiOXhuSTg2S0tGdTg3SmZubkJtUDhMUzZINHpjUndwbz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 277000
content-length: 0
expires: 0

GET
H3 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0C71 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 636B 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=924308458592&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 636B 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=924308458592&version=m202301230201&ct=76&x=1&cor=9430209476401238000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 636B 87 KB
36 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BCq6FdSFqgPZEjRpMrcCGBbyZo6a2j-7Rvs_irXNqkN6krm-ZdNbiczmsMlLRGFJeso8yXgNs3oPWmDzlFZxbf8mJ2nQCb4Vu2-guPaUJGDuPa8tk95KzvNYySRHVCfv1PvVHkq2pwlrux3rZnAK5v31CLjuXBJ4VYS9h6aWnIgRBO-yQ&dbm_d=AKAmf-D_4GiaylejtzDd0IMhsn2X1vcdm8cr2oZZ114TejYKF9Xj0w-d7qLFC78o56jL7sOui6f-2M4f6R3ttGHrFix0ZV8YciPjCThvuqRxGKNmJuHKSpq5hHqkc1_3voX9cecP1q6oEXgygiV_98HHnuiKzsXQndKoY-vt81pMvQYib4-2AlV4PKXet9-P1dXohmCu6k9H44H49Qjo2NfxYCvs582Nagfq7yPwkEiHritTK0i4aRz25of540OHhPGCzJFXTVkXSZso1sxX97TjkjkBgI5Hest2rwY7jNh3FE5KDdPgBFbnTAPveU90DL2We8_1BuqiAfqhUoL997zeYoJpuNMuClwnlFsCvtf5JYPwKEauWCyILHQyuKLW4hbQvTqMkExLZr-URUfSnGQTt5kjEXoSzTA8yJIH3QEPZEvxNo7Hd0Av3g3kOjF0vkwrz746c7rmxC0_Ujtl0kFG1t4FCRVQC3H_vKxm4Mdx8Kj8H5rDErcDg9pNgSviDPtTqGhlD30K_wwlYOO7Q8BUzBLWr6M3acNOOMdHjGvn2eR821oXMYfPz5R0Hh2rsdgjJmfxbx9hhnsKgzQlyUoww-0p7bMZh57MzJ4tY9VhILnmJBK2wpbn4zIgAXtZLzVHTjaewkcHb9IUudjceesK25UK3rFDjuij_HpRUWm685NPgJs6eK_92yS84L2k0n5lkBMrRAwTnT1iS2L_CxPsVa-Mg_khvtPjlRw6p-qM0SbuWPAwgpxo4YU46Fds2EGTTyF4RA7hf-HG72hZtJeft-q2ogm-ZZt4UA-iAnQ-6_hkK0hEx7wB1bOSGCszCRpk5l5IqukXPKUuvKbXq0M19NKGqxb65M8tjaWuIF2KH7INbEkOkRATcmxHm58-rvNT3DKvPtsdKBFAgMNVbnikrw8xFAoKh5e2Comqsdc4D0k0ZP41Ul9jQ4lCWQG8e2O3z7N9gatNYJjqGhMcRcMIG9KooxVVR6dhtwFTNbFtBuhUGC0BSVkYBlaLW9Upyq7GQ3dWuDfaH9HWeo8URnFYKwoP5KQVg3EohMbysh5nLdf0n1nIw1snIvUO-OF4tHkrKZvENyTq861aKEO9bxHbPrKDeyfCeReTSf63nElQyKg48udrsCRI13A03dTVINAdjmYTDXYaspggnS3sVhpfVqI2UbrAm-nWsMn2B6K469Xk4zZydsFfaKfKgnFnyFo0qt4DbZ4pFrN9sCbQl1EOAYwGGo28l0iGbRmcUAKvaaXsjPKpPMEgP91z1tB0eBdfc_T65PTElRXA8LYqHZHZhKD3PtSTviav0e0e-MlumEwsgc4x-4lS9TZVqV26_uMe91IQAk_vsFuGTkBK1rh9Xi0Iop1mE9heXo9uX24GY-XZjRK_PbzP15PMvebXYf0eHBUCoWLkE_0oYU-IEnaoNiTkTBmFfy2o38q_PCXp1-vXHp0Kb_pB7M_Daw2T40t0r_VXkSwfohyLW-P417zgz56SRAEebunYr8eUrLhJw1lv9s4uRZ9MUdbWtGcxX49Ry5JwnUTewG_X6k0_5TnV4A9hqX2b-rCdCQsc6AqH2RbR5j1hEWMGo5jFOjKFcLZJF59Du8tXFIr5c9tvgfbjqEWBi9ppRFbSK2kZQOuP3IqanCsE8TsiIyvS9yXkDxV0z5vTl2pstCGWJC_02BoL0ix8PvS5YOzWioImxGLIgFMHURpNO4E8qb5OZtPRiUIf8qymmeeRs-KtT_XePC07sK62pIFsqcKEN0UT_ypZ74FUpjl0GDZyC0FOs-DO3Y4Ul82ZMXIFmrQc1YqYYRvp0vwKNwVrU0t1oq1QrqWG2wzbIQyJMSlFYrK_2RaX1zxeORKSZdWXUpk4x6NgD4naCnb9yJ4gg2rbn4cepqpC5EqFt-SIDIj1kgSweeId3CVhhkmip3NNtmlKquD4eF5AvSvM7kybFB883okl26C4SlmNIw8Vv6fw51bl_OCZQ652d0DJiQAoFm3QjPkloVOJoqJxycSneLgo8YfFauUTzjhKmWm45_2n0HQ7FwZHTSVKaSh2Bc8WDJjdjMP79E7HrwuPFUFRzLRJK63N4YqLcxxwLyFOb5n4QQf_FuRr0haykfYssKF4xjunVs1fXaTgEtAAyHPEaUYujOusZ_Pnbnc0-XTCKpprFTgwDO4fxTlBjn9O5umMpM3QzKHxqMgmEH0iXkTsx-kh-3Avx9ITM4nzGhmap8_fXtcWWMWk7jvUVvUpDcuDQH-ZS1rm19W13tAAICdRAeZrY5h_jNf5ppT8vD596q-NakxskZUoFRB6x1ocqAISKWIThumPOeU5FgHcBx9eZuIOuv7Q1JF6jV0OKGej2cKDoy0pblk_SePnsudhABq9o4ew5LlT0O9ZV5WdOGZk6aH8kenXNzZ69bt1tNfBj71pv0csUZGxNpmbMtDjwaTlkyD6LIMVvLhYAHWZKCBAjwGWmw5SJ80-rZ3uRL0LAhR3QU0yAwPkC6lfuvRSPdR5BOpZ76IHv80NxfcoviDIgWi_OW7S6wKtzIr-N-8Rx0SAR5aUZgVsYB4rF_HZmAnEeIauzJlL71ozymkzzvVUgkYnVO2PeZIJz9KdTKhQMQk_RC8NQTC2ZJYOkuAGSMaY4xDc0qMXo4SJfxwl_EieMrEHlKj9OYUXLnAvRmU5KukeTGqQg8BsdR9ycn5fkY14JvoqKKt0ME3OaUkk5l_67f0O1vYfKumDRcq5OF6SrxjO5kr-LwlcnbI64pKiff4lRQybrAkHtS_pNyHn_dWMILwy4YZZ-CMN0izey-c_BeY7ruzKZHAmGGJm_3sLr_mxWNX3DQDTGBoSW_Tpv8j1_vNZg3vIXZKFHTw_AQdGbjbveFnEwjkfTRXTJ_Pb3xLGEa_9tGkQ6ijvebPNxmYJGZAX6BTYE7A-c0KBxZ7fJxxkZFYwHP1HaoyVJABlAVWhIPh7ua7axJR3tq33a3sJlMg6LkPe1tmJRWRe9zaKwQsOI0ZEnwyINySI2x71-lzIZ-IvIF_QKUPTSJsOAnhuEOunTp8qJmClatp5PeXd1oAFFcJz4XUyCrEI-fuEzxsJFA55AUaWReNEbzcsSiKc9OK6Q8oXiucPLeV8VJNSU7dzn_ACC40Icxeb3f_ZEk2VP4XOeVCMw_jnbGIygSn8m_6aGM5imLaj1QwVefhqonELlpq7DJEpEhdDUAvVafzY_FrRTHAnxvMWiz2rFxUfWvH53Q05OMsKUzWsiMksDyk229jacP07qbRMHZq7aMfh2_Uewk0fpI9XLZlp_1Rzv4QuyFuQSE7I0hWuOQ2ej7MBkk5rP42rYcvfun1F6u4kHwas0eXNB6N00EjwtCW1T_c3gbKrjHLBPUPCF3spwstWJLDjhq6ToWSQeFw97zhwtMiEQSlfccjZtoK_nDb9BgQBqmWmXwjvRVEcIKrbSwU&cid=CAQSOwBygQiDa-Zx3iFgs0NZfINHgpn6kAfUo3EXt1RQf3GEFupxGKIgEIMHCAlAtRnzh1eQluY95kvY-3jnGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9430209476401238000&adk=250412560&idt=135&cac=0&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a212de6d8a0fc6a0d81aa275a848fe5de91a15be922fce6e31cd1a8d9fb526e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37038
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3DA2 624 B
242 B 49ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJOlvQEQv4LBARik05rsATAB&v=APEucNXqbuZ-9OmQ_RRxkcptNe1dc0KIA_-zi717hOHzpNIRDbqLiCXyd2GJ-aeWssfNGDhcTQg4REqKJEFbbtB8bdpmvpodwii8V3smRxb-mDiQqOMdR6auQk1dgOxlkW9fdxGdOrOfM8l1q_B-jAnfyyBXyIGd8trVo0gFizmh7x5_nYvqvcp57vghMaqFKZhfc6zboDua

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0C71 78 KB
27 KB 80ms
79ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C71 42 B
63 B 42ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CsTZKvfRh9No0pHm4Gq-yrnRd9F35mWtFefj587h0rS0orrtO9KYYL-tCBWxKEEFayVZCzX_qpZsP-1Fy9oMwaGosKAMwgwHTmY2EmGOz1aw_lCNI

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C71 0
20 B 43ms
41ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=8110768988406990385&x=1&ct=76

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1316115/71738579/xbbe/creative/ Frame 0C71 252 KB
77 KB 145ms
58ms Script
application/javascript 52.215.105.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1316115/71738579/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=&ias_dspID=3&ias_campId=1010526756&ias_pubId=pub-8601585505701947&ias_chanId=1&ias_placementId=20251344649&bidurl=https://www.ensonhaber.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iEqMJypu02CUY8QhI5ejFC
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.105.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-105-179.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 0205397c26f5c55a4911a68063bff397eebf95c71188a2c8777d230b570c561b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0C71 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 18:48:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0C71 19 KB
8 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0C71 0
0 16ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTZBEAx9j5p6BYNpB4M4FVF54aYJ_tNfQYfXb8f-eUpVBJIp7MCYUwMdeaYuYlIqY6wOFpyiaC31Kl_cyY-a7uJ2tRubw
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0C71 178 KB
56 KB 53ms
51ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57058
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687274360908795"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3DA2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJOlvQEQv4LBARik05rsATAB&v=APEucNXqbuZ-9OmQ_RRxkcptNe1dc0KIA_-zi717hOHzpNIRDbqLiCXyd2GJ-aeWssfNGDhcTQg4REqKJEFbbtB8bdpmvpodwii8V3smRxb-mDiQqOMdR6auQk1dgOxlkW9fdxGdOrOfM8l1q_B-jAnfyyBXyIGd8trVo0gFizmh7x5_nYvqvcp57vghMaqFKZhfc6zboDua
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGP7u2VDqTtPnyITQadzLJw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3DA2
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJOlvQEQv4LBARik05rsATAB&v=APEucNXqbuZ-9OmQ_RRxkcptNe1dc0KIA_-zi717hOHzpNIRDbqLiCXyd2GJ-aeWssfNGDhcTQg4REqKJEFbbtB8bdpmvpodwii8V3smRxb-mDiQqOMdR6auQk1dgOxlkW9fdxGdOrOfM8l1q_B-jAnfyyBXyIGd8trVo0gFizmh7x5_nYvqvcp57vghMaqFKZhfc6zboDua
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3DA2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGUHq8CJr4Doxz0o5_x2xX0&google_cver=1

43 B
1 KB

15ms
15ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGUHq8CJr4Doxz0o5_x2xX0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJOlvQEQv4LBARik05rsATAB&v=APEucNXqbuZ-9OmQ_RRxkcptNe1dc0KIA_-zi717hOHzpNIRDbqLiCXyd2GJ-aeWssfNGDhcTQg4REqKJEFbbtB8bdpmvpodwii8V3smRxb-mDiQqOMdR6auQk1dgOxlkW9fdxGdOrOfM8l1q_B-jAnfyyBXyIGd8trVo0gFizmh7x5_nYvqvcp57vghMaqFKZhfc6zboDua

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
AN-X-Request-Uuid: 24144d72-594e-4a08-b624-a661904782af
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGUHq8CJr4Doxz0o5_x2xX0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3DA2
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:23 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3ebf6f71-e8f6-4612-bc86-898fcb633848
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 636B 172 KB
61 KB 63ms
7ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Origin: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20448
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 636B 11 KB
4 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BCq6FdSFqgPZEjRpMrcCGBbyZo6a2j-7Rvs_irXNqkN6krm-ZdNbiczmsMlLRGFJeso8yXgNs3oPWmDzlFZxbf8mJ2nQCb4Vu2-guPaUJGDuPa8tk95KzvNYySRHVCfv1PvVHkq2pwlrux3rZnAK5v31CLjuXBJ4VYS9h6aWnIgRBO-yQ&dbm_d=AKAmf-D_4GiaylejtzDd0IMhsn2X1vcdm8cr2oZZ114TejYKF9Xj0w-d7qLFC78o56jL7sOui6f-2M4f6R3ttGHrFix0ZV8YciPjCThvuqRxGKNmJuHKSpq5hHqkc1_3voX9cecP1q6oEXgygiV_98HHnuiKzsXQndKoY-vt81pMvQYib4-2AlV4PKXet9-P1dXohmCu6k9H44H49Qjo2NfxYCvs582Nagfq7yPwkEiHritTK0i4aRz25of540OHhPGCzJFXTVkXSZso1sxX97TjkjkBgI5Hest2rwY7jNh3FE5KDdPgBFbnTAPveU90DL2We8_1BuqiAfqhUoL997zeYoJpuNMuClwnlFsCvtf5JYPwKEauWCyILHQyuKLW4hbQvTqMkExLZr-URUfSnGQTt5kjEXoSzTA8yJIH3QEPZEvxNo7Hd0Av3g3kOjF0vkwrz746c7rmxC0_Ujtl0kFG1t4FCRVQC3H_vKxm4Mdx8Kj8H5rDErcDg9pNgSviDPtTqGhlD30K_wwlYOO7Q8BUzBLWr6M3acNOOMdHjGvn2eR821oXMYfPz5R0Hh2rsdgjJmfxbx9hhnsKgzQlyUoww-0p7bMZh57MzJ4tY9VhILnmJBK2wpbn4zIgAXtZLzVHTjaewkcHb9IUudjceesK25UK3rFDjuij_HpRUWm685NPgJs6eK_92yS84L2k0n5lkBMrRAwTnT1iS2L_CxPsVa-Mg_khvtPjlRw6p-qM0SbuWPAwgpxo4YU46Fds2EGTTyF4RA7hf-HG72hZtJeft-q2ogm-ZZt4UA-iAnQ-6_hkK0hEx7wB1bOSGCszCRpk5l5IqukXPKUuvKbXq0M19NKGqxb65M8tjaWuIF2KH7INbEkOkRATcmxHm58-rvNT3DKvPtsdKBFAgMNVbnikrw8xFAoKh5e2Comqsdc4D0k0ZP41Ul9jQ4lCWQG8e2O3z7N9gatNYJjqGhMcRcMIG9KooxVVR6dhtwFTNbFtBuhUGC0BSVkYBlaLW9Upyq7GQ3dWuDfaH9HWeo8URnFYKwoP5KQVg3EohMbysh5nLdf0n1nIw1snIvUO-OF4tHkrKZvENyTq861aKEO9bxHbPrKDeyfCeReTSf63nElQyKg48udrsCRI13A03dTVINAdjmYTDXYaspggnS3sVhpfVqI2UbrAm-nWsMn2B6K469Xk4zZydsFfaKfKgnFnyFo0qt4DbZ4pFrN9sCbQl1EOAYwGGo28l0iGbRmcUAKvaaXsjPKpPMEgP91z1tB0eBdfc_T65PTElRXA8LYqHZHZhKD3PtSTviav0e0e-MlumEwsgc4x-4lS9TZVqV26_uMe91IQAk_vsFuGTkBK1rh9Xi0Iop1mE9heXo9uX24GY-XZjRK_PbzP15PMvebXYf0eHBUCoWLkE_0oYU-IEnaoNiTkTBmFfy2o38q_PCXp1-vXHp0Kb_pB7M_Daw2T40t0r_VXkSwfohyLW-P417zgz56SRAEebunYr8eUrLhJw1lv9s4uRZ9MUdbWtGcxX49Ry5JwnUTewG_X6k0_5TnV4A9hqX2b-rCdCQsc6AqH2RbR5j1hEWMGo5jFOjKFcLZJF59Du8tXFIr5c9tvgfbjqEWBi9ppRFbSK2kZQOuP3IqanCsE8TsiIyvS9yXkDxV0z5vTl2pstCGWJC_02BoL0ix8PvS5YOzWioImxGLIgFMHURpNO4E8qb5OZtPRiUIf8qymmeeRs-KtT_XePC07sK62pIFsqcKEN0UT_ypZ74FUpjl0GDZyC0FOs-DO3Y4Ul82ZMXIFmrQc1YqYYRvp0vwKNwVrU0t1oq1QrqWG2wzbIQyJMSlFYrK_2RaX1zxeORKSZdWXUpk4x6NgD4naCnb9yJ4gg2rbn4cepqpC5EqFt-SIDIj1kgSweeId3CVhhkmip3NNtmlKquD4eF5AvSvM7kybFB883okl26C4SlmNIw8Vv6fw51bl_OCZQ652d0DJiQAoFm3QjPkloVOJoqJxycSneLgo8YfFauUTzjhKmWm45_2n0HQ7FwZHTSVKaSh2Bc8WDJjdjMP79E7HrwuPFUFRzLRJK63N4YqLcxxwLyFOb5n4QQf_FuRr0haykfYssKF4xjunVs1fXaTgEtAAyHPEaUYujOusZ_Pnbnc0-XTCKpprFTgwDO4fxTlBjn9O5umMpM3QzKHxqMgmEH0iXkTsx-kh-3Avx9ITM4nzGhmap8_fXtcWWMWk7jvUVvUpDcuDQH-ZS1rm19W13tAAICdRAeZrY5h_jNf5ppT8vD596q-NakxskZUoFRB6x1ocqAISKWIThumPOeU5FgHcBx9eZuIOuv7Q1JF6jV0OKGej2cKDoy0pblk_SePnsudhABq9o4ew5LlT0O9ZV5WdOGZk6aH8kenXNzZ69bt1tNfBj71pv0csUZGxNpmbMtDjwaTlkyD6LIMVvLhYAHWZKCBAjwGWmw5SJ80-rZ3uRL0LAhR3QU0yAwPkC6lfuvRSPdR5BOpZ76IHv80NxfcoviDIgWi_OW7S6wKtzIr-N-8Rx0SAR5aUZgVsYB4rF_HZmAnEeIauzJlL71ozymkzzvVUgkYnVO2PeZIJz9KdTKhQMQk_RC8NQTC2ZJYOkuAGSMaY4xDc0qMXo4SJfxwl_EieMrEHlKj9OYUXLnAvRmU5KukeTGqQg8BsdR9ycn5fkY14JvoqKKt0ME3OaUkk5l_67f0O1vYfKumDRcq5OF6SrxjO5kr-LwlcnbI64pKiff4lRQybrAkHtS_pNyHn_dWMILwy4YZZ-CMN0izey-c_BeY7ruzKZHAmGGJm_3sLr_mxWNX3DQDTGBoSW_Tpv8j1_vNZg3vIXZKFHTw_AQdGbjbveFnEwjkfTRXTJ_Pb3xLGEa_9tGkQ6ijvebPNxmYJGZAX6BTYE7A-c0KBxZ7fJxxkZFYwHP1HaoyVJABlAVWhIPh7ua7axJR3tq33a3sJlMg6LkPe1tmJRWRe9zaKwQsOI0ZEnwyINySI2x71-lzIZ-IvIF_QKUPTSJsOAnhuEOunTp8qJmClatp5PeXd1oAFFcJz4XUyCrEI-fuEzxsJFA55AUaWReNEbzcsSiKc9OK6Q8oXiucPLeV8VJNSU7dzn_ACC40Icxeb3f_ZEk2VP4XOeVCMw_jnbGIygSn8m_6aGM5imLaj1QwVefhqonELlpq7DJEpEhdDUAvVafzY_FrRTHAnxvMWiz2rFxUfWvH53Q05OMsKUzWsiMksDyk229jacP07qbRMHZq7aMfh2_Uewk0fpI9XLZlp_1Rzv4QuyFuQSE7I0hWuOQ2ej7MBkk5rP42rYcvfun1F6u4kHwas0eXNB6N00EjwtCW1T_c3gbKrjHLBPUPCF3spwstWJLDjhq6ToWSQeFw97zhwtMiEQSlfccjZtoK_nDb9BgQBqmWmXwjvRVEcIKrbSwU&cid=CAQSOwBygQiDa-Zx3iFgs0NZfINHgpn6kAfUo3EXt1RQf3GEFupxGKIgEIMHCAlAtRnzh1eQluY95kvY-3jnGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9430209476401238000&adk=250412560&idt=135&cac=0&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 829
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:34 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 636B 30 KB
11 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:21:16 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 636B 41 KB
15 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106848
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 13:52:35 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8CE3 1 KB
646 B 7ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22453
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 13:19:10 GMT
etag: 48472445140208031
expires: Thu, 22 Jun 2023 13:19:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 636B 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3f737780ba32e7fc297573bb8e339c7c20126e074761dcb0ea5106c4b0cf008

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FBB0 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C71 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=550741679676&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C71 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=550741679676&version=m202301230201&ct=76&x=1&cor=8110768988406991000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0C71 15 KB
11 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DfxOoF89-oMQHRjrjsNKY8gfEbni0TpOCHhoo6Z0lzO9LYDvHHq2hJyPcWyUENoo8ziUcnF04ZWGQmdopms2OpX5lAO-M66baNemmR1iGwiqUVl_IySa5iExkOjUocxUJcY_V8B9Y27ZliFJmU2nke7b_Hl78pJnC4bMu1xCPRS4tUgCY&cry=1&dbm_d=AKAmf-Citg84EnGRXUf2QcSAHZb7VJt1lrauqcWVeLIzpsbuqaO3j7YwqvSB6T4iwoHT00Fb074RJD6GziUcJMJJAgBG6HRyVUo7SHuIONB6IpGr7wDWeWVqbi4Mqw1GzbEvXkafDwibvRUZBikYwuYBDcRKbDx6_17Ua-gsaRXKsbZu5v36q4Xq1OUzXm4t_0KB5dU4yd584PFbHhxgEZ9lynIYrfQS2h0ag_XhaPgBbR3zeYDwa4QXeYK9Fol6NU6ptpcrNhBB-sTKW9w8ykef4NVFTdXVtrzewoBm6YFsNDK4b8Sg_CKuOlxoKzNuwzKZg0uQ1hiOC6tIbm-V308qHpaMEx_NGBnacZOW7bgUxYdbEgOafiv--pzU0upZiHZyCXexOZNYd48QiAvPqsTNXof1LRvx34BfoP2bBIrdDc8a-ryB2cIi1PwZ8c0OdIbo6jWrm7BamuoOE-KykyOHCYSLBgL9NeeSHrbHzn3SgmhAa6V4b-csbht44jzIhj53A65FviKaGhxZPMx6ov0Hzna8uGSO4Us16qvGOS79y1K8KpOyaCfM0CB3Lk3CsR4QFWLzhw-wjE3WxvTT4WV-lUkkyPVQHW5V1rHhTfaEOD6IImeP8ZmMYgMn9Ux55QEcPri-ipee9960M5Dw1qheWqwEq9bminqMrPQuakuZRh1qQx_xneGEDTOhTibYrQRvTCf0eWFwFJWYWo2ecDUG-Yih81TI7xMid3FRreV2WJnyQK5FUt5Dmf8W5FOVe8HtHgadZbCpSJxtN__EbhPqrDYCucU3M4OOx7DohOUVMnAKOFSWrjbBFUvxfMcKD3EX1TJMoUhTh7mHSXLhIpd3TKiCJUXR7oXkoNneTTB2A7aomQCIDXwrGl5fy6A3zu_eiJulW1FSs2THgvVyrM0Y43s_r0FjoRhQJ1jfC8ZPQw9Zfvk7osayswnnZBR4X_IHwv3bmwmI-qHqh3Wl-HxDwxQrLSLxowxai7heRVI6MygElVlPNc0kvpttaQojTo78QsCq-UwG7p2XX7bthRX10-32SedGu-dMpgJJFIWqrIs4DFFGSOjy-gHiGwt96XM2r3RNqsLXir0qbl4lBNKDNCKpcT1n_xd1ZsHUGlEy_9WOxJGZbqsdFKvm1xQr1pTFuWKYFxEjuC8VWKt2_l1tfr0LYVq2BEsCZ4xeLKP4yffP9rfE9T2fSHBzGtmvT_gQeF3ok9Z7pgY26TZ87gKjm0fzeQqofoMawMMqZLUnT60jZW3HiY_5GquWXL0WDuyrEN1hCE1hLzyuuwhjn4wRsmeOLOp9T7AsZW0dX5CpDOL0ekcW_jstIYyesfGE_AzMgaZNRLzxfQM4fCRMDiyH_tTU_CBhUVYoJMANAbj465WmA7qDWXOl3N0-o756OKZZ48y5Uu_HVWATG5n131WH4REZPS1Tr23IwGgu40XLOoDu6GG_EbU4_9YdCTUxAW-fMUijnYXJJ_vkhLfZjcOq-3Wqkjn5iYHp4kYo1_k1Q0Ax9sGN8a_V2W0mFIb7NVxIKfk4eASiUamZczRuyCmgUF1dpEdoCMffc7bLXXxjl22e1RDcalS_d7Nn9imslosd1AY-HcdHp2kIhNwCCAbbvYyeABNJUX2kHdoYQ8T3aDZC1R0s_IabN7MC67Myax3lhFhtzWdNgknK_qJdFpdVjoCSxv0zGTcCCgoDqgw-AFpGCgAznkB1gqXlKoIkAney9xY0DWeLyfjjJskWiw2nWjWYyvpQkuJGJ5YYBxd4pcIMcLjmDzTaircFoc4HxPAsifJDx3ohaUd8oxP1r3xVik9h_sOHoTBbmPTSOIdZnC3W_I8kB0oj1MXEJD_ziD5Un_FMm9NK3IQ_ffBH6jx2z5fr-3dgoBusUihBh5OLWm1CapUYvzKJ1z7DmH0xv2U8hJnE7r007nxKKxX66cyt3hmnYbGAkdct2Ft1r2YEuS-q7TzGaEklyRD6XUfciUyu-3pBgDWBD8H9vx0tpsJ20sHVMlyuRJpX3Vms6YYLt3DreGsqXjmH22hsMPM1VDnqo6SNQZaMQA_C96tGfWlTI_6_BtQUQUR6U2hrhf3uc5lZJ70FvCNrwITWMmbXW0aSeYToD9kp9tfQNVYnMbtQtw4QoFkuivywiIDK0cwpeJwRMMFXuRXOUkstT5KbmvpR2MaKrJPpjcg42pTGZPYpjew5dT_TzsuEOXkzUh6vRUM1Lfh2bz97uLEThnfM7ZY439OZsCY8XRuV9IAo67VqopU7sQUWFBFPpa_yQgtakamorFoGXUL9MO23dO0V5lC2PJQ6dKCwqa9AeMf4VK_wEkm5idXrbDq7lPi8SCPb5vwqclmqR67ffst4PqrqJ6axlgETp-ZzKX3L8aYCV39LfFIZoXettnaSMXFYDf3YnTEVK4zjl-HO83h59PqAyMkeSlpp6M9LFPn8PsXscx0OFSLm3kHcfUvDILncWR0b2ou0gZQNRjGWR3C_5Yg398yzfx3As7EXH2QVBshPFN4rbBB57ruXuwBEKOSKEkH6pKsqagvsSVKK3QGV_64nEXRf4zGdSVc_b3CbVbatELzhOxqKRev3TD16boEmqzN9MZNT54qOtS46u26gF4RlRGOVLexuxD-Rts35hemd2GLTdL1k6o0ZwnESSZLeNxDD6IgSiyOgtXxnGTCjoRFrpBupRDj-6cDFha3Si2NqEQ6ldV4a0nbL10iULx59HqsYZMRihtzLduOnPRoROwXqhA0RVd-q4ECp2SNb5mNIXna59v6p48s-mM3ToVNdpnKbRDF0ySouK2Xtgc1Kd3VRuFU16FI2n16yLOyNQqfNNw_ICx558jWxwZoJu9sOj2UBMVIe7dO3CKlOJdeijeWMj6NAthEUYPJXub9Jj0TjUEAx2NHTkNqC9BEwBbMB2KfP2DLupwg9f3_barJHT2-cv8jonISX93QefDGq_1Y-SyI7z48xdURHVpb-qN1KgRlvvxq9abmzZoZhuzNYy_Un_lAflLY2-oFlTdTccSCA5VSzG_ki_Vgdu9WX4SAqWbxyhUazjCvrN2gUl9Bi2IvQ_e52Q5Qy6y9s&cid=CAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=8110768988406991000&adk=2228999115&idt=111&cac=0&dtd=15

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39d4c4f0dfc10291d2697f8eb1274b6071ca11531b2a7f6bb109b9bbe91e32fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11391
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C476 624 B
242 B 51ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYlfTiwAEwAQ&v=APEucNUemwfHTdpQrBhATouKpOh925hoM6WSgt2OoA7BKHbShtxAp3XzSWGdiXv1_9kj1bUnGC0VDmYaJuGhIEnWoGpfSa5CuoHNYPJTdYAUEcAqwzYt5LYn8QmtKZBwiCUWBmYXkSz8Ry08GjpV6JBbVQ2ZduQ56lspKaxQP2qIRup1Mp3fW-3goqmZSgGtxws6hz4lM6Mw

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame FBB0 78 KB
27 KB 176ms
175ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBB0 42 B
63 B 44ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AQtj3QDQwr9s1DE9Pg4V6anHqzTtuomp7DOPrEGaf4OvI7dTnEB6bckS-KfLKT0hln8uXuRb4pSS5P3SrdxHeaGkf0cUfOVVAyoK_IBXzThyHSfok

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBB0 0
20 B 44ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9072290020843976270&x=1&ct=76

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame FBB0 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 18:48:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame FBB0 19 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FBB0 0
0 16ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQI_vXP2lEDihrSxxSLU79iUN9v0Zbfc-WCs-rWJnWFI2YaiJnWS4w1m2WoyQhNAkMaCyD9Bjhqu_S8VyVNIlz6fRcseQ
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FBB0 178 KB
56 KB 81ms
79ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57058
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687274360908795"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 8CE3 0
104 B 152ms
23ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJMbyyriHKdD7XPN6UpWkUY&google_cver=1&google_push=ATf1kGNPsQUicjOGwrE77QT6o_fP-eL7vxbZbQvbWh6XED159TYkfy2LM4sRlm5Y95qVLnBNyT0DHJOGz_ySI0LDdBuXoFrsEcUK
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHGquPafL7cB3HS08at6d_o&google_push=ATf1kGPg2Vx46TyKYnZy73YKOhfubINoOhDvrme8LVDbMyWV7dre12UmDR...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHGquPafL7cB3HS08at6d_o&google_push=ATf1kGPg2Vx46TyKYnZy73YKOhfubINoOhDvrme8LVDbMyWV7dre12UmDR6-ktGGo5eB0AXZVj5D1WF3YpGIj1v3TRvRA0YEX3OM

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230082-FRA
pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1687376004.602020,VS0,VE99
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHGquPafL7cB3HS08at6d_o&google_push=ATf1kGPg2Vx46TyKYnZy73YKOhfubINoOhDvrme8LVDbMyWV7dre12UmDR6-ktGGo5eB0AXZVj5D1WF3YpGIj1v3TRvRA0YEX3OM
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 8CE3 70 B
265 B 115ms
33ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBK9ujCWYN9olG9nI7uyq_8&google_cver=1&google_push=ATf1kGOt_8spUPjTDnprxTkAQGXQb4bTfh2PkXifmKCEuxpLZIFOOVB1P8m6QNveufv6TYAe5ifIq5usxEjAirI5Wo-WaqwWSzKb8Q
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CE3
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOQphE0sU8f0-fWCXTIug5mh9gGoclqOhYYnurg6Kfq1lR7PfzImyd0AOfo815WpV8mRn4LlLjfu_I8SARQe0mPdrNC_WlLtg

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOQphE0sU8f0-fWCXTIug5mh9gGoclqOhYYnurg6Kfq1lR7PfzImyd0AOfo815WpV8mRn4LlLjfu_I8SARQe0mPdrNC_WlLtg
date: Wed, 21 Jun 2023 19:33:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8CE3
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEErXsB7LAp3fp1JWRuJ6N_Q&google_cver=1&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0sp...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEErXsB7LAp3fp1JWRuJ6N_Q&google_cver=1&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmO...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzm...

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0speF-ueliw

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGPwVuaG5Enm1HPLB-ajb7hgYNk8N4lhxIlhg-gdWv-DCZBeRTImJV7I8w6K7pyCS1dMZNOUpllHyH43yzmObMu0speF-ueliw
access-control-allow-origin: *
date: Wed, 21 Jun 2023 19:33:23 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 8CE3 0
45 B 199ms
26ms Image
text/plain 185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEKuICFFLLp5XrCN8h5ps550&google_cver=1&google_push=ATf1kGNpyG0FbSOcXnRQHKlku55Zm72hxgS-FnIUtEWlcF8CnseyoZ-Ae3vy5ZquinFWdRyRAn1-Yg6qL0RMFCx_wp0vvDVkijUi4A
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-length: 0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame 8CE3 0
363 B 58ms
8ms Image
text/plain 3.76.139.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEDf5-nZNeKsN66yUf4rEF60&google_cver=1&google_push=ATf1kGMT1dWNZXYXnrHUsXZdPW5HH4av9y5EziB1k1sWiM68LZfb5LWb1O_E_y-Lf5aKqRuvrWtZIjK-OcH6BGB30FeB3ta7jYw4jHw
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.76.139.6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-76-139-6.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8CE3 0
12 B 20ms
17ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ITvguzFC5FJJsh0OSm6VA9okdET_eHDrI3eiml9yhnKEyrd3y8bseFQOzmSCEbe2bKhX_qQQ

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9170381621892120779/ Frame 6273 13 KB
3 KB 33ms
17ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

691257cf7d510da3434f5eedca2b2e0137949c698e3750c7705526a1ee75684c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2744
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:23 GMT
expires: Thu, 20 Jun 2024 19:33:23 GMT
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 636B 0
0 112ms
57ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvSje54BhhiD6aRUiag_r6uvMGZtEq9oB7lPbkoIAWj1RwrVzAMBq7BCITQIBMIXknNzBEsEbkV5uHt2AxoGlSIBwke0nmt2ArCHG4RzRdKPA5IRlq3kkB9PmCb1XrnHEo0eYKoVNWHRB19d8qpx6UtGJ9ftHt-MeSo62jDZDgNBxOUTennxl5LyCcSLLvbp3vLuk4IjQRqWwiutzrHCuztMidAv9OcDtAysnS77BWIB4_Yu5mLJmQ_7ROzuHxaw58eUD-1_zRAsn_Xvn68NvcJlhbJ6ZerNgTpslWl2EjZP1K6sPrEWeIQ57uVNVMmfzU1r7p-gyBuNPzH-SkEAV8QeOT-W-xCoQ8R1Fb0GJ-ed9qJ9t9c-Ivkrb5hRCGkCtradKBBMyGhZEFbUuGLNdAIRP2Fv-UmjZyFQooPbFrxzO4uZel19-pa3T0zxM1-82-5Y-BUauy9AsQXVKoLo4dsSMZiFo4DzJKtGuZMts-nisPdeR24Nezqf8j3d3aJmnoZYLBi1pyLPHbkEkoJTAscjVNRISN89u1-g1NUOahcCPlpO7d3deVs7aa6fAT5gj0ybmAShyG0Ya6A2lwVRhErePKBO2vbKYHo9LyYNIh569FAQRIk-uIgdS5547sl-VFyIK2k9DurWmX0tp4EhVzjzhPRoW5wahwtzz1ZR8-86txMT2X0br61r0jSq0b1TqSQUDzinhFV992h1HFJmBSzN7Ci3uXaRdjUmVJ_5CO4_xAH1lCOUeXFMUd-fp6simfscUvfjPMrNwRqmNV3tAjCpY43JTGqWxuticUyA5_PoRPKGB2TJNrnU498jaHJ4W09x6xhdHnaRDvm0H2ltikyABIeebDROs7DJoTI_G63zm3b32VIEbNeSwcZYzuO0luCFb3WEAMBz2jGryLdFTz4tD-VNVRVbVCG8pbeHQ7IxtwhitxbtD2xK2bnqWNyh3W5CwH3AtDhvmW0g78qs4FLbrDJx8kP8K95kE_1VPMKXKpsv_SIAf43DmAgLOOrnoVGC0vlJrN97J0YFEGHd4czrFd69vfkHcKcTaeiG1dv-4vgdNfkMnlEJRRx7kq3u1TMQ94aGcbRLcx6olprq9y0Ze_Y6tv7YmfvNUbtV5Hu0KIO-Ng16RHrkl1bDhwCCL1gfohiStH1uOIzfKHwff_SGtMkT9qDmF0vsr9Zrep12SPYCgDIzdTFkYIE1DAnMGmdiHLSeVxXJL4Q4LzqlqbR0m3qaXFkCq6hzW08VvXvxiPbAgrBA8e9WUrQujoaQUZ_4zVB16SkV2fadGVT6zv64kYB7h_rgS2NtKrxhBQRRDjsdv-6YxGof6Rgs2Get-dU3pweD-JgEb4ZygZEyeDd4Q&sai=AMfl-YQR9zCoTL9ZuX-QIFTWtfArrFKzQCQShwfa6W2orNV24OkY0yajvBdcmbu0TXvfB9z9ffIftC7OzbtQX2jrMaCDcT2cqiXDWP-04L9oWa24TbLLoGyFnQJGg3jZTZJC_4MAniu7e93WKF5Wxym4ORXdfqnePGxvj3Fkhf4xaDyPXRR-e3t2YOR15RagzqUfGore366IxJVAN68tK-DCBhBGDmfie0ljyKVynzehGcUbrMbYyYp7B2aGaAoF7PgbVPVeKFN7It9jOgMHqlwnKqz4BygqOA&sig=Cg0ArKJSzN33_tTzUp7aEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=217&cbvp=1&cstd=203&cisv=r20230620.48978&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4A09 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 106816
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Jun 2023 13:53:07 GMT
expires: Wed, 19 Jun 2024 13:53:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C476
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYlfTiwAEwAQ&v=APEucNUemwfHTdpQrBhATouKpOh925hoM6WSgt2OoA7BKHbShtxAp3XzSWGdiXv1_9kj1bUnGC0VDmYaJuGhIEnWoGpfSa5CuoHNYPJTdYAUEcAqwzYt5LYn8QmtKZBwiCUWBmYXkSz8Ry08GjpV6JBbVQ2ZduQ56lspKaxQP2qIRup1Mp3fW-3goqmZSgGtxws6hz4lM6Mw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=492
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDR9C-5kVyHrQ9TQwJ1Ng38&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C476
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYlfTiwAEwAQ&v=APEucNUemwfHTdpQrBhATouKpOh925hoM6WSgt2OoA7BKHbShtxAp3XzSWGdiXv1_9kj1bUnGC0VDmYaJuGhIEnWoGpfSa5CuoHNYPJTdYAUEcAqwzYt5LYn8QmtKZBwiCUWBmYXkSz8Ry08GjpV6JBbVQ2ZduQ56lspKaxQP2qIRup1Mp3fW-3goqmZSgGtxws6hz4lM6Mw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=491
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C476
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENYvBnjOn88NRCSpSqOETcw&google_cver=1

43 B
1 KB

26ms
26ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENYvBnjOn88NRCSpSqOETcw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYlfTiwAEwAQ&v=APEucNUemwfHTdpQrBhATouKpOh925hoM6WSgt2OoA7BKHbShtxAp3XzSWGdiXv1_9kj1bUnGC0VDmYaJuGhIEnWoGpfSa5CuoHNYPJTdYAUEcAqwzYt5LYn8QmtKZBwiCUWBmYXkSz8Ry08GjpV6JBbVQ2ZduQ56lspKaxQP2qIRup1Mp3fW-3goqmZSgGtxws6hz4lM6Mw

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
AN-X-Request-Uuid: ec58710f-2f2a-4679-8f1c-f99001f3ffe3
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENYvBnjOn88NRCSpSqOETcw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C476
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:23 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 611982c0-af21-43aa-a057-04417b598966
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0C71 41 KB
15 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DfxOoF89-oMQHRjrjsNKY8gfEbni0TpOCHhoo6Z0lzO9LYDvHHq2hJyPcWyUENoo8ziUcnF04ZWGQmdopms2OpX5lAO-M66baNemmR1iGwiqUVl_IySa5iExkOjUocxUJcY_V8B9Y27ZliFJmU2nke7b_Hl78pJnC4bMu1xCPRS4tUgCY&cry=1&dbm_d=AKAmf-Citg84EnGRXUf2QcSAHZb7VJt1lrauqcWVeLIzpsbuqaO3j7YwqvSB6T4iwoHT00Fb074RJD6GziUcJMJJAgBG6HRyVUo7SHuIONB6IpGr7wDWeWVqbi4Mqw1GzbEvXkafDwibvRUZBikYwuYBDcRKbDx6_17Ua-gsaRXKsbZu5v36q4Xq1OUzXm4t_0KB5dU4yd584PFbHhxgEZ9lynIYrfQS2h0ag_XhaPgBbR3zeYDwa4QXeYK9Fol6NU6ptpcrNhBB-sTKW9w8ykef4NVFTdXVtrzewoBm6YFsNDK4b8Sg_CKuOlxoKzNuwzKZg0uQ1hiOC6tIbm-V308qHpaMEx_NGBnacZOW7bgUxYdbEgOafiv--pzU0upZiHZyCXexOZNYd48QiAvPqsTNXof1LRvx34BfoP2bBIrdDc8a-ryB2cIi1PwZ8c0OdIbo6jWrm7BamuoOE-KykyOHCYSLBgL9NeeSHrbHzn3SgmhAa6V4b-csbht44jzIhj53A65FviKaGhxZPMx6ov0Hzna8uGSO4Us16qvGOS79y1K8KpOyaCfM0CB3Lk3CsR4QFWLzhw-wjE3WxvTT4WV-lUkkyPVQHW5V1rHhTfaEOD6IImeP8ZmMYgMn9Ux55QEcPri-ipee9960M5Dw1qheWqwEq9bminqMrPQuakuZRh1qQx_xneGEDTOhTibYrQRvTCf0eWFwFJWYWo2ecDUG-Yih81TI7xMid3FRreV2WJnyQK5FUt5Dmf8W5FOVe8HtHgadZbCpSJxtN__EbhPqrDYCucU3M4OOx7DohOUVMnAKOFSWrjbBFUvxfMcKD3EX1TJMoUhTh7mHSXLhIpd3TKiCJUXR7oXkoNneTTB2A7aomQCIDXwrGl5fy6A3zu_eiJulW1FSs2THgvVyrM0Y43s_r0FjoRhQJ1jfC8ZPQw9Zfvk7osayswnnZBR4X_IHwv3bmwmI-qHqh3Wl-HxDwxQrLSLxowxai7heRVI6MygElVlPNc0kvpttaQojTo78QsCq-UwG7p2XX7bthRX10-32SedGu-dMpgJJFIWqrIs4DFFGSOjy-gHiGwt96XM2r3RNqsLXir0qbl4lBNKDNCKpcT1n_xd1ZsHUGlEy_9WOxJGZbqsdFKvm1xQr1pTFuWKYFxEjuC8VWKt2_l1tfr0LYVq2BEsCZ4xeLKP4yffP9rfE9T2fSHBzGtmvT_gQeF3ok9Z7pgY26TZ87gKjm0fzeQqofoMawMMqZLUnT60jZW3HiY_5GquWXL0WDuyrEN1hCE1hLzyuuwhjn4wRsmeOLOp9T7AsZW0dX5CpDOL0ekcW_jstIYyesfGE_AzMgaZNRLzxfQM4fCRMDiyH_tTU_CBhUVYoJMANAbj465WmA7qDWXOl3N0-o756OKZZ48y5Uu_HVWATG5n131WH4REZPS1Tr23IwGgu40XLOoDu6GG_EbU4_9YdCTUxAW-fMUijnYXJJ_vkhLfZjcOq-3Wqkjn5iYHp4kYo1_k1Q0Ax9sGN8a_V2W0mFIb7NVxIKfk4eASiUamZczRuyCmgUF1dpEdoCMffc7bLXXxjl22e1RDcalS_d7Nn9imslosd1AY-HcdHp2kIhNwCCAbbvYyeABNJUX2kHdoYQ8T3aDZC1R0s_IabN7MC67Myax3lhFhtzWdNgknK_qJdFpdVjoCSxv0zGTcCCgoDqgw-AFpGCgAznkB1gqXlKoIkAney9xY0DWeLyfjjJskWiw2nWjWYyvpQkuJGJ5YYBxd4pcIMcLjmDzTaircFoc4HxPAsifJDx3ohaUd8oxP1r3xVik9h_sOHoTBbmPTSOIdZnC3W_I8kB0oj1MXEJD_ziD5Un_FMm9NK3IQ_ffBH6jx2z5fr-3dgoBusUihBh5OLWm1CapUYvzKJ1z7DmH0xv2U8hJnE7r007nxKKxX66cyt3hmnYbGAkdct2Ft1r2YEuS-q7TzGaEklyRD6XUfciUyu-3pBgDWBD8H9vx0tpsJ20sHVMlyuRJpX3Vms6YYLt3DreGsqXjmH22hsMPM1VDnqo6SNQZaMQA_C96tGfWlTI_6_BtQUQUR6U2hrhf3uc5lZJ70FvCNrwITWMmbXW0aSeYToD9kp9tfQNVYnMbtQtw4QoFkuivywiIDK0cwpeJwRMMFXuRXOUkstT5KbmvpR2MaKrJPpjcg42pTGZPYpjew5dT_TzsuEOXkzUh6vRUM1Lfh2bz97uLEThnfM7ZY439OZsCY8XRuV9IAo67VqopU7sQUWFBFPpa_yQgtakamorFoGXUL9MO23dO0V5lC2PJQ6dKCwqa9AeMf4VK_wEkm5idXrbDq7lPi8SCPb5vwqclmqR67ffst4PqrqJ6axlgETp-ZzKX3L8aYCV39LfFIZoXettnaSMXFYDf3YnTEVK4zjl-HO83h59PqAyMkeSlpp6M9LFPn8PsXscx0OFSLm3kHcfUvDILncWR0b2ou0gZQNRjGWR3C_5Yg398yzfx3As7EXH2QVBshPFN4rbBB57ruXuwBEKOSKEkH6pKsqagvsSVKK3QGV_64nEXRf4zGdSVc_b3CbVbatELzhOxqKRev3TD16boEmqzN9MZNT54qOtS46u26gF4RlRGOVLexuxD-Rts35hemd2GLTdL1k6o0ZwnESSZLeNxDD6IgSiyOgtXxnGTCjoRFrpBupRDj-6cDFha3Si2NqEQ6ldV4a0nbL10iULx59HqsYZMRihtzLduOnPRoROwXqhA0RVd-q4ECp2SNb5mNIXna59v6p48s-mM3ToVNdpnKbRDF0ySouK2Xtgc1Kd3VRuFU16FI2n16yLOyNQqfNNw_ICx558jWxwZoJu9sOj2UBMVIe7dO3CKlOJdeijeWMj6NAthEUYPJXub9Jj0TjUEAx2NHTkNqC9BEwBbMB2KfP2DLupwg9f3_barJHT2-cv8jonISX93QefDGq_1Y-SyI7z48xdURHVpb-qN1KgRlvvxq9abmzZoZhuzNYy_Un_lAflLY2-oFlTdTccSCA5VSzG_ki_Vgdu9WX4SAqWbxyhUazjCvrN2gUl9Bi2IvQ_e52Q5Qy6y9s&cid=CAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=8110768988406991000&adk=2228999115&idt=111&cac=0&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106848
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 13:52:35 GMT

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/9170381621892120779/css/ Frame 6273 6 KB
1 KB 11ms
8ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101470fcde40e5ad29c691a0cc4276b7e311972a8e02a684f19db29fd4698645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106846
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1483
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jun 2024 13:52:37 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 6273 118 KB
40 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:52:36 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 6273 95 B
122 B 10ms
10ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/overlay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 08:27:52 GMT
x-content-type-options: nosniff
age: 558331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 14 Jun 2024 08:27:52 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 6273 6 KB
3 KB 7ms
7ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 08:27:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 558331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2563
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 14 Jun 2024 08:27:52 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6273 60 KB
24 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 0C71
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1316115/71738579/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwN...

59 KB
23 KB

107ms
40ms

Script
text/javascript

74.125.133.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

74.125.133.155 Nashville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f155.1e100.net

Software

cafe /

Resource Hash

5ff78e2297a3556dfba37ba6769e1f8d722d2ea9dd2d8cba409f91c06cb25a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23557
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: nginx
x-server-name: app11.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 22BB 91 KB
23 KB 93ms
25ms Script
application/javascript 2600:9000:2450:6200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2450:6200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 aa6aac7d06fbfacc7e809b87e595c5b6.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P4
age: 23601427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: Md4C8km2y3HLKhhfvr7HRiv9tfaLmD0tUjYGlLvN__KaZ_KauFx6IA==

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 43ms
43ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306200101&jk=2752916905154317&bg=!cXKlcibNAAaGYqkwpmI7ADkAdvg8Wh5PaEeNVXc-hylo4_7nWoqbtvPkMoflPTuB7Kd-7-84UyLkId-dL5z7kKV2uJmBItQNyxsCAAAAWFIAAAADaAEHmQLg1nY9LRjiMWBDOzrQT4p-R9NAw_W33HG-Dd4-I1PmOQ-xWAMV1KGWFN9qNX_HLEcYn68mFcB2hLtUE02D0VEgbGlCroM6pLkoM89kvByVhEStKmgfDy8VG9YjYSeyPMX8V1DO5Q3I4BD-X29QFYu2VhdaotpKsP4KrqSyJMllrbrSaaLym4vdDIh8DRefoIwrHPriNTSPtC4wPH6lHePKORzQM9cm50BPuyJKfBcO8AOXODNT5Q6vvTcXdqX87k0rWBHrOmNvY9aoq4Bc6kHE8zzcQQI-hh8pW67HAOIn4SUmPk0Gk4xuH8roSh4JnQuIAB1EMCDNJBLdosJEHNtB04izlHeYmNpI8NbRnc82jKUeMTU5mgYp3jgYRjh9tzYssE9EJ0hZCMCca7xbqq_X_ZMUxi-cGh08y3VADvHSHG2catK4bg6BpXSy3PHvsfdcxbAzsZbiSBegKu_r5K7hqcidH5WLhcK_4OUGxcvvqOpaEwiFk9ra7ev4mHg3LC0LG4BNDbeweOeMP6oPo9ymHLBFTlnErbNoQtZQeyYa3gAuNXX_tRKw1m76-8UQ2cSVo6m4Hb3Y17QixlBJgRAZvP5czg60uSDsxP0AZAEihmTmpZfmCWsnJKz-ALPfnsc0rp0SCiQcvjcPr37gr-IWrjP4CrL8KzvvlUBRLEHt_-Y6Jw2rhe-xxVMYo67cNPhDsKUNW2T3YDcKAgBRU4X-4oQalgk0ywgpc4o6ErEjneIv1iWaPyd9iw3USI2WvODjZ056Nqn11kMQ922UFCdTr2z53HkY1HU0EWe7hrSV9hrPijOTl2NKUlnESjNa6eKZwIWCMSzJ0Efbutx9EX0P5mEIFtseQtFYnya0qFwmOvLIqDt38SSlZdou5jcyRfTE_u-WBkkqzwcYmmq4KifhHCsGPfjqvcvbFHwLju3WqDjz8nDCvG6v6pSumIhdGNa5iWf6l5wwfAr_LYUcRRxTWA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 301ms
95ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDhAd,pingTime:0,time:89,type:c,env:%7Bnr_rHRbA1:0%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:90,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B80~0%5D,as:%5B80~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:41,metricId:rHRbA1,cmr:t%7D&br=c
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: nginx
x-server-name: dt18.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
216 B 299ms
93ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDhAe,pingTime:-3,time:91,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:91,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B81~0%5D,as:%5B81~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:41%7D&br=c
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: nginx
x-server-name: dt19.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 24E8 6 KB
3 KB 11ms
10ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 281ms
94ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDhAt,pingTime:-6,time:105,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:105,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B95~0%5D,as:%5B95~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:0,renddet:IMG.us,siq:41%7D&tpiLookup=ao:www.ensonhaber.com*&br=c
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: nginx
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 250ms
95ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDhB3,pingTime:-2,time:141,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:395,beZ:397,mfA:400,cmA:402,inA:402,inZ:407,prA:408,prZ:429,si:435,poA:437,poZ:463,cmZ:463,mfZ:463,loA:499,loZ:504,ltA:535,ltZ:535%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:141,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B131~0%5D,as:%5B131~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:IMG.us,siq:41,sinceFw:97,readyFired:false%7D&br=c
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: nginx
x-server-name: dt20.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js Show response
pagead2.googlesyndication.com/bg/ Frame 4A09 37 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87127
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14515
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 19:21:16 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9579 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 106816
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Jun 2023 13:53:07 GMT
expires: Wed, 19 Jun 2024 13:53:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBB0 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3030842695668&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBB0 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3030842695668&version=m202301230201&ct=76&x=1&cor=9072290020843977000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FBB0 93 KB
37 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZpOt-pW_pt-TBXbfRk_HfotGGtCTgMrFhdKG92WGDbm62qCgz0B0c8kEqYRCZZth3-naHGQDFMnGnSJyXOYmZsYgqkdLNdPmvxVahIO43FGAFwXVRjyQRzONAjxTQfVnvNtSmnQkCPuJhVMG_wYB1n3pSVcdD2uAau7uW1UqBt2UsLXk&dbm_d=AKAmf-ALUdNLdo212qtraXSseWVpDcc-8PH4oxyWuEfpeARzo3T52H1SPtik6waegNK4bdZoqBKXOuOlZhCP7i1xo2uMzFZbTv6lkLDHXm500liAOIB85mAprHB1YpIs6H7iQC_lcOK_anef551u3NcG_ffKZ0yvL2LrpJKlyEyV8Cf9Cp1OQoDshZ1S5c1SkzE8LUkZ5FUIeAxbwRMS3wYoCPYYWQDDCKBhK0EDCCNm-ZUez3fLj2CjrxOcN6GIZcnzEV-CuiA4Jxj9D3xJzoumxwn7oixmEZKzP9opX3M_LPpM-_LMTll9n85nD6GdlfgCfp7sgCJZSqwlZVNbiu9jCFVHpLcNmHsG2zUJcN9Ev0qdPigIk7eTXnJYcMgUqi0B3OS1hl5F3ns9LNpqhVONB-53keBTh3UNFRjTrPbBP4m59n8prjXo-iuNJW1X5BIINAFVrOPcKg-1hrTL9C4LkAQvdDaC-fINXsUHpkGBbKfjWHm4ru9Tg9ZInZYCr9cOM732V7UFkQerAImxyNj2BJx6B95SmAtiYVCHdCC51Wc4CAvJSPxnS9z9lLtjowgaY2b6PMjG-H1WB24Rr7l12pkQCPnbATvqTR3OBgiAqMZ5AJMwQ7n5iSUs7W5m7ijcbF0EsY-s7zhZBCwcHtJToGsx4A073956ngL9X5nLAhJqpOxuz0Gk6MmuoifYfvgbryfaSqzsgrQkXHVu4ogKPOiBpR0V4JMjBjVExWpT5M1heZH39RAeyjtdISJNh0NRJ_cOrrzLJF8750j1wYJObn5WVsDCkUvvNAjrtzpsxTJorkTUbPRddOFyY7JmCA5CIgtatk_9jkuN4YlSAFrnoLrfxPeabnVOWyq4sDCd8ZzlEe2RkFCKP7l-iwgo_rNLSPAk-JU9c4k_2VeUVCEbVCVExL1Gq6kfhl-1Ha_z_OuMCfYz3jLL9rViSoa8rLogPLjFaB_1c2JVUnFveRJMQLiXvWn-x2ekZgxkQZZvjbS0JLDz7AB4BOIV5UpyBQ6ZipHN0yY_lNqI5HrYm5zQOpLLDynQZ6kMffPgeGrCBmXsEJZFr3l7NLxLgPyfgOwBki_mhQWLK5YFYyqcRlEBE9TJup3R8bfW330cGHh9N_9u70sp_Yhmk6WqRMR-Cig2ije3sF4K5mQUwQ5e6jPA-WZeZqKDmJBNfF1JPSXbfUGx51-MLgKuWnkOU1qcdp7oV4k-dPvtDk_7tGFON-T0OkBN7eO7EYuj5UuaiUQqe3exOHuAGGWCPk3abF0ON1Q4DDiYIJbbDGpn5eyq0SP6T9wnANVil7gVkZRv0fRiIjnTmoCd7i3yCHjl1lYD-JPhmmz4EzFk4HXCFlRgvJSmLCIxLUk5aFWEe8eQDXcgaRuI_gYEUJP_TWdD1Z4Q9hr_nxc-tfAe70V47nI8xMenfj8rMbgeZ2NlShqUqJIqOmmNjDPDsEfA6EsbkLlCp_d8hTzLcMxYV8USzaOf7mNZdP4cYfmI-B1uWcaeTibw6a3AjmWkrGqeppPmvZ0gnyOhqJqO6NXpiUZh4dRjqId421_iOdzV-wOVUAzo-J3eX-472cHgTMTyswL90kyeQP1u50Gj4CLINRjCQGz9Wh4m-zM-WptRH3Dv11WbCJHRLuz5NeuQFLlgQWJta_ytDyusvrz-mDf2W7ARPigGy4cU72jM4YfkMIeSQUm-LtoTYK2S4GmfZ4NYU7Q_uqzHnN_85j0FeEfv3TWzhSVeNuBXkhGlWORybm-tmZU5NdvBLjCXGMXouzdEFsfnRe9ZpXgzs9Ev9k-zy8wVtUMoaxVBiGZtQaVc38u6iS9O7QdV3WFXkKDsl2D5sw8r6K7OV04TIIYWEL3yXus-L19bYg_WFPrGxexutUAYMxLXZaQ3Ox4ZghApdp_SpIUJ1L0o3Til8JrnA04thCsT6A9mpJdPK_ohkcEUVZuGrOAxeQkK3G6ys6d3jkhMT-RzLykA4ZEMlcLYhaLcDUahDFyzFmsOijdmquiaryYr010wW19LkPM9veAUR8r07ksXzKhefM3GN-fciP57kf6XYSDuvH6zoDR6g5SbYdr4crUwuwIrZlYUWhbrlGBXS-mSQRvKdMzjNChozTQ1f4rw3ybsf4834UIqCNGnvAl9BavudmkGvyvyQau715iDr9HZ-Zzk6Vouc8CUNm0p_O0uS8I7s30LAAXsISMCHcDz3TzsLhaelKZB7BMKbqfxYUCw3XN6wTYvobiz3z12WszqYiH68dgmF2SVFWDx8uvljBxACo7slYr9A_IEGvQh5Ab9yC02V4mdGWRXcBHWD8v8GV8xQl-_IHlYOR3Q2Dwy-9PK0af3ILYA-nNZ9ZNwnbb4YiQ5NmGKjfgoMuc5HVI-irr9YDJhghdI5sjxh-kqw2vXlDnPNS2tjRzfFvdyD9PYDbzAtxu8_mMOAKDYr3J4Nckw5dQCXzF7O4RsIgXodsMAf4pfc0DnqGB--qaai0rhb7bnqJO8KWqkOYRYGoW5ZvDLzAhD4pnhNBowW4_DV7lSS8_1l0TMIlqBhrAVLSKGKHkDTwjpRw9sB4Q_fHy-RoCQQtIqrNJJSsIJRvujNCVLBaFj7koF2ANjS--nDlFlyCw43bhpPh1yt_sr6qiM43U_9af4BFsGnNjY6ELyfr2d5PkkGOZLY8nbY100jVAInvLC-t19nMcngoCoENosQ1jsJhf-tRsCOAQEFF9cN6ra1aqCCljHwH5_oE3xCpZTckW6pFVW-wkeM6IhSY0XLrUS1GqlWr0dqnYQm__lool21uJYTdbdvSgAzabc_-umUZwari1818zWW8yNwRpvjL6ntKzI_VelFJNgWLNWKOKca-mk0nLq6rvdTx-Tmhud1s6cfjUMC0VivtQcY4xuNsKiBE7Kep2sCpScxSfWFR2nY1TM7DT6cl53XTMlScO4F-X8AuLF2jJY_Uu5_B6NEhQUl_9MoWdNUgMNwvf6eYmpxsBHDs9mVF1vtRL9bKGOQBSremAAGxsSgYeJ59-qK_K5Lg0wVBFwSYf3g_rE3lQVpbXVfksKXyn1K4T_pVdVH-AYkRGJ15Q-LMLWSbUfraVeMPZTO-qHgsb779Miu3EuUmrDM9BtqPa4Egs3_4u3HR7-GPjv4015TfP_It_ldZweXQq4-r1z2wo1RcsM70XP0i97d3Ly48uRJVZsjVCvMpyyCqrgq0RT_Bf7xfDKkxrnxpjo4-BHyBtg2wEOYVAScqYI6Jp5ilBIZIfditb3p-YNymlyPje8uD1RuaDIX_TzgHj80ABQuSnsd6_YTa2Np1oh_C8o0QfMOC-GjvNYpoTA7qN_HEFXw_T8mi2A78KPBQlgqWcKq8-5V0ziMf0JT8VL6LB9dYHunMAOHNAIaNPvLsmqCvHHgK2bqI_8ldpWKwlPRoWeY9iHdTP76AR59bnGvoQd9V9-yQ_O6skAdoAEZp5qnPafE7HzTYm9N9orvye6C17Oh-mBTfd9fI89ZIeBAZZ-rc9MT7l3UtMi9X1RI5uvecHDdIeO1XF5clyyT5PWAPOrZlLfxTWuDltCO29Vz46LfogH6vWfQ6WTUyPFhIJDgy9XpsXEzVHv6_4p8GMKxwAwmbll_L8ULyr-_sT0XiLug9rZJzJ38PwjfmM1Jpvvm5SA0_7n6BPtSRM8QIkK8AmOu6sU7GJL4tY-sRQyIE8uhdHYXn0&cid=CAQSPABygQiDBWeSF_qv_-DuapSBgA2j_IAouLcsLVU04cXQwSGZ0AqROzcvEvhAm0QD92wyp4IMdElXqJYg5RgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9072290020843977000&adk=2228999115&rc=1&idt=180&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fdbf1de1c1d2b32ed534337136436e7519c3274d614ce809465065db84a35b3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38037
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6312 624 B
242 B 50ms
48ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAhsHjATAB&v=APEucNWoEfFf8BRSyjL0cohO8YwUzwiAEse1Pa9nCjzNcctPCHSKaxG9i64LSA8eFcsVknqPWuARuHFF-Bo5_8lTNEorYAZhaziNoj7TN-r9iaiofUrOngFJchnwdgmGtDRuJSA2P2kpvzzio505o-XnlE0_dMM6Ec1w38NFLmW4kOAx-5xwC9fWRCczB0DLwShNyL4cbr6F

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 24E8 78 KB
27 KB 85ms
84ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24E8 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CkQD03Am8TIDAW91n-wsnDJym4AHFJ8WQDU-Z5PCsQWQ4qBU3IY9Q2_qFVaIvxRpRWi-Z_2UQTwqZv-Vnhmk0yje_aN-ZEG4b6j6u3MBOAXzTHWzs

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24E8 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9966132341682260662&x=1&ct=76

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 24E8 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 18:48:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 24E8 19 KB
8 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 24E8 0
0 16ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSz5X6DZYnEuz7wm4BcN53k675dKiYvwYXNkvXeNqxTxahXA5g-n2s_sJRoQKfGDNqJlpIDolVeYgfFmJLsSzpV8yWFpg
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 24E8 178 KB
56 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57058
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687274360908795"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 6273 13 KB
13 KB 10ms
9ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaCondMedium.subline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 20:23:09 GMT
x-content-type-options: nosniff
age: 83414
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13336
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jun 2024 20:23:09 GMT

GET
H3 200 FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 6273 12 KB
12 KB 9ms
8ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaBlack.headline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 10:58:49 GMT
x-content-type-options: nosniff
age: 376474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11876
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Jun 2024 10:58:49 GMT

GET
H3 200 FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 6273 14 KB
14 KB 10ms
10ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaRegular.legal.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 08:27:52 GMT
x-content-type-options: nosniff
age: 558331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14468
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 14 Jun 2024 08:27:52 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 636B 0
0 47ms
45ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvSje54BhhiD6aRUiag_r6uvMGZtEq9oB7lPbkoIAWj1RwrVzAMBq7BCITQIBMIXknNzBEsEbkV5uHt2AxoGlSIBwke0nmt2ArCHG4RzRdKPA5IRlq3kkB9PmCb1XrnHEo0eYKoVNWHRB19d8qpx6UtGJ9ftHt-MeSo62jDZDgNBxOUTennxl5LyCcSLLvbp3vLuk4IjQRqWwiutzrHCuztMidAv9OcDtAysnS77BWIB4_Yu5mLJmQ_7ROzuHxaw58eUD-1_zRAsn_Xvn68NvcJlhbJ6ZerNgTpslWl2EjZP1K6sPrEWeIQ57uVNVMmfzU1r7p-gyBuNPzH-SkEAV8QeOT-W-xCoQ8R1Fb0GJ-ed9qJ9t9c-Ivkrb5hRCGkCtradKBBMyGhZEFbUuGLNdAIRP2Fv-UmjZyFQooPbFrxzO4uZel19-pa3T0zxM1-82-5Y-BUauy9AsQXVKoLo4dsSMZiFo4DzJKtGuZMts-nisPdeR24Nezqf8j3d3aJmnoZYLBi1pyLPHbkEkoJTAscjVNRISN89u1-g1NUOahcCPlpO7d3deVs7aa6fAT5gj0ybmAShyG0Ya6A2lwVRhErePKBO2vbKYHo9LyYNIh569FAQRIk-uIgdS5547sl-VFyIK2k9DurWmX0tp4EhVzjzhPRoW5wahwtzz1ZR8-86txMT2X0br61r0jSq0b1TqSQUDzinhFV992h1HFJmBSzN7Ci3uXaRdjUmVJ_5CO4_xAH1lCOUeXFMUd-fp6simfscUvfjPMrNwRqmNV3tAjCpY43JTGqWxuticUyA5_PoRPKGB2TJNrnU498jaHJ4W09x6xhdHnaRDvm0H2ltikyABIeebDROs7DJoTI_G63zm3b32VIEbNeSwcZYzuO0luCFb3WEAMBz2jGryLdFTz4tD-VNVRVbVCG8pbeHQ7IxtwhitxbtD2xK2bnqWNyh3W5CwH3AtDhvmW0g78qs4FLbrDJx8kP8K95kE_1VPMKXKpsv_SIAf43DmAgLOOrnoVGC0vlJrN97J0YFEGHd4czrFd69vfkHcKcTaeiG1dv-4vgdNfkMnlEJRRx7kq3u1TMQ94aGcbRLcx6olprq9y0Ze_Y6tv7YmfvNUbtV5Hu0KIO-Ng16RHrkl1bDhwCCL1gfohiStH1uOIzfKHwff_SGtMkT9qDmF0vsr9Zrep12SPYCgDIzdTFkYIE1DAnMGmdiHLSeVxXJL4Q4LzqlqbR0m3qaXFkCq6hzW08VvXvxiPbAgrBA8e9WUrQujoaQUZ_4zVB16SkV2fadGVT6zv64kYB7h_rgS2NtKrxhBQRRDjsdv-6YxGof6Rgs2Get-dU3pweD-JgEb4ZygZEyeDd4Q&sai=AMfl-YQR9zCoTL9ZuX-QIFTWtfArrFKzQCQShwfa6W2orNV24OkY0yajvBdcmbu0TXvfB9z9ffIftC7OzbtQX2jrMaCDcT2cqiXDWP-04L9oWa24TbLLoGyFnQJGg3jZTZJC_4MAniu7e93WKF5Wxym4ORXdfqnePGxvj3Fkhf4xaDyPXRR-e3t2YOR15RagzqUfGore366IxJVAN68tK-DCBhBGDmfie0ljyKVynzehGcUbrMbYyYp7B2aGaAoF7PgbVPVeKFN7It9jOgMHqlwnKqz4BygqOA&sig=Cg0ArKJSzN33_tTzUp7aEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=494&vt=11&dtpt=277&dett=3&cstd=203&cisv=r20230620.48978&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6273 7 KB
6 KB 51ms
50ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c98e974dade636fcd482b003077a1dfd617cc234459ab65007ca146847d00f0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5618
x-xss-protection: 0

GET
H3 200 visual.jpg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 6273 92 KB
92 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/visual.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb578159169bb38173ca68b7f9ce061b18af4e4e6724bf3c9c3e745cc954f177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=9eh5x3HCSZ&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 19 Jun 2023 19:30:55 GMT
x-content-type-options: nosniff
age: 172948
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94238
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 18 Jun 2024 19:30:55 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6312
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAhsHjATAB&v=APEucNWoEfFf8BRSyjL0cohO8YwUzwiAEse1Pa9nCjzNcctPCHSKaxG9i64LSA8eFcsVknqPWuARuHFF-Bo5_8lTNEorYAZhaziNoj7TN-r9iaiofUrOngFJchnwdgmGtDRuJSA2P2kpvzzio505o-XnlE0_dMM6Ec1w38NFLmW4kOAx-5xwC9fWRCczB0DLwShNyL4cbr6F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=489
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOixPcZB9ozzKON2D6RkV1k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6312
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAhsHjATAB&v=APEucNWoEfFf8BRSyjL0cohO8YwUzwiAEse1Pa9nCjzNcctPCHSKaxG9i64LSA8eFcsVknqPWuARuHFF-Bo5_8lTNEorYAZhaziNoj7TN-r9iaiofUrOngFJchnwdgmGtDRuJSA2P2kpvzzio505o-XnlE0_dMM6Ec1w38NFLmW4kOAx-5xwC9fWRCczB0DLwShNyL4cbr6F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=488
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6312
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

43 B
1 KB

12ms
11ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAhsHjATAB&v=APEucNWoEfFf8BRSyjL0cohO8YwUzwiAEse1Pa9nCjzNcctPCHSKaxG9i64LSA8eFcsVknqPWuARuHFF-Bo5_8lTNEorYAZhaziNoj7TN-r9iaiofUrOngFJchnwdgmGtDRuJSA2P2kpvzzio505o-XnlE0_dMM6Ec1w38NFLmW4kOAx-5xwC9fWRCczB0DLwShNyL4cbr6F

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
AN-X-Request-Uuid: 2463b22c-6d20-48da-9226-fbfcb753ecc8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6312
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:23 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2dc2cb8b-d75e-467e-883a-54607f0452eb
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js Show response
pagead2.googlesyndication.com/bg/ Frame 9579 37 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87127
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14515
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 19:21:16 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame FBB0 172 KB
60 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Origin: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20448
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame FBB0 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BZpOt-pW_pt-TBXbfRk_HfotGGtCTgMrFhdKG92WGDbm62qCgz0B0c8kEqYRCZZth3-naHGQDFMnGnSJyXOYmZsYgqkdLNdPmvxVahIO43FGAFwXVRjyQRzONAjxTQfVnvNtSmnQkCPuJhVMG_wYB1n3pSVcdD2uAau7uW1UqBt2UsLXk&dbm_d=AKAmf-ALUdNLdo212qtraXSseWVpDcc-8PH4oxyWuEfpeARzo3T52H1SPtik6waegNK4bdZoqBKXOuOlZhCP7i1xo2uMzFZbTv6lkLDHXm500liAOIB85mAprHB1YpIs6H7iQC_lcOK_anef551u3NcG_ffKZ0yvL2LrpJKlyEyV8Cf9Cp1OQoDshZ1S5c1SkzE8LUkZ5FUIeAxbwRMS3wYoCPYYWQDDCKBhK0EDCCNm-ZUez3fLj2CjrxOcN6GIZcnzEV-CuiA4Jxj9D3xJzoumxwn7oixmEZKzP9opX3M_LPpM-_LMTll9n85nD6GdlfgCfp7sgCJZSqwlZVNbiu9jCFVHpLcNmHsG2zUJcN9Ev0qdPigIk7eTXnJYcMgUqi0B3OS1hl5F3ns9LNpqhVONB-53keBTh3UNFRjTrPbBP4m59n8prjXo-iuNJW1X5BIINAFVrOPcKg-1hrTL9C4LkAQvdDaC-fINXsUHpkGBbKfjWHm4ru9Tg9ZInZYCr9cOM732V7UFkQerAImxyNj2BJx6B95SmAtiYVCHdCC51Wc4CAvJSPxnS9z9lLtjowgaY2b6PMjG-H1WB24Rr7l12pkQCPnbATvqTR3OBgiAqMZ5AJMwQ7n5iSUs7W5m7ijcbF0EsY-s7zhZBCwcHtJToGsx4A073956ngL9X5nLAhJqpOxuz0Gk6MmuoifYfvgbryfaSqzsgrQkXHVu4ogKPOiBpR0V4JMjBjVExWpT5M1heZH39RAeyjtdISJNh0NRJ_cOrrzLJF8750j1wYJObn5WVsDCkUvvNAjrtzpsxTJorkTUbPRddOFyY7JmCA5CIgtatk_9jkuN4YlSAFrnoLrfxPeabnVOWyq4sDCd8ZzlEe2RkFCKP7l-iwgo_rNLSPAk-JU9c4k_2VeUVCEbVCVExL1Gq6kfhl-1Ha_z_OuMCfYz3jLL9rViSoa8rLogPLjFaB_1c2JVUnFveRJMQLiXvWn-x2ekZgxkQZZvjbS0JLDz7AB4BOIV5UpyBQ6ZipHN0yY_lNqI5HrYm5zQOpLLDynQZ6kMffPgeGrCBmXsEJZFr3l7NLxLgPyfgOwBki_mhQWLK5YFYyqcRlEBE9TJup3R8bfW330cGHh9N_9u70sp_Yhmk6WqRMR-Cig2ije3sF4K5mQUwQ5e6jPA-WZeZqKDmJBNfF1JPSXbfUGx51-MLgKuWnkOU1qcdp7oV4k-dPvtDk_7tGFON-T0OkBN7eO7EYuj5UuaiUQqe3exOHuAGGWCPk3abF0ON1Q4DDiYIJbbDGpn5eyq0SP6T9wnANVil7gVkZRv0fRiIjnTmoCd7i3yCHjl1lYD-JPhmmz4EzFk4HXCFlRgvJSmLCIxLUk5aFWEe8eQDXcgaRuI_gYEUJP_TWdD1Z4Q9hr_nxc-tfAe70V47nI8xMenfj8rMbgeZ2NlShqUqJIqOmmNjDPDsEfA6EsbkLlCp_d8hTzLcMxYV8USzaOf7mNZdP4cYfmI-B1uWcaeTibw6a3AjmWkrGqeppPmvZ0gnyOhqJqO6NXpiUZh4dRjqId421_iOdzV-wOVUAzo-J3eX-472cHgTMTyswL90kyeQP1u50Gj4CLINRjCQGz9Wh4m-zM-WptRH3Dv11WbCJHRLuz5NeuQFLlgQWJta_ytDyusvrz-mDf2W7ARPigGy4cU72jM4YfkMIeSQUm-LtoTYK2S4GmfZ4NYU7Q_uqzHnN_85j0FeEfv3TWzhSVeNuBXkhGlWORybm-tmZU5NdvBLjCXGMXouzdEFsfnRe9ZpXgzs9Ev9k-zy8wVtUMoaxVBiGZtQaVc38u6iS9O7QdV3WFXkKDsl2D5sw8r6K7OV04TIIYWEL3yXus-L19bYg_WFPrGxexutUAYMxLXZaQ3Ox4ZghApdp_SpIUJ1L0o3Til8JrnA04thCsT6A9mpJdPK_ohkcEUVZuGrOAxeQkK3G6ys6d3jkhMT-RzLykA4ZEMlcLYhaLcDUahDFyzFmsOijdmquiaryYr010wW19LkPM9veAUR8r07ksXzKhefM3GN-fciP57kf6XYSDuvH6zoDR6g5SbYdr4crUwuwIrZlYUWhbrlGBXS-mSQRvKdMzjNChozTQ1f4rw3ybsf4834UIqCNGnvAl9BavudmkGvyvyQau715iDr9HZ-Zzk6Vouc8CUNm0p_O0uS8I7s30LAAXsISMCHcDz3TzsLhaelKZB7BMKbqfxYUCw3XN6wTYvobiz3z12WszqYiH68dgmF2SVFWDx8uvljBxACo7slYr9A_IEGvQh5Ab9yC02V4mdGWRXcBHWD8v8GV8xQl-_IHlYOR3Q2Dwy-9PK0af3ILYA-nNZ9ZNwnbb4YiQ5NmGKjfgoMuc5HVI-irr9YDJhghdI5sjxh-kqw2vXlDnPNS2tjRzfFvdyD9PYDbzAtxu8_mMOAKDYr3J4Nckw5dQCXzF7O4RsIgXodsMAf4pfc0DnqGB--qaai0rhb7bnqJO8KWqkOYRYGoW5ZvDLzAhD4pnhNBowW4_DV7lSS8_1l0TMIlqBhrAVLSKGKHkDTwjpRw9sB4Q_fHy-RoCQQtIqrNJJSsIJRvujNCVLBaFj7koF2ANjS--nDlFlyCw43bhpPh1yt_sr6qiM43U_9af4BFsGnNjY6ELyfr2d5PkkGOZLY8nbY100jVAInvLC-t19nMcngoCoENosQ1jsJhf-tRsCOAQEFF9cN6ra1aqCCljHwH5_oE3xCpZTckW6pFVW-wkeM6IhSY0XLrUS1GqlWr0dqnYQm__lool21uJYTdbdvSgAzabc_-umUZwari1818zWW8yNwRpvjL6ntKzI_VelFJNgWLNWKOKca-mk0nLq6rvdTx-Tmhud1s6cfjUMC0VivtQcY4xuNsKiBE7Kep2sCpScxSfWFR2nY1TM7DT6cl53XTMlScO4F-X8AuLF2jJY_Uu5_B6NEhQUl_9MoWdNUgMNwvf6eYmpxsBHDs9mVF1vtRL9bKGOQBSremAAGxsSgYeJ59-qK_K5Lg0wVBFwSYf3g_rE3lQVpbXVfksKXyn1K4T_pVdVH-AYkRGJ15Q-LMLWSbUfraVeMPZTO-qHgsb779Miu3EuUmrDM9BtqPa4Egs3_4u3HR7-GPjv4015TfP_It_ldZweXQq4-r1z2wo1RcsM70XP0i97d3Ly48uRJVZsjVCvMpyyCqrgq0RT_Bf7xfDKkxrnxpjo4-BHyBtg2wEOYVAScqYI6Jp5ilBIZIfditb3p-YNymlyPje8uD1RuaDIX_TzgHj80ABQuSnsd6_YTa2Np1oh_C8o0QfMOC-GjvNYpoTA7qN_HEFXw_T8mi2A78KPBQlgqWcKq8-5V0ziMf0JT8VL6LB9dYHunMAOHNAIaNPvLsmqCvHHgK2bqI_8ldpWKwlPRoWeY9iHdTP76AR59bnGvoQd9V9-yQ_O6skAdoAEZp5qnPafE7HzTYm9N9orvye6C17Oh-mBTfd9fI89ZIeBAZZ-rc9MT7l3UtMi9X1RI5uvecHDdIeO1XF5clyyT5PWAPOrZlLfxTWuDltCO29Vz46LfogH6vWfQ6WTUyPFhIJDgy9XpsXEzVHv6_4p8GMKxwAwmbll_L8ULyr-_sT0XiLug9rZJzJ38PwjfmM1Jpvvm5SA0_7n6BPtSRM8QIkK8AmOu6sU7GJL4tY-sRQyIE8uhdHYXn0&cid=CAQSPABygQiDBWeSF_qv_-DuapSBgA2j_IAouLcsLVU04cXQwSGZ0AqROzcvEvhAm0QD92wyp4IMdElXqJYg5RgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9072290020843977000&adk=2228999115&rc=1&idt=180&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 829
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:34 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame FBB0 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:21:16 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FBB0 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106848
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 13:52:35 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 0C71 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1316115/71738579/xbbe/creative/adj?p=APEucNWy33QpoBKMg8wisveLpI8BY0xlwURr7Z8p-seuNdqQsl3uxj8&d=CokBAKAmf-Ci5NtF0vIuLpFDaASozKgiHi_Tvdp27CufNIIBOMevQV6thtTkVr8fL-WnqQSn_mn9CO-8EPK47YLwNc_QDeUDhttilu5HwuXvDL8yZ5U5hVC20eZTcgS1V_1eo9CEUf0bTlP-sX_QjWGwz4CMemM1kUAahElc8ZRVtKf9JOGA1VSX-5wSqRUAoCZ_4LEFLYQVRtcW5kOrxFpNHcxpRsqumlZxmEHHd-6IghQEcyisg92SXe9oprtvtM98xCKy5X33iPM-kOemLtVP8m9jdiGxbafm6yMCooJsCniojP7ABbGBXUkmzFu-vX6ERsDyM84qheQvGZm7N6uP4wY0ekLAx3plhk6TPsnJCtbxX-xPeQLR6OcUfWXy-7I9lKRr0RlXIv05ontB2ml1vy7Vo0RVzm5L9VaJIXO_YkWFLFBheXHmmQtrBB91vSWmYxH3_4-6NvbK-qtQ6GSSxypNY6OX-xf80v7eNr82ziT6avMr5Sr8aNh8RjjOXdpVEbcXnmUrJJvNWZhRm9cERhpT1BXFoi3Vz8LxG8twPFI5BTo30uOXVRSrsnAvSoDkMSE3YpB7lbnzS5Lh54MxOTeCjO-xeyjGJACt7bU1EU-1Cg0WaA2LhSQo1M0yJKykgTzzNuvanYCwc4SGa7xjSzklYPgvIlkBd2dF_kNjMSH2r0gWJytqtvrDIFBL8vlec4wqbqd8vLwz2CxMzQSMxlmtgIpzLUW6Ju4n5Umw0Z6yEO71-BACUY8fl--H653hrev8qSbhtfTBM4eE9RsS-jFbt0Ty9MJynDpt-Y23Yjc3N8vRkj_sLTywY63zPKjVyZkAn9njydDD3pbvFV8vtJ5wFZVn6aM2O5Ms9FpyKWKSOKk2AaE1MFjuUbEWpK31udmTK9AO_N6BFK5Mv7ukYqCzhcxNtFVkuvSEDjNh2DLgaEHUUNXg4nvACiznYghXWuCMXOSwZpvmuXlW6Ged4M-fsshf3Zy_uijv4HXCOxhasRBxMUKSHMDovvaWZJioH6ttdU9EXcP55w8VwLIq0mjkz6cjfVXaXrSK-0dTNiiB_WjIQ7vu2LfzRe3cTHOrMizCiLOuXPyv3zPrYyzdNeNJjbf-ZszhKlB4VPoghZFnV0hTClLCneAh_OCvq9RS9AIXhLwqFBIzVSd_Qs0UD7UUROCBHaaunP6Q4-0FXXIKb-T2-nzw-D1H8ObZ90UF2o7cGmAUKPp6WunOPJ_9bAVEAwoMX6kj8oXF0J1_mGQ-VyetIKaqqOiYU-Xjyta106TDKWqsrCL_7pQ6O_bLCFAdSlraZ6vbzxKqCDmRnpM4h9OFWln40UUi4nV55HyDMzXUfNp056Ok5VGRZ5Q02ZXWi0dLcetygJNiwHa3_7cvQ_4VjJUwPXqF3Xa3yCOvTY4OlxYuUequRi0aoAM-aINWcJT8EAMyNaXt0jnwCnOpq1VOnsE4ykZn_ZK8fDa1lLuF716bkuTtajyo_83S9SkxFa9-VStle4IcPEDom5BFVGvFoOTAlvY54PlTuO8HKYrtM6QCTGvsfsBPMScKV4w-NuGCaxqwvXCUYDMLjZA4FPlYlzXHgqDZDPJGLNNNKTMdtzIDiWEANS_OFwJ6ZWOJfN7T9YHb1Icw1xDU_dzfHGTir0q-j4XkX0Lj2esbZmkXIO-XjZa7iGiz_VGa0d_rJUewcOxk8hZDNCn-TWKr-ftpRR1aX5MJKvgLR1j702cw88wY_DFjYFECcIBFxK_xw5iwImBB9fotF5o9szl1ma4X4IIIHyOSIop_WfuQOM2kHKMcMJiRpTvlGBbMx-Ga8MmcJoQrTR15jDuRvAeB4KMUtKYTGCgX1Jj1anlOnY_5Aq1Nh267TxF_Bja8YEXdQH1-t8gB4xt8TyniZfxe2_51uoDEyUbOKPouVw925CAYV9FVCxvWsIbNLBTFQdcPPteXv3UO7iJRt_DhuV33dzCi8KEPvPy5gAni4wsuYZ36FvTW9EQgbFU94ibO5cgDyZraoELlXREPs_Obw9VF4VSxD4SJpLGPkw3zIca9QD3kOz-6Zb3O6QS9620VkdiEW7pdcqrWhGkKrit85d6mlr_3QWR0EhXJuDJmXiGb23rRRpsfkDmifgyOOhejQoYo3eHiHabG49rdo2dwRI-QyVMzgu2giLv1gV6QjGA2OleKKv1fZ6rMQFacdayv-zFthb7H_Go8BznEq-AxKgMbVNe4r1rt9FxxCDW0_6KMCMycpwUr5HTt1xgMi5v9xoayPzsz-M6MYMaOLPLcdDq0dCoS4Lq3W08cXPSkdwcM_8eCNyBrjendey4QfYm1GEFkoTVffD8Snt0NJ2n7YIh3D7LL3DbSfxGFSdZo9qGHkUq6OdmDW4HYQ6qZDB7Q6psImLNThmtr-HPmF5WlU3jSvfFdnAQy5JqAZvaGj3lwsxMS22n1KPu3_P09_EmmZGD2MQg3Gohp5gws7ZQAKOkYrDGr64op8OxC26BD9NHaVxRpGPREhxXr6SKNiruGs-6tN9sIR_saWL_cOxYE1weK1Kfn_QZJEE8G1zdfscCDeChmb4MetwISrSVN6kA23yEGKq2dgHDY6jaY777mrVbxXBvug4MgBienElp3nsLW_SMrtoezFLzESLxazwf9mUAB9Fcp0EXpvvP1HSoNy4zrZtgmBVt0W-XTTiiqWRkCACgUAwJm6syt3c4bvJuWBYJFFquP_Z1_lQDP3VCdiiFnCcuAWe-k5hQkeKb5i75QoGoRHuqshF0uaz9-M8o7q2rNL4XNeDWP6W_CCInlpaWivIXEauBNzxvDtifDBaeTB_ccMhMH4RBnrW3gvEyiWC9MgX8YOTahWqWsZzQE3g38foZSoEQStdjjTwYbz2mSws6_Q3ZQgZHvC4JjQD_E8GjISaYIzB6QPyOirGIwk_-4GxBywp6MVkJXoQkAMJG4Y7MTVGtIkf27QAG9Sy9QJisibwrXsQqrJ2J2YPX8Q13Zhbrmgvo0qZ2Ea6uOuLYu0A21HA4w6pRr7PMFKAFzXq_zweJ4LlcbhTvz_StYFlXMzb7T9RiP4MBauuRIlIi4T7exe2ZtsUH1WpLlWnWPqAsXpBN3kCPiUBuwZBkdWUhJmfEkRdElRQC15XG1Ux7KZfMH24gouDod_E6ztyA4la2I-v7q1wC-O69GhhrJXk6aDLJ-ALnijB0VcHyerhA5NUViXanlODjdz4cYlHH5nRacoLINRp98ZDr3h1NFBY896OonA91b454bK9r2TrVzBIgLqjqqHef5mrCVzIc2qo9KAuszjCqe87GnwLmlPVPb_8SHbR59g2Et5sL8NinD4V-GVaESoiMDWhHXQLqLaAYYuiUFeZpEt2IAcC9phv8grrtvodAGJ5Mud72Ca_5CGuw2HAWnp1RqEKXW-lku_vnv1I6D7-zGRGdhpmSuliSFuPzO85sEdDmu-Q7uPOCvm6SIDDRDeBL5i9HARiKc3QkVzfSLsES6JSsnMFMqwiymy0WDPE2eH4RwHbU9rdlP4UhDu6MbquGE9Ay4epPxqgPBtiC05RqLnZGzSKJ77T3wzxCjXx9pmDVpnsCHneO3M6jFpAZKYxkyDgTaUkzhB_1jac-a0tsVSXLyIkiVR6OYU3F_2CDg02w4moOdrDgfFQD-oOj5fsXTsDUcwevjIDjHLP4RT7n7o5eANbBPqKmzWhOb4qx0ER_eoRD3ywYpQhbnoAzE8QqeG7V58X8mxo0v85Bo8tlcXgtKHeVnScnvhCPoj5at6TsF2El4FJp7IlkzX0AZNiiA__bNoD1LAv6U46uZ9DObnB7hei3S4a_uBHhFthpBCAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAFgAQ&cry=1&bundleId=&ias_dspID=3&ias_campId=1010526756&ias_pubId=pub-8601585505701947&ias_chanId=1&ias_placementId=20251344649&bidurl=https://www.ensonhaber.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iEqMJypu02CUY8QhI5ejFC&adsafe_url=https%3A%2F%2Fwww.ensonhaber.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.ensonhaber.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:fe83c85e-6a84-4a6f-13aa-cddf127f38ed,c:gcDhzq,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5958d7d477-8zgt5,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,scm:rHRbA1,mtim:6,mot:0,app:0,maw:0,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:41,oid:7c5b7473-106a-11ee-996b-22b8ddb3ee24,v:19.8.421,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:21:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 0C71 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 829
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:34 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C71 0
0 45ms
45ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstsskhaPYnF1lmw0c8bki8wtUt3_IpRYeNluTCeJl7gYd498ujALheTJVT2IB-JP6zh7INCN-uHnomk6aEZv_JDTUvBD7rqdAGeKvjjDLdwT5aKRWCFE92fdzB4QuRzIJ1l8B7GH3A3fLPmJYtbWN_37p8HLNGKEftFNVf4U-lbepaU-0A9n7Xv9uQ9TfaFK9X61G0F61d0Ud3HYaQsP1XS8aDf&sai=AMfl-YS1wWOzIABopj7uSJHya-hAAlQnJGtA09-87zelU_64ZTmCYLDqJ9IdxVtHAlyy1stA1HCrBuEBEtmqphnIluyWdkcca-lxK-4DGE-Svgu-hHI-t2JHSqFxEH9ZBx2l3gz9JZeaDtC8AKjEclzQ8T9mOg&sig=Cg0ArKJSzGuIBlSteg54EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230620.24908&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3 200 16214054782314436997
s0.2mdn.net/simgad/ Frame 0C71 52 KB
52 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/16214054782314436997

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4521175a8b7a60fd7d7ca599212a6e15dfde0f747260f53584961befc21bdac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 19 Jun 2023 09:41:33 GMT
x-content-type-options: nosniff
age: 208310
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52770
x-xss-protection: 0
last-modified: Sun, 28 May 2023 18:07:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 18 Jun 2024 09:41:33 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 18ms
16ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.ensonhaber.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 24 KB
11 KB 346ms
346ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2752916905154317&correlator=596431764896915&eid=31072019%2C31074947%2C31075507%2C31075338%2C31075340&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fifs&iu_parts=9170022%2CESH_DESKTOP_ANASAYFA%2Cmansetalti_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C970x250%7C970x90&fluid=height&ifi=7&adks=902017448&didk=953221528&sfv=1-0-40&cust_params=kategori%3Danasayfa&sc=1&cookie=ID%3Dbb049b8a1eadb93d%3AT%3D1687376002%3ART%3D1687376002%3AS%3DALNI_MZVYL1DCZhOJYjVwDLP4vi1gd7cgA&gpic=UID%3D00000c4ca10b5e2a%3AT%3D1687376002%3ART%3D1687376002%3AS%3DALNI_Matosp2MPvZVgv269h8KXkq8pr3Qg&abxe=1&dt=1687376003977&lmt=1687376003&dlt=1687376002004&idt=549&adxs=315&adys=1234&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.ensonhaber.com%2F&frm=20&vis=1&psz=970x280&msz=970x0&fws=4&ohw=1600&psts=ABHeCvjeWlXAfP4IOU0O_RBwfJstOXdoNX8rLqkdCSJU9lLn&ga_vid=1137403029.1687376003&ga_sid=1687376003&ga_hid=829601041&ga_fc=true&a3p=EsIBCghydGJob3VzZRKsAWRmQjlXT09yaTZEMVA3dnd5QUVsd1paU05vOHZEQjhrbERQbmNlK2JwNXlFemhkQ2tHbkZDNEp6aXNvQmlxUVBxOVE1MndIR2xNSHIzdHhpNWZaanRqSW94Mm9JczIzVElabi9XS1JlRHpyZFU4d2lEYzFzYkUzUm0yQ0MxUzZMNVozNFB6b0JLb0JkRjFib0JaS1RnRUN1cDdtTHFuWXNCVDM0cS9NeDV2MD0YnIHK-40xSAASHQoOZXNwLmNyaXRlby5jb20YkoDK-40xSABSAghk

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba6f4248b6606355f0ec65156d57203c548498013992b2806a776edab1d40a6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11538
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6273 17 KB
6 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8620 1 KB
648 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 13:19:10 GMT
etag: 48472445140208031
expires: Thu, 22 Jun 2023 13:19:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FBB0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c27495eccd08463663385ae4ddc305e621dd1e1fe7a05d710733b0f388e6ef9f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24E8 0
26 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4094770207436&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24E8 0
26 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4094770207436&version=m202301230201&ct=76&x=1&cor=9966132341682260000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 24E8 75 KB
35 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoQ65R8PzB7cJermVIMviVeF4yf5VanrxhC10xxvu0jatnCqGI_CSum3fMMkJ_iBaJOTb8ggrfrA4NKUXPZj-bDmYXkg&cry=1&dbm_d=AKAmf-DZKpGVYHL1WSdOy5MLIslC57AzRmDjvvQV8qBDg5Yr0D6NhLEbBK_csZRSdEKMk-D0Fk4APCoZCRPCUZFEh9ChhINm1aTuSXzLCKaSGGp1XLADFsvqB7vF7MYsHw5FKzI4ZyZp5k18MOT41QuYobqJPuy-7FYQpJN7rO52UYE-OAg-J9_oeP3D44w9m6gmqz8ky-JFE4gs6XJ3Hhnyxd3n2iJUYSaspGmWfG4prSRyw6uXmue_7X-KGpBaMgHcl2mz3cTgJLZDhWOw4AYVR0lyR5nlx-GknK3pyNKZgFDGlNuZT7W-QPOQtSd8HpaDhPrnzExb1c7BaMiSb8gSt3oWxZOukHeMk5i2upQuyDoWIsLN73D8qMdSB7I6cTuXSe9b-J2UqwhGM8bHZMXtVyWUpF5eiBgCO4yGu0x8WTH4ebuoryygqtLs1aV4F-U9CnJmGOT0ITSV3uqxrjyt-RyA2ANsLU0z4svkrhvfWYpJda6C2e_NbiXXXIduJCbgsHaml1Lj4OqTm6frBS8NWoDDj0urfCV2CUdEmkUKWxMaboze0jcqIkv4LQ6RqGr5oQOez_3_gzNxOaXD47qhFbvh_xvIU-CdqXHHEBVHqRYPZYTuWUrF_X7eSdPHvTUgxWS-EYfB7EYWj4aJ6p1IFXpfe9x8XS7D6OW3PKG_WrAwgSfm-rfH7AwTeAtEbP2G9n1G5L3dWNN8OjI9RCb-yv2XkQqxbgtuPid7H21rgU3Zj3Xqt-H5qFGcT1-9Dnbxi7BxREFo7n_ZZtV_e2umLXMsOLOeaBvGTgu3q8yTr5iHHyc-z9OGIYXLgbqfCrDwjhQK_vNLMzVRsdmzaSO3jwSXk0H5ZmQiUD82JK74bY9fIpBNNbA7oyrUQqVHTLMa8xvyc5SVUYY55NWo3n7xkWYNeC4-varkMHhsYrCNnR_vjN3rJYGuiQLEPEs1X6etLrQEkB4JgWn9xz5vPkT_GIsgCTQAt_CjYWnwMX1mk5pwDdHhjymcRKHh990uXVwIt8bEZC-9cxJLLviFYTmmq4NEFN-xCzkNQtYzzuVcqTfJLJN6zKKYn_J2IikAkdkV5r3wIwUKmNM67eCoP1wT7jGBzYkr_Jf4KY6D4fdezh0fdFtMwS1zUlOeK2BJlq52BLmNMXnaK6DBj1WBbHxICw3_lMpLWYZL_cLwW1beGNvlhvWIJVU9qB0gKiufrqoOXk0nsNU3qPAoIwF7k8upi73zb5jW0JUGhzbiKTJliCsjErADAswb107yu91San3jLChdNe-187DaozZ3V1x7-2CeZ-Pu0wYCPVyGOGm4xsOKeH0sb_dzLbFPdB5RF2n-sRvqOgGObCI8vYvGituvgxJinAhtDJQoWOmOJo6OUes3aIkBQIYg5WI_g6xXtWKyGsyWKDEYMo0W48gt1-lHUp3T1-a8Bt3kSgdBBODoql9lvCnRbefbgg8nGxjLGzagOfGxqtNM0_LhkHbBjmchbCsACxyBtXi9tl_qcjtoNOAo3nLVTsDUeOn7Pt-XVB190V_D7w3ngzQKOrC3ik9wVac-KBojYnCsHPGLdIa06iwjmPgJeBr8TKCzslkV_EWwcUsAAaRw_bgJgzU_D86xhRjMwDeofBBEU2_LpUDnIDDFFWCBGWTXLkzpCyBXGgYVz9s8PaaQIluNiQGuhC9EiO4tQ1orGkrPOpgtbMnpzx5tE3rtlFHi6X5EYqFwF6njbuL7DeZt-Mm2414UVtzo_aJhaL-FAU0NAeQSsgMshtI6oyZsneBLFJACwuEr3FhGZgFRDVRfIu7P9neq6D6st3PdDnVN32cuQoHdpufL0FJlo7qIi7WzV4uBbfdHU9zFgkJaLXLHp0-GM1H9lCuNNSc2dfXH5Lj_uHn7K9m_Byl5DY9Av42eTJZlUpR-8mGxAenJlafakHEWOB8qTPpRAdAEZ_Ygpi2P6D_g-XcJEE0mX426EtQTNxoL44HWalNbMuGEE1rS9RIP5Zi50i1f_sZ1TU5Su7jNs3cq82HKhgTKqa2EIJrN_DURPQJdFGSwhwB2bctmFnvIO2UKkQWaBBCyf14bkP7u3pG_sfT2C5dEUedsJBUgIGMbQDdbQ7Vi6PGmSylTAIg5fyaUnGIRE-dq7_GaRAcxe5arOTZ58Is-CdP3iSMS-VuKHzlRWAUgHMphg0E6loMQlbXRuhgXsBSbZGr713ESL9h_GGwwXTMzFElQa3W021fxTKWbSdtH36ezdU6nB8jva-HUizRjgTmPZFGayVfxTle3P5IVx8BM_Pk3yEzbS7VxgqZuj6kgrfwhrALh5bKIzSoDTGgJIHMOqS2ohrk2BWUfsqoUlwZcxP1rup_8i07AuF2pDUswkFaZ_qskng_agReSIY2aq0svh_IaunrxchYgGSaENP-lGB6kLIiZDpmDgEZ6vWitmKAQU2fFiaFVZidh7eSymtj2275bW3xfm_sNhcjXAWXwQnG6H45_Biq8dUoLRCkyWbM2rz-r0skCYOO5zib-6PM3mRB_kyJ66QHCxl9qoA9qbIqB5iQ0ytB5IfP_VsnG_zC1iGueJ3jG57l_P_QEWawK5rzxYHYMRiAAkBMBNNOhYYhpwCW3Cp9KgrGXCg73l9fHrfOzcc-zpYUnOthFYBH2uBS_4k0lHF7c4eHnTuRexQ0oy7tsVDC57Ugn88pca3YZMWKAWIUmVH7HXdDfM-n_AN0ZogxJBeBGBphAGqiGUqKs3o0cX2rA1QctUMpuaT_8Ss7qrCw8xb0mOGZGMMazND_yL9R4Bci-hT2TycdH-RVUp81Kab_aK8rxJoLpBtsn-SYl2ESdr1NlP63ttExBZNICJqu6BMkiuBkc6ugz60--HACjc5USSj-TZCaN7jC9HuHaNYpmcOjy55umQbK_cH5JpkUIQL_qFXPAE-Inky2WPoypKaJFI8AQdT_JklmVHULVHDmIQYXhe46dMfc-Njzj7hNtYgZ9g1NvZnkZzNc9m3aOvs-AKyEqRlUD-sMEhX7yCN9wK4q7f0q0T-mrNFEg57VI1ZAGsTZ-WXr8ChQCCdjObJJ6n7eqF935EfiBYSohvRlcTIpIMGGA99Up1j2FEBJetluz_s0V2K7Kw6aEINPxXN2zlCSe0OIq9zAOS8OeC6DFkoPnyGQ95WMsxFYPowVanvbAmYnwE0GacOVNMRQEwWCxSY9t494aWwS4-1KKSwJj5pGEnQ4wSUktr670cUklwMUBmXqUCaWuT9Hu-F5eS9DwvCy5TChLKCvWjMBcFpFALun30mqTsD_EIWWqbQXgbYFBJUFPZB7H0vClvcDqEhmwDu6yOnu4EEsNP7Ei5QgO2EiwPmxpm2WcVFZOZTSXCJ3APoaEaGcQnbP5EAr_fIQG5hVhjNP-gZHgwrfVbILyavsKgQL2-3FjrzINC5WNbgvUEB6fYy9QJPgjbULSDjEPJzWoy959-naQZ2E4ysLhoGOP0tU4aQJt64_hhfhLACxvPcCJqGb4QfmQsVWIFD_6RIJoV0wiNfgjTbgGnGilHNuETGjBpBH1Nw_Pnghlwa5XkkaCxQopkADiilOUMypm-meYUXL7vS4Kh9FLAS408q-nLQPnrOoy5wJV989g7_a7m-VXfOTbODt9K5djaNK5LGQxvZCuYFIQWoeJA3GNaIR8QecjJw0YYyiMvK4oVblsNOAGbCL03qF_bmT1jeb4bAk9vAWnFuHIrZj-&cid=CAQSPABygQiDDcubzUPIUAUR-cENsgp2an17qPunSIBQsiGo245MZSuSKj2bVpmDK4LoALP91lZDmeIRLtTMcxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9966132341682260000&adk=3047537735&idt=91&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af418d23b71632f7ca5a43aced8c8ecf1d3e577ea866aab2cffbf6c3ca7d690b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35585
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D00E 1 KB
648 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 13:19:10 GMT
etag: 48472445140208031
expires: Thu, 22 Jun 2023 13:19:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0C71 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae8d2a30192388badb421ec0d60e4eb6a691164a1184dfd1dd956e5878993bb0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C71 0
0 46ms
45ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstsskhaPYnF1lmw0c8bki8wtUt3_IpRYeNluTCeJl7gYd498ujALheTJVT2IB-JP6zh7INCN-uHnomk6aEZv_JDTUvBD7rqdAGeKvjjDLdwT5aKRWCFE92fdzB4QuRzIJ1l8B7GH3A3fLPmJYtbWN_37p8HLNGKEftFNVf4U-lbepaU-0A9n7Xv9uQ9TfaFK9X61G0F61d0Ud3HYaQsP1XS8aDf&sai=AMfl-YS1wWOzIABopj7uSJHya-hAAlQnJGtA09-87zelU_64ZTmCYLDqJ9IdxVtHAlyy1stA1HCrBuEBEtmqphnIluyWdkcca-lxK-4DGE-Svgu-hHI-t2JHSqFxEH9ZBx2l3gz9JZeaDtC8AKjEclzQ8T9mOg&sig=Cg0ArKJSzGuIBlSteg54EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=134&vt=11&dtpt=133&dett=2&cstd=0&cisv=r20230620.24908&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4323423352959208367/ Frame 7118 15 KB
2 KB 16ms
15ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0486d620f8c483ed0fa8b56edfef5799ede455138606b4392604174847199be2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2272
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:24 GMT
expires: Thu, 20 Jun 2024 19:33:24 GMT
last-modified: Thu, 16 Feb 2023 15:59:28 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FBB0 0
0 66ms
66ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv-XMRnBQEHXPy2SE8_CHvSXvuf6CfSCTutW_OuVjnkI73avMwryAZTQcBpn41t-w4K-OCH4fPIQof1t5JovwmgpU5F1zPk76x1coi_FIAyz8zOPBQgly3LNxWtURTdxZSBfSAs3kBwp6i7LjKFVUOzVkCgQ8O3C-qijeM0FDBkoPOA5oOYbmYRiDLEDGYWUK3J5n0NhNFGZittlhVIVHenv0ljK6YruJIz-V7cMVv4dS7expXOhWHboKF-7hRr2p3CeERicy-UnbJxemd_55zzolLiMkGAXH0uvJ9rIn3uf9QAriDqfv_4nbjT7gLW3BUP5D5_lo84O0pK6r9odmpp-O8nr1Et77IYl-oVHBt1mqLd1vDKzIWrA71n0IRhsdb9C31BayLduQfbDLStEHnZIFlPfw761KCy4akm-lYOOE54YjJrGItCsXcygZ5bcG-tDLqbVvEN6vzOG3yFIN4WzpUj_n1Nw1O8IiwUo12E0vohRdSxnMyxlfjM8yS4LKZq1A1_WSXpDdwGMdOTxGE-ppezTMFnPyOkwujQR9273D9vnknuIQZ1MK36s81KaUGiijhbDa1_LTVLox3Mjl1MAT2y0Z4K6oxc5TOL_vesxbvSl8Z6U8anX9BQ4t4KRiGNQ3h2cqOcdslIr0m2jjx6GI03WVZ5oXG6IlTjrW3B0Ikiy72rqwx_KCM5MZOoQMbT9hiyDUnB9vvUTAPD4vMgiFoaFgVeZW3oFjbpNHSdgMpLavoPR1ZFINliuNs-53Dqjxwe2pD_0GSBwDMeQxRu1R1mdbjKSIERkYnePhgvVG3EDYl_OJcUpP8Bm54cRalU3pYD3GRlkUv5j-DRquetP9DGwUalCVLnesfX4KgwVAtFQGOemrkyoX11vdJV5robkN9z6VmRvs0w0jRh1fzuEf7tr-gcpzuRBpyI9ysDzjCg4FH14SBRpZZ6HMl1uIg0LIkx_krbx15uKZ4p3kYtgA7BgOpbvvgN4sdf-7lgwhNu8NlILGPlqPSG8ba9DsCNCaanDOL5cssx1zxXBWIWWurlaqYpI3xe3hAhh_1EEBFUAX5Nj9Loya7JoY75FR3WS8F-4JkR5j54SdT44VsoMMEkQs0Yv9L76EjNGiSLCY1BboXfnkCn0DxK-Ckl43ZchoB5YtllJVm6drfVktnLWWR0pw7e0NmaUmdX-kenvGnp72qyEu6ltrcsXkEYRAjk960a-65uj46h5QYaSphJqPMKcwMTQo8tDk73KrYSdTzP2pBVI5kWd1DhCkKRL5u7-vOYCCmk7xbGvwFPtPLMJcTih3TYzo0ittSw8qiUAfcDsUSMRcAyE-21mOIkaXjkPCU&sai=AMfl-YQtUFi62EmqBWnRAEkyfDpSFzObPfBHSWw0MkjWLhJ0nKuQxKiCCV_1OENjSOjlHf9vAYySS4ODPtAt-_e7ERGfBsdDekxYPsb4904faeK4R18lIm3WfumtwIh_OfaOgKO640lXWKHGnNqcGozAQPvq4NF5BVKZOPGSXNx7EEO_T0RM_9rzXOmBnABVjoMSVbNZLFrDvS1WLP5vRq1iwzJclJZwsFJOygmThr3SCuPMGFENC3aDGRisG3I5WN-E3y8OxUA&sig=Cg0ArKJSzN5sw4oOpJmqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=185&cbvp=1&cstd=177&cisv=r20230620.46141&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 8620 35 B
465 B 46ms
9ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPOsofimrni17tVMcjHNXYQ&google_cver=1&google_push=ATf1kGNpd6WC1SZLb1Y9vT1rKMOCCk_myZtyEO95hsE1b_23K5LWAML_7ag02L34cYffZNuX__er9TsX-4uezpuJGkm-mVQh__EFfw

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDiWSYuYbYmH1lcDlGQgg14&google_cver=1&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayT...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayTWe90F7g&google_hm=eS1nLllEYWJCRTJwSHNZ...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayTWe90F7g&google_hm=eS1nLllEYWJCRTJwSHNZemxSLmxkNUJaUDRhLjc3dUtiRX5B

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGONVVJJJF8J2ZIDgst-o0Xuk3EBD7o0IHUmVFryjnEESJ0mBIuqW2ZiMfnJ56JJ2zd8okD73kUsKYeoNVyLymQyayTWe90F7g&google_hm=eS1nLllEYWJCRTJwSHNZemxSLmxkNUJaUDRhLjc3dUtiRX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEJxkjAC0fMykj4wZAXJsZSI&google_cver=1&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLH...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEJxkjAC0fMykj4wZAXJsZSI&google_cver=1&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_bl...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blips...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLHUKaVNg99CTvgO-boDhWs

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGMigrt8HtrP1oGsis2HJB_hjnWqIiA_RQW73CYuaLEGtiiezHM1-_rklwCFXePlAhk9_blipsLHUKaVNg99CTvgO-boDhWs
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEEEds9Q1A5giMFNto6z0Hng&google_cver=1&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEEEds9Q1A5giMFNto6z0Hng&google_cver=1&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3Qi...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNa6fTTge1B1cyT173kJT92zKCiOKawhsRd5HmKnSNV7AJ09-IGV8ceIZakTpfedC_KiQuaNA1PIV8alclG9z3QiPy7ebAypw
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPevhlU4LD-1NYW6L-XsSsA&google_cver=1&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpg...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo2NDNUS1EtMi1KSURV&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpgClTHAbgVIMqrjtVObEKEEO7Vt

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo2NDNUS1EtMi1KSURV&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpgClTHAbgVIMqrjtVObEKEEO7Vt

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo2NDNUS1EtMi1KSURV&google_push=ATf1kGPI5bNKNzKKbnwEhkgrzO-4BvHH9sRX1eVIrSl-dSlP4jWxjXVst4N5SHlANwq0YrUKEpgClTHAbgVIMqrjtVObEKEEO7Vt
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEPCTfjmLHit5BFeNGrSJRZk&google_cver=1&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w&google_hm=Z2ZkYWUwMjVjZGMxNW...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w&google_hm=Z2ZkYWUwMjVjZGMxNWE3NDJkZjQ=

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGMLE-08ydHPdjLMA6CybFl_Uf0ool9Yg3yuNDglet9JsFFbgfN1qDoethXgtSsQfbOyXJnZUD_HKacE7xE8uF4dek7sgwQL7w&google_hm=Z2ZkYWUwMjVjZGMxNWE3NDJkZjQ=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8620
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=google_ebda&google_gid=CAESELy5VNKY31HKkyhS7klTJQQ&google_cver=1&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPe...
https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg&google_hm=WkpOUWhNQ...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg&google_hm=WkpOUWhNQ284WW9BQUkzVXJqTUFBQUFB

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 0
Date: Wed, 21 Jun 2023 19:33:24 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?google_cver=1&google_gid=CAESELy5VNKY31HKkyhS7klTJQQ&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg&proto=google_ebda","cluster_id":0,"gdpr":true,"ipv4":"0.0.0.0","key":"ZJNQhMCo8YoAAI3UrjMAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad190"}
X-SO-Key: ZJNQhMCo8YoAAI3UrjMAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad190
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ad_generation_eb&google_push=ATf1kGMJAnx9zr4RBoIbsmNukT2RQ9LzWMGw4u0lYiyo8X4lmyO04Gq8KaogbJ-lihkP3jPk0fCPedezqBQTk80txR_8oLT5pCSCBg&google_hm=WkpOUWhNQ284WW9BQUkzVXJqTUFBQUFB
Cache-Control: private
X-SO-HostName: m-ad190.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 3
Content-Length: 0
X-SO-LB-Hostname: m-tgng38.dc4p.scaleout.jp
X-SO-IP: 45.141.152.72

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8620 0
12 B 15ms
14ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KQqBhP2y12DbIPErEL9fwBIvdRIg6ybKcxcrGs180iGEtkGHUBV1yInU37r2S84FrYGtgK

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js Show response
pagead2.googlesyndication.com/bg/ Frame 5D7B 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

999415a508fe78341a8e9bb9f55abd136a4cbb7dbf615028356efd2c023a40c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 12:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25238
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14716
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Jun 2024 12:32:46 GMT

GET
H3 200 1676550659977.css
s0.2mdn.net/sadbundle/4323423352959208367/ Frame 7118 9 KB
2 KB 8ms
8ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac546194565bbef33495adfd3072005ecb03e2563f484d0228435a8c4ac42f51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 02:05:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 408495
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2321
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 15:59:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Jun 2024 02:05:09 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 7118 118 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20448
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:52:36 GMT

GET
H3 200 1676550659977.js Show response
s0.2mdn.net/sadbundle/4323423352959208367/ Frame 7118 20 KB
5 KB 9ms
9ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cff8001763a4cb0cb81352e07fb9927790673baaeda29140c072f30c5933cf10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 15:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358782
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5491
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 15:59:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Jun 2024 15:53:42 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 24E8 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoQ65R8PzB7cJermVIMviVeF4yf5VanrxhC10xxvu0jatnCqGI_CSum3fMMkJ_iBaJOTb8ggrfrA4NKUXPZj-bDmYXkg&cry=1&dbm_d=AKAmf-DZKpGVYHL1WSdOy5MLIslC57AzRmDjvvQV8qBDg5Yr0D6NhLEbBK_csZRSdEKMk-D0Fk4APCoZCRPCUZFEh9ChhINm1aTuSXzLCKaSGGp1XLADFsvqB7vF7MYsHw5FKzI4ZyZp5k18MOT41QuYobqJPuy-7FYQpJN7rO52UYE-OAg-J9_oeP3D44w9m6gmqz8ky-JFE4gs6XJ3Hhnyxd3n2iJUYSaspGmWfG4prSRyw6uXmue_7X-KGpBaMgHcl2mz3cTgJLZDhWOw4AYVR0lyR5nlx-GknK3pyNKZgFDGlNuZT7W-QPOQtSd8HpaDhPrnzExb1c7BaMiSb8gSt3oWxZOukHeMk5i2upQuyDoWIsLN73D8qMdSB7I6cTuXSe9b-J2UqwhGM8bHZMXtVyWUpF5eiBgCO4yGu0x8WTH4ebuoryygqtLs1aV4F-U9CnJmGOT0ITSV3uqxrjyt-RyA2ANsLU0z4svkrhvfWYpJda6C2e_NbiXXXIduJCbgsHaml1Lj4OqTm6frBS8NWoDDj0urfCV2CUdEmkUKWxMaboze0jcqIkv4LQ6RqGr5oQOez_3_gzNxOaXD47qhFbvh_xvIU-CdqXHHEBVHqRYPZYTuWUrF_X7eSdPHvTUgxWS-EYfB7EYWj4aJ6p1IFXpfe9x8XS7D6OW3PKG_WrAwgSfm-rfH7AwTeAtEbP2G9n1G5L3dWNN8OjI9RCb-yv2XkQqxbgtuPid7H21rgU3Zj3Xqt-H5qFGcT1-9Dnbxi7BxREFo7n_ZZtV_e2umLXMsOLOeaBvGTgu3q8yTr5iHHyc-z9OGIYXLgbqfCrDwjhQK_vNLMzVRsdmzaSO3jwSXk0H5ZmQiUD82JK74bY9fIpBNNbA7oyrUQqVHTLMa8xvyc5SVUYY55NWo3n7xkWYNeC4-varkMHhsYrCNnR_vjN3rJYGuiQLEPEs1X6etLrQEkB4JgWn9xz5vPkT_GIsgCTQAt_CjYWnwMX1mk5pwDdHhjymcRKHh990uXVwIt8bEZC-9cxJLLviFYTmmq4NEFN-xCzkNQtYzzuVcqTfJLJN6zKKYn_J2IikAkdkV5r3wIwUKmNM67eCoP1wT7jGBzYkr_Jf4KY6D4fdezh0fdFtMwS1zUlOeK2BJlq52BLmNMXnaK6DBj1WBbHxICw3_lMpLWYZL_cLwW1beGNvlhvWIJVU9qB0gKiufrqoOXk0nsNU3qPAoIwF7k8upi73zb5jW0JUGhzbiKTJliCsjErADAswb107yu91San3jLChdNe-187DaozZ3V1x7-2CeZ-Pu0wYCPVyGOGm4xsOKeH0sb_dzLbFPdB5RF2n-sRvqOgGObCI8vYvGituvgxJinAhtDJQoWOmOJo6OUes3aIkBQIYg5WI_g6xXtWKyGsyWKDEYMo0W48gt1-lHUp3T1-a8Bt3kSgdBBODoql9lvCnRbefbgg8nGxjLGzagOfGxqtNM0_LhkHbBjmchbCsACxyBtXi9tl_qcjtoNOAo3nLVTsDUeOn7Pt-XVB190V_D7w3ngzQKOrC3ik9wVac-KBojYnCsHPGLdIa06iwjmPgJeBr8TKCzslkV_EWwcUsAAaRw_bgJgzU_D86xhRjMwDeofBBEU2_LpUDnIDDFFWCBGWTXLkzpCyBXGgYVz9s8PaaQIluNiQGuhC9EiO4tQ1orGkrPOpgtbMnpzx5tE3rtlFHi6X5EYqFwF6njbuL7DeZt-Mm2414UVtzo_aJhaL-FAU0NAeQSsgMshtI6oyZsneBLFJACwuEr3FhGZgFRDVRfIu7P9neq6D6st3PdDnVN32cuQoHdpufL0FJlo7qIi7WzV4uBbfdHU9zFgkJaLXLHp0-GM1H9lCuNNSc2dfXH5Lj_uHn7K9m_Byl5DY9Av42eTJZlUpR-8mGxAenJlafakHEWOB8qTPpRAdAEZ_Ygpi2P6D_g-XcJEE0mX426EtQTNxoL44HWalNbMuGEE1rS9RIP5Zi50i1f_sZ1TU5Su7jNs3cq82HKhgTKqa2EIJrN_DURPQJdFGSwhwB2bctmFnvIO2UKkQWaBBCyf14bkP7u3pG_sfT2C5dEUedsJBUgIGMbQDdbQ7Vi6PGmSylTAIg5fyaUnGIRE-dq7_GaRAcxe5arOTZ58Is-CdP3iSMS-VuKHzlRWAUgHMphg0E6loMQlbXRuhgXsBSbZGr713ESL9h_GGwwXTMzFElQa3W021fxTKWbSdtH36ezdU6nB8jva-HUizRjgTmPZFGayVfxTle3P5IVx8BM_Pk3yEzbS7VxgqZuj6kgrfwhrALh5bKIzSoDTGgJIHMOqS2ohrk2BWUfsqoUlwZcxP1rup_8i07AuF2pDUswkFaZ_qskng_agReSIY2aq0svh_IaunrxchYgGSaENP-lGB6kLIiZDpmDgEZ6vWitmKAQU2fFiaFVZidh7eSymtj2275bW3xfm_sNhcjXAWXwQnG6H45_Biq8dUoLRCkyWbM2rz-r0skCYOO5zib-6PM3mRB_kyJ66QHCxl9qoA9qbIqB5iQ0ytB5IfP_VsnG_zC1iGueJ3jG57l_P_QEWawK5rzxYHYMRiAAkBMBNNOhYYhpwCW3Cp9KgrGXCg73l9fHrfOzcc-zpYUnOthFYBH2uBS_4k0lHF7c4eHnTuRexQ0oy7tsVDC57Ugn88pca3YZMWKAWIUmVH7HXdDfM-n_AN0ZogxJBeBGBphAGqiGUqKs3o0cX2rA1QctUMpuaT_8Ss7qrCw8xb0mOGZGMMazND_yL9R4Bci-hT2TycdH-RVUp81Kab_aK8rxJoLpBtsn-SYl2ESdr1NlP63ttExBZNICJqu6BMkiuBkc6ugz60--HACjc5USSj-TZCaN7jC9HuHaNYpmcOjy55umQbK_cH5JpkUIQL_qFXPAE-Inky2WPoypKaJFI8AQdT_JklmVHULVHDmIQYXhe46dMfc-Njzj7hNtYgZ9g1NvZnkZzNc9m3aOvs-AKyEqRlUD-sMEhX7yCN9wK4q7f0q0T-mrNFEg57VI1ZAGsTZ-WXr8ChQCCdjObJJ6n7eqF935EfiBYSohvRlcTIpIMGGA99Up1j2FEBJetluz_s0V2K7Kw6aEINPxXN2zlCSe0OIq9zAOS8OeC6DFkoPnyGQ95WMsxFYPowVanvbAmYnwE0GacOVNMRQEwWCxSY9t494aWwS4-1KKSwJj5pGEnQ4wSUktr670cUklwMUBmXqUCaWuT9Hu-F5eS9DwvCy5TChLKCvWjMBcFpFALun30mqTsD_EIWWqbQXgbYFBJUFPZB7H0vClvcDqEhmwDu6yOnu4EEsNP7Ei5QgO2EiwPmxpm2WcVFZOZTSXCJ3APoaEaGcQnbP5EAr_fIQG5hVhjNP-gZHgwrfVbILyavsKgQL2-3FjrzINC5WNbgvUEB6fYy9QJPgjbULSDjEPJzWoy959-naQZ2E4ysLhoGOP0tU4aQJt64_hhfhLACxvPcCJqGb4QfmQsVWIFD_6RIJoV0wiNfgjTbgGnGilHNuETGjBpBH1Nw_Pnghlwa5XkkaCxQopkADiilOUMypm-meYUXL7vS4Kh9FLAS408q-nLQPnrOoy5wJV989g7_a7m-VXfOTbODt9K5djaNK5LGQxvZCuYFIQWoeJA3GNaIR8QecjJw0YYyiMvK4oVblsNOAGbCL03qF_bmT1jeb4bAk9vAWnFuHIrZj-&cid=CAQSPABygQiDDcubzUPIUAUR-cENsgp2an17qPunSIBQsiGo245MZSuSKj2bVpmDK4LoALP91lZDmeIRLtTMcxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=9966132341682260000&adk=3047537735&idt=91&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:21:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 24E8 11 KB
4 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 830
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:34 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 24E8 0
0 56ms
55ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst9bP1XYMvPpMRNTkAW1VeyV15-YAIvdlfMsnbXKFrgTKTMKSzRVGnH_w4Ygass2P8hSw3x2nj_L8UD6eE-WIAic5QcKMJPI40LMbNiCNBydvi5iYf6eBwmA6fsZgiY9k_nYIJ1ElBIuwuz-kl07SWzkFoC3sbnqL04QxgVhN7h0DcuNZkPCiSXECXZ3uRXajtIcxRw-TWHrNtVM2kKEF0rggfWxEtIe87JqqGdIfCN3x-_BeuWatlyK4AKAXlj1_i3nBk9EeXagdum9eHZoC1wGMGV6gNTLlT8L8zkU-nEMuhNBbXrHnOJdBTVyxPv4lHtPDzxc5Z5Z4JCC2o9q0SYc2a7nu14pqPDFWYiVId-_Nb-uRkqsLKvdLryhBNIdXzUWN-PNS9psjrT3T1awVQA4nF6H01r-RTYq39DsgCzMJVgqq8YIUjp_baVazRaL9AANUYkcOKDBbk4lULsqaTMUAVWmUGs9gmS9QN2Ew_vW1mWP9oCVIuhMGIS4-zpvOL7qEYzRTMcfghWHngB5p9rTHyTqJiVO7pXHxhv8WI9GsDbslmL9YjCVEeW2zzH3mYFCaRUbrvFXNm57eQDkgMS2zdoMCC05ekofDhlEOoihHDQgZWSpexunc5OkOPI6YM35hTW9_uUs2cfFluMLYSlMpErb-weIjcaqLzXAFOI3bWgBQMlE41senVsIIR0au9zt45RHjS8neBrRzp4Btqo5FTYdCC0fpWA8PnDk6kwtDbliEhn1gSroiW10D4dqauZ-PqoS4-YuyXL5ICweAQkENzG1oP5gAy6PgmWb0L--M3vSYwXk8I8-6XaGn1NCzIfLfNvnz4WaJNjmO4NG2Hz_y6VkV1ISttM5RXdX0wV3CXii1OME9UaBhmAbJHJ9qqQ4tZkWjI7yJodEt80STyX6sW41uliUCYPO5bzXHiaihflhnADb_-6Pjw7DDjCH0Ax50zTMvoRs6H3P58p_mn8SufE4AitXpvZxleulOF2ODjv1TVPfbUXbSGLdwx-OBRwXm4Byi1dnfeP-m98Drp0pNDqNF18-1V7330mSyGcI2VDjaIFDFAR7Hfg-erBxbZTzpWHS2W3bqwLnx7bq69ncPBAvoCL9ILe-zAYslWai50ayC4LbW_yjSXCmzcG6pKTiaFk9bMV92UvlcOq_LrBb6gDWxlGW2FOzToAwXq3Fd-JenJeIl1bWTF2tO6Wx7xCZvqkzmvH2PyEV0H1aleAens8nwkVmE070SzWBiRwaUc4NnUGo4rSFxVzj-03Eh9Y4mAHUFCQzVwFvQZzG2Hgbu5xICgCYtUCb2aFy7_zH8TBh7KuRwyb8ri7ykGI&sai=AMfl-YThoe_ZYbNKUdvKKAzMO1Aaf8fqHg1insFPL-kBnGTuDN8E916wG9ZTaN5F-7LFD_tDPsEFUdzmLbbi3mCI-suoMUyokQNdhhz7y1YGg1bBG5-nuC8CgQDOnlPXD3krlaIHTdVnDbWL4XPASthXWoT4b-zwCA6oW3TbIaVsCh-B2FU9eT0fu_iMmWWAyj70wpwXLfMfnP6FrqkFuoQ9Isq3zLYmoQYNB7S1Q6WtO4i4drgSMffUj4Eo8c1ClsQbBaclw8I&sig=Cg0ArKJSzJUu2HV4FwO1EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230620.91812&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 24E8 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106849
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 13:52:35 GMT

GET
H3 200 859946642154228691
s0.2mdn.net/simgad/ Frame 24E8 102 KB
102 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/859946642154228691

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

512273e8d454edde250416038c73b4752bc4deecaf8bcad90bab27cbf9e4e497

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 18:35:11 GMT
x-content-type-options: nosniff
age: 349093
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104453
x-xss-protection: 0
last-modified: Tue, 18 Apr 2023 13:52:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 16 Jun 2024 18:35:11 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame D00E 35 B
464 B 10ms
7ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJPGL-MkFK59yo46ALI9tP8&google_cver=1&google_push=ATf1kGMPEql7hXhjNbeo7nA_HxWIa-kyyJrkB-Wgt3fBJt3p9yl6ay3NHcwTJS9eBta-VCVHu6F_NZ3h9xlqMwxuVPpe0VPXr9pAwIZkr9tjNKtz32V7afZUnnb_xPXUHiVam0eYvE4pDDOo

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D00E
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEPWyHPgA9N2Ii-jBBzm5gHk&google_cver=1&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKY...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKYa-YGejV_kbVWtBqnK3tfBxtJ_XbJK2...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKYa-YGejV_kbVWtBqnK3tfBxtJ_XbJK2b3hxdSxQzaLg4u0-sfW_5soNlb

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:24 GMT
Server: MT3 1031 59fd23a master cdg cdg-pixel-x30 config_version:"1438"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOvHFdfNpRpnhsMwTPzL5dkO4D-cRJInkV_PKi1vsjnFqOzu2OHdvuiNYm4o0GIZiJvA9F9r0gm-AEObLKYa-YGejV_kbVWtBqnK3tfBxtJ_XbJK2b3hxdSxQzaLg4u0-sfW_5soNlb
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 21 Jun 2023 19:33:23 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D00E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESENZI9LAmsjVCCYaSYcQaBNQ&google_cver=1&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwzhn4y9qTOJhjwCR-...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=93547A5F1B5F4C84A8C184F2B5D4A934&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwz...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=93547A5F1B5F4C84A8C184F2B5D4A934&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwzhn4y9qTOJhjwCR-662lk6qw9BLYJsnlRLUgoUMKld52L-yiPxO4ZlOUE-

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=93547A5F1B5F4C84A8C184F2B5D4A934&google_push=ATf1kGMEic-ZwfT0cgt0OpiRpe8qqC3VE0GfE1Pvyqwxmq1aLzRSatItTEZyFJW3LVsXekalLErxdsLGn9pahwzhn4y9qTOJhjwCR-662lk6qw9BLYJsnlRLUgoUMKld52L-yiPxO4ZlOUE-
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 20 Jun 2023 19:33:24 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D00E
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEB7MBqJ6iYs9DnnY5n3A0VU&google_cver=1&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZu...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZuCI8vYXba3jy-9w...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZuCI8vYXba3jy-9weAuEmeqkAcCr7bsrjCnwIxw0wr1KXHDqvRnxL6th4

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Jun 2023 19:33:24 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGN-yepMVvKn77SCEIBGqoucJgxoCUBpExRTIfBHKwLRKraG857_UkFj8fR_3Rx6IebVxdd_1eZE4cWLZeZuCI8vYXba3jy-9weAuEmeqkAcCr7bsrjCnwIxw0wr1KXHDqvRnxL6th4
x-host: tde-deliveryengine-production-6885dfccb4-958jn
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D00E
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECM1j1ADzWxOky-m6_7UeLM&google_cver=1&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6B...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESECM1j1ADzWxOky-m6_7UeLM&google_cver=1&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4v...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI...

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr&google_hm=7zE2MBDBRmen_U2NK54WDg==

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr&google_hm=7zE2MBDBRmen_U2NK54WDg==
date: Wed, 21 Jun 2023 19:33:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D00E
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECcYhE3QVswEGXJtcDkeewo&google_cver=1&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uu...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uuyLLbibhCUUMHShvbgftPE8riIhoORjc5Lg9jyh...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uuyLLbibhCUUMHShvbgftPE8riIhoORjc5Lg9jyhy_FMUXfDWU&google_hm=eS11d0tvUWJ4RTJwSEk3eUZ5VzM5Y1hpRjAzOTdUbU03YX5B

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGNOMWyLL7qDV-l5TXMkNcpKdo4hv05dLFjP1cIsi2k-bwklUZn3seue7irRHzG5lD-YCPClHkGJrs4UqruKasu-2uuyLLbibhCUUMHShvbgftPE8riIhoORjc5Lg9jyhy_FMUXfDWU&google_hm=eS11d0tvUWJ4RTJwSEk3eUZ5VzM5Y1hpRjAzOTdUbU03YX5B
content-length: 0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame D00E 0
356 B 11ms
8ms Image
text/plain 3.76.139.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEJ_HuDg1ZPQ3zZi_71-8Ex0&google_cver=1&google_push=ATf1kGPO9Q4hmfOvus27REuY8GUbUQv0luZXCwJJicTExQ_spkO1iWoG5PVJSeF6bC1KP-tigK23vBGQEmeEk2a_lvHuvzl8WlC7l1pMP0xVfnevzcYfjL4pPNjv_1IoVuUPtDYB91sOlG0ONA
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.76.139.6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-76-139-6.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D00E 0
12 B 16ms
14ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KSP_-1_MDiil8WqQot1LKV_OgZHnnAwcNy6EZW4XHoUfMEiervGI8XoXObNT1bSoqOHcfM6w

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7061 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 106817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Jun 2023 13:53:07 GMT
expires: Wed, 19 Jun 2024 13:53:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 429A 1 KB
648 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 13:19:10 GMT
etag: 48472445140208031
expires: Thu, 22 Jun 2023 13:19:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 24E8 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2618637b907790054e18fd6cfc745da918d2039de89109bb0890edf1ddb2c223

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 94ms
94ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDhJL,pingTime:-10,time:681,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS4xMzMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1687376004320%7C%7C9884b005ea0995e3aa590b7ef6d131b4%7C%7C8623b242deb4313525321dba17b62725%7C%7Cdef3bb3a4057431740e718796fb45a67%7C%7C803446a25eb1e1a2e781c50bbaa04e83%7C%7C7c3f3dbf5d4379a59958f2ecffa3f4db%7C%7C117688ef9b259aa34a28cdb131ec36bb%7C%7Ce0ab3c24e1b9f22876de105487f85de3%7C%7C1663701684,im:%7Bpci:%7Btdr:561%7D%7D%7D
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: nginx
x-server-name: dt27.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 24E8 0
0 47ms
47ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst9bP1XYMvPpMRNTkAW1VeyV15-YAIvdlfMsnbXKFrgTKTMKSzRVGnH_w4Ygass2P8hSw3x2nj_L8UD6eE-WIAic5QcKMJPI40LMbNiCNBydvi5iYf6eBwmA6fsZgiY9k_nYIJ1ElBIuwuz-kl07SWzkFoC3sbnqL04QxgVhN7h0DcuNZkPCiSXECXZ3uRXajtIcxRw-TWHrNtVM2kKEF0rggfWxEtIe87JqqGdIfCN3x-_BeuWatlyK4AKAXlj1_i3nBk9EeXagdum9eHZoC1wGMGV6gNTLlT8L8zkU-nEMuhNBbXrHnOJdBTVyxPv4lHtPDzxc5Z5Z4JCC2o9q0SYc2a7nu14pqPDFWYiVId-_Nb-uRkqsLKvdLryhBNIdXzUWN-PNS9psjrT3T1awVQA4nF6H01r-RTYq39DsgCzMJVgqq8YIUjp_baVazRaL9AANUYkcOKDBbk4lULsqaTMUAVWmUGs9gmS9QN2Ew_vW1mWP9oCVIuhMGIS4-zpvOL7qEYzRTMcfghWHngB5p9rTHyTqJiVO7pXHxhv8WI9GsDbslmL9YjCVEeW2zzH3mYFCaRUbrvFXNm57eQDkgMS2zdoMCC05ekofDhlEOoihHDQgZWSpexunc5OkOPI6YM35hTW9_uUs2cfFluMLYSlMpErb-weIjcaqLzXAFOI3bWgBQMlE41senVsIIR0au9zt45RHjS8neBrRzp4Btqo5FTYdCC0fpWA8PnDk6kwtDbliEhn1gSroiW10D4dqauZ-PqoS4-YuyXL5ICweAQkENzG1oP5gAy6PgmWb0L--M3vSYwXk8I8-6XaGn1NCzIfLfNvnz4WaJNjmO4NG2Hz_y6VkV1ISttM5RXdX0wV3CXii1OME9UaBhmAbJHJ9qqQ4tZkWjI7yJodEt80STyX6sW41uliUCYPO5bzXHiaihflhnADb_-6Pjw7DDjCH0Ax50zTMvoRs6H3P58p_mn8SufE4AitXpvZxleulOF2ODjv1TVPfbUXbSGLdwx-OBRwXm4Byi1dnfeP-m98Drp0pNDqNF18-1V7330mSyGcI2VDjaIFDFAR7Hfg-erBxbZTzpWHS2W3bqwLnx7bq69ncPBAvoCL9ILe-zAYslWai50ayC4LbW_yjSXCmzcG6pKTiaFk9bMV92UvlcOq_LrBb6gDWxlGW2FOzToAwXq3Fd-JenJeIl1bWTF2tO6Wx7xCZvqkzmvH2PyEV0H1aleAens8nwkVmE070SzWBiRwaUc4NnUGo4rSFxVzj-03Eh9Y4mAHUFCQzVwFvQZzG2Hgbu5xICgCYtUCb2aFy7_zH8TBh7KuRwyb8ri7ykGI&sai=AMfl-YThoe_ZYbNKUdvKKAzMO1Aaf8fqHg1insFPL-kBnGTuDN8E916wG9ZTaN5F-7LFD_tDPsEFUdzmLbbi3mCI-suoMUyokQNdhhz7y1YGg1bBG5-nuC8CgQDOnlPXD3krlaIHTdVnDbWL4XPASthXWoT4b-zwCA6oW3TbIaVsCh-B2FU9eT0fu_iMmWWAyj70wpwXLfMfnP6FrqkFuoQ9Isq3zLYmoQYNB7S1Q6WtO4i4drgSMffUj4Eo8c1ClsQbBaclw8I&sig=Cg0ArKJSzJUu2HV4FwO1EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=122&vt=11&dtpt=121&dett=2&cstd=0&cisv=r20230620.91812&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 container.html Show response
6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 19D2 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js?cb=31075507

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ensonhaber.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:22 GMT
expires: Thu, 20 Jun 2024 19:33:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/4323423352959208367/ Frame 7118 3 KB
1 KB 7ms
7ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/4323423352959208367/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac1f8c2a4ee7c0ee40acb4937d0459e1e290abfa8229c4b7fc4d7992858e1cd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 22:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76324
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1365
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 15:59:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jun 2024 22:21:20 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESELzJVeA83Z9JI3tP0vnoCv0&google_cver=1&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROP...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI0NzIyNDc1MzI1Njc5MDE2NQ%3D%3D&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROPMPPn...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI0NzIyNDc1MzI1Njc5MDE2NQ%3D%3D&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROPMPPnrQJ5mM9LJLCs5m0w9wDgFUSPZWa8Taz5v_kYlke-KtQQ0IjPa_eA

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI0NzIyNDc1MzI1Njc5MDE2NQ%3D%3D&google_push=ATf1kGPO1XyG--kVFrxWTVYFoeQXuoWtMy6zwuglypbaiPl7F1YGh1Lt8m56d_jo4ICYl9488EPgtgHI1alROPMPPnrQJ5mM9LJLCs5m0w9wDgFUSPZWa8Taz5v_kYlke-KtQQ0IjPa_eA
Date: Wed, 21 Jun 2023 19:33:24 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEnEyByKN8prMu-rTiCvgiU&google_cver=1&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZ...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZk49UCrmu_udWOE...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZk49UCrmu_udWOE5aYlmDoAuNQWaf1jRUQ-dO8PIidv9IC85JXwFcuA

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 21 Jun 2023 19:33:24 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QbwiEobOS0GilM22U8ju0w2&google_push=ATf1kGNZvGUPSU1ZhpGU2bK-iGEm65oMkWXUXnnWbPm8_GktIEbyxYpzAqp2IG--DFoe6dbIuQqkkHNFlRFTLOcZk49UCrmu_udWOE5aYlmDoAuNQWaf1jRUQ-dO8PIidv9IC85JXwFcuA
x-host: tde-deliveryengine-production-6885dfccb4-n95kf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEA14IPWANbyxVD7HhctFI9k&google_cver=1&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1n...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1nsuPv8b84...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1nsuPv8b84w9BDVVZWNprC7W33oiOhZePUPM9Yh4Wz2VT0Xa8o

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMjx2sIuKlJL684f70ehvG5zOC6C6KcpP7OgBbvqAXMd-hlz-bJ5_03FmSkbIJer8SmAzoDDlpr9S29jZUdwEsQx1nsuPv8b84w9BDVVZWNprC7W33oiOhZePUPM9Yh4Wz2VT0Xa8o
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOBZJPtTg7kk_NuHjVYDi3b3_Puo7CE9zboIVKSqZM0ORvVWViQ_YF80rhjQg3IBkLRcZkxdWxKdP6AakK2YMgXWL7F_UfHUBkup5zDtg12i9l0XZXRO5GHQp6LntgLG6Tt7Plkdg

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=apMDZg9oTVKWYrqXsHQJmg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOBZJPtTg7kk_NuHjVYDi3b3_Puo7CE9zboIVKSqZM0ORvVWViQ_YF80rhjQg3IBkLRcZkxdWxKdP6AakK2YMgXWL7F_UfHUBkup5zDtg12i9l0XZXRO5GHQp6LntgLG6Tt7Plkdg
date: Wed, 21 Jun 2023 19:33:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEPnuMVyntzvaBwq0ca8capQ&google_cver=1&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCN...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCNykWIyP3Mw3pIVsOmBFid5d0d5sj8-eIHAmJd...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCNykWIyP3Mw3pIVsOmBFid5d0d5sj8-eIHAmJdihYHfZDgYkN2lH2q_cmQJ3A

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGOSNVt1CM5QKLGGL4SU0hhu9d24FVt6K2NP819HyVLkWqewlr6GRdfvqKUYiHMMw0O5ejBNU_EvORCNykWIyP3Mw3pIVsOmBFid5d0d5sj8-eIHAmJdihYHfZDgYkN2lH2q_cmQJ3A
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEH...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6...
https://sync.targeting.unrulymedia.com/csync/RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGPPA-Zm5m0VsTYT0ATWT...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6K...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY&google_hm=A8K7p089pEo4onG7tVag138

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPPA-Zm5m0VsTYT0ATWTbWqgkgN4epWvGxMSkUL0PQQLnn3qmXpChzRjspd7Z9K9wqEbC0oUjt_w8SySca7VLzkt7ykJGurDzc0Nr1lC5n3urEVDQRrEWM3wT19mm6H7D6KuAxzrUY&google_hm=A8K7p089pEo4onG7tVag138
date: Wed, 21 Jun 2023 19:33:24 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXc2bba74f3da44a38a271bbb556a0d77f003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 429A
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESELNdMnzTG...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ef313630-10c1-4667-a7fd-4d8d2b9e160e&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ef313630-10c1-4667-a7fd-4d8d2b9e160e&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ef313630-10c1-4667-a7fd-4d8d2b9e160e&%%GOOGLE_PUSH_PAIR%%
date: Wed, 21 Jun 2023 19:33:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 429A 0
12 B 15ms
14ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JAPgZyLrCL28xLpsFHXyki-JZGB_a57HAwCFUx1bqQd164Kbu-dytq4aW-c9SY0bJabVeOFw

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js Show response
pagead2.googlesyndication.com/bg/ Frame 7061 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87128
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14515
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 19:21:16 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FBB0 0
0 45ms
44ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv-XMRnBQEHXPy2SE8_CHvSXvuf6CfSCTutW_OuVjnkI73avMwryAZTQcBpn41t-w4K-OCH4fPIQof1t5JovwmgpU5F1zPk76x1coi_FIAyz8zOPBQgly3LNxWtURTdxZSBfSAs3kBwp6i7LjKFVUOzVkCgQ8O3C-qijeM0FDBkoPOA5oOYbmYRiDLEDGYWUK3J5n0NhNFGZittlhVIVHenv0ljK6YruJIz-V7cMVv4dS7expXOhWHboKF-7hRr2p3CeERicy-UnbJxemd_55zzolLiMkGAXH0uvJ9rIn3uf9QAriDqfv_4nbjT7gLW3BUP5D5_lo84O0pK6r9odmpp-O8nr1Et77IYl-oVHBt1mqLd1vDKzIWrA71n0IRhsdb9C31BayLduQfbDLStEHnZIFlPfw761KCy4akm-lYOOE54YjJrGItCsXcygZ5bcG-tDLqbVvEN6vzOG3yFIN4WzpUj_n1Nw1O8IiwUo12E0vohRdSxnMyxlfjM8yS4LKZq1A1_WSXpDdwGMdOTxGE-ppezTMFnPyOkwujQR9273D9vnknuIQZ1MK36s81KaUGiijhbDa1_LTVLox3Mjl1MAT2y0Z4K6oxc5TOL_vesxbvSl8Z6U8anX9BQ4t4KRiGNQ3h2cqOcdslIr0m2jjx6GI03WVZ5oXG6IlTjrW3B0Ikiy72rqwx_KCM5MZOoQMbT9hiyDUnB9vvUTAPD4vMgiFoaFgVeZW3oFjbpNHSdgMpLavoPR1ZFINliuNs-53Dqjxwe2pD_0GSBwDMeQxRu1R1mdbjKSIERkYnePhgvVG3EDYl_OJcUpP8Bm54cRalU3pYD3GRlkUv5j-DRquetP9DGwUalCVLnesfX4KgwVAtFQGOemrkyoX11vdJV5robkN9z6VmRvs0w0jRh1fzuEf7tr-gcpzuRBpyI9ysDzjCg4FH14SBRpZZ6HMl1uIg0LIkx_krbx15uKZ4p3kYtgA7BgOpbvvgN4sdf-7lgwhNu8NlILGPlqPSG8ba9DsCNCaanDOL5cssx1zxXBWIWWurlaqYpI3xe3hAhh_1EEBFUAX5Nj9Loya7JoY75FR3WS8F-4JkR5j54SdT44VsoMMEkQs0Yv9L76EjNGiSLCY1BboXfnkCn0DxK-Ckl43ZchoB5YtllJVm6drfVktnLWWR0pw7e0NmaUmdX-kenvGnp72qyEu6ltrcsXkEYRAjk960a-65uj46h5QYaSphJqPMKcwMTQo8tDk73KrYSdTzP2pBVI5kWd1DhCkKRL5u7-vOYCCmk7xbGvwFPtPLMJcTih3TYzo0ittSw8qiUAfcDsUSMRcAyE-21mOIkaXjkPCU&sai=AMfl-YQtUFi62EmqBWnRAEkyfDpSFzObPfBHSWw0MkjWLhJ0nKuQxKiCCV_1OENjSOjlHf9vAYySS4ODPtAt-_e7ERGfBsdDekxYPsb4904faeK4R18lIm3WfumtwIh_OfaOgKO640lXWKHGnNqcGozAQPvq4NF5BVKZOPGSXNx7EEO_T0RM_9rzXOmBnABVjoMSVbNZLFrDvS1WLP5vRq1iwzJclJZwsFJOygmThr3SCuPMGFENC3aDGRisG3I5WN-E3y8OxUA&sig=Cg0ArKJSzN5sw4oOpJmqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=527&vt=11&dtpt=342&dett=3&cstd=177&cisv=r20230620.46141&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A13A 624 B
247 B 56ms
54ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNCEFBDI4JukAxip5e7sATAB&v=APEucNWy7fyUnWF-ckpzn9gohIOqcT1KdqVlQOv8cmbTWFdw3TdV1DmBdLbf2B-PnyrKaWFjYuojl7cMoiMOsAOm6dF5yn2Z4SWjKXfMYujnRYP_KYDJcrSeXr8GuBMBc3WJaPV2nbCbbdxHFtDMq_Rspv_PD76yP8ATLk3_DiTGe0O2aIC84GjXOeNbEpvMns_qpnmVLpqY

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 19:33:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 19D2 78 KB
27 KB 101ms
100ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19D2 42 B
69 B 42ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CqBejP-tukab30i6jRVtCA1jLB08G9I1dcxn4C5g8r38JbK54m_2ur2Z7jok68Q985-RnimS3kT3uNEMr2LzhAThkKl9bsnF-DSjlKiSmM_5zstfU

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19D2 0
26 B 43ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4950728767053787090&x=1&ct=76

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 19D2 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:48:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2704
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 18:48:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 19D2 19 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 826
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8131
x-xss-protection: 0
server: cafe
etag: 7076601798724011321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 19D2 0
0 15ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSsKByukthCBN5uneJRtaMBfe8LF45bXtXmFVkGLpY_TzC-OdV5nd80ONuIynWILP3kWxzl9C1tsklKlSeXWFTJii3How
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19D2 178 KB
56 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57058
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687274360908795"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 10DB 22 KB
8 KB 9ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 106817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Jun 2023 13:53:07 GMT
expires: Wed, 19 Jun 2024 13:53:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ Frame 7118 13 KB
6 KB 35ms
9ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 01:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64412
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 01:39:52 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 7118 8 KB
6 KB 52ms
52ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dcdb25c59c07dfa5cdb4fa539245d0aa2141046352b9dc84e317db3d91546baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5823
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4A09 0
26 B 44ms
44ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2b8Ag1CTZM-AE5-wx_APqqyl6AcAAAAAOAHgBAI&bg=!7u2l7bnNAAYQ3eRoMN07ADkAdvg8WiJwYGtH2-T11eFvt7FisoQGuYpKF0Tci7P5LNQtsR7ggboZxzDpY_uKGQ0eLuZr6x2JZAYCAAACYlIAAAADaAEHmQL8Xx9wkAxWSTlL7NKKcZ2LjO1ZjduM6GtFRI2OXvHrhksCrFbw9FtZ8Jr5cKtHAXoATYKNEeCkjw2LNZHLbEL1IeDBI1hYL25rIQd4iDALlgUwGxpjTn5cVo0wnGrklqjn9fDfS-dJXIHiue4wcILVQ_vm1NaiHufB-bRBL34pbrvPg6rMATVMEHkjnpeUsYTdosXtm8g5cqlB55L3jzhuVdee9Avx3Nn5hjd68TroJVQ8BoUK4jYQNqw15H78yo0_vhBMqZai3xH6m2iBi8Gfgh7kgdb0MYkoFOAkl8BCJdIj6PNnsHb_Fld9fjbALhZFezdgGCVTXzU1fypkqmwkNKM0sRaiJ7byWov12o5-tJ2UWabbet598QU-DFFAzjEmRF3abAt_ix1OQllQ1UI0YC6rZB-CdzlqDvI9_ZL6QZRGQ5vyZqsFIfgKSC-ps_4b2LHSts7UTPKkYF6Kr2Vao9fKrrMwe8EB6Ih8nKdzZzs4p5jDchn73DQ3jmSNrq_W8DZk9suyTl0BVdZwF4OMDmgngDmdUk1ncSBvdmMnu0-Kmd-zk4j7-GWXwUFo0IqLShdNGipGtmtvzCxTKB-UtJtyKnnqJmC_UWLiy8ATqtwGs9M2okpqbJbGEFnT-ehCIWhsd-u2OKTWVorToHk17AdDct8Q3qrHAJxuE51W-iM_MLcq05flPQGmvCRGWlHLU3aMJ1KKbiAz3NHILAAY69zdknPWF-gUD5AT0lHhdTb3HCZpjHkIoVOJiyqK1JeRToJoFlD98WpSGViJ6XDkQZ05TD03CJFgw2j9l5il1vywUOfXE49dFmbBIy7ThdOhffDElLn0eZiQFi79uDWfincjwzc2blk4b0GpWz_LPi1jLH3Uu4_PwrVC8k4efGBINgIxAfbqt_f3EHV3KTerouvLFVc56C59PjJg7BiZ2fE96apvtt3Xt9az0L3Lo3TedP_TEwAWharKSw_i0pcv18h1oxM4AFEANgd6qBdTOeBpqlPbN5Fp-W2qD0w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A13A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNCEFBDI4JukAxip5e7sATAB&v=APEucNWy7fyUnWF-ckpzn9gohIOqcT1KdqVlQOv8cmbTWFdw3TdV1DmBdLbf2B-PnyrKaWFjYuojl7cMoiMOsAOm6dF5yn2Z4SWjKXfMYujnRYP_KYDJcrSeXr8GuBMBc3WJaPV2nbCbbdxHFtDMq_Rspv_PD76yP8ATLk3_DiTGe0O2aIC84GjXOeNbEpvMns_qpnmVLpqY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=486
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A13A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJNQg2gdFYgyxIJWskXx8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNCEFBDI4JukAxip5e7sATAB&v=APEucNWy7fyUnWF-ckpzn9gohIOqcT1KdqVlQOv8cmbTWFdw3TdV1DmBdLbf2B-PnyrKaWFjYuojl7cMoiMOsAOm6dF5yn2Z4SWjKXfMYujnRYP_KYDJcrSeXr8GuBMBc3WJaPV2nbCbbdxHFtDMq_Rspv_PD76yP8ATLk3_DiTGe0O2aIC84GjXOeNbEpvMns_qpnmVLpqY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=485
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPu65ct_-DKCdBFd-7AmLgY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A13A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

43 B
1 KB

7ms
7ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNCEFBDI4JukAxip5e7sATAB&v=APEucNWy7fyUnWF-ckpzn9gohIOqcT1KdqVlQOv8cmbTWFdw3TdV1DmBdLbf2B-PnyrKaWFjYuojl7cMoiMOsAOm6dF5yn2Z4SWjKXfMYujnRYP_KYDJcrSeXr8GuBMBc3WJaPV2nbCbbdxHFtDMq_Rspv_PD76yP8ATLk3_DiTGe0O2aIC84GjXOeNbEpvMns_qpnmVLpqY

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
AN-X-Request-Uuid: 9d9090ab-a518-4110-b101-f5d021a70ccf
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECMJH_UaTJy3AMDLkH3aeIk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A13A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 21 Jun 2023 19:33:24 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.72; 45.141.152.72; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 66a61ba6-4991-456d-a5f4-9fbd50ea3651
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU4NTM4MTEwMTMxNzY5MDM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 7118 17 KB
6 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js Show response
pagead2.googlesyndication.com/bg/ Frame 10DB 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87128
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14515
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 19:21:16 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 636B 42 B
64 B 51ms
50ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvCPPoH8paHkIgtYobtEtS9PWWUVgWP8-ImKDNRlc6_ivt3tcgz9TBUMD0toWcU9K5XaqqH_UmJX_3EFyywPNqrVe18-yByJDt1QpPzwRpgO_CBl9ecCr_4Y97PPh7fI4EqPfksyqTyTBGE&sai=AMfl-YQR4c-qZD1SYnHb_RhlFartO6P9vCKQagkoUh6HKbxL5TLzpvgNLM65oRLsr4-fFU3-O7ig_erjE3oUEA4lCRvBNBObuOHJdYrAlf956oYEkACB4bBv6x1yR_s&sig=Cg0ArKJSzBRBagHtFsM9EAE&cid=CAQSOwBygQiDa-Zx3iFgs0NZfINHgpn6kAfUo3EXt1RQf3GEFupxGKIgEIMHCAlAtRnzh1eQluY95kvY-3jnGAE&id=lidar2&mcvt=1020&p=1203,436,1293,1164&mtos=903,1020,1020,1020,1087&tos=903,117,0,0,67&v=20230620&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=396462409&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687376003096&rpt=363&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19D2 0
26 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4023091464838&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19D2 0
26 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4023091464838&version=m202301230201&ct=76&x=1&cor=4950728767053787000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 19D2 89 KB
36 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DdlQ_cqLjEP-TnWTjmKaWFSRhw9hkYS8zmQV8fvCrjDGAs8UcFADlicUSnm_-4p24WDg7p10t__v2zlUS5_RxVwtOwlA&cry=1&dbm_d=AKAmf-CZL8tjPDvbADAVXR59yY5GKMAoOqbP2bu9EQSdY10ASn9L-c9GQ7IiYXQ58CLk7f9NDyAGa-rRSspKXIMLfNhdOAx2GcC0vEb2ugniNH8xmxVN8YJBz_Lcobu6iyfTrwQW62uYTpYe3o71t7HnQKYS4l_XvisBD021Z0S7bdbL4JEFk2pizoj1PbG1BIj-g5kPs3Eamn3TTwxucpX07dPyZReoaGqE_7Ri-M7shIh3y9UVcMzHSUD_fE5sgKKCkqiO1d88vqr17CjZCrHlsJ_8XyIW_JxqHD_y0CcA1XHZHIVZB1Czt2uQRosEVkS8Nyi0eAijGmRzHv1-1D7kMjQF1KNhzMF2jes0qMSWq7ykXzFEvb-7Qtx8a5GAxYbyFKtXapZIkFRgT-IDcLtXnohImHMt5wo1dLYUOB15iBfQD85GSfyrd3HxOnqdTHfz9-9fCHjwep8vVYpcUDa2ryzqT3NJU9YIvE9eIzJ_eJnkYMzkWUc7-Yedy_yf1csknXtWVn7aKyD4-0loIsanG46RF71TK6orZIo1_QaoPElSb-Ta6ifGhxwubqdPMABnNbrtdEK3t0pyZPcSTqNtxB4qjBZy5fQZoq_WOs8R0B0r9T53NAKGsTOipnXQBMcmgJ7e18e8ix6trV3cbwFFUIFYa5CvSWtDqw6WtDvSsKRp03pY2MCA0OXoslnlAhvI-HtaFVh_DR0OIqHzav5cAYZAEoqkqOys693F9kzYbTqKtUCYwOhoQU_KGXiX8NLNPUbK3HehCCAPlaYHsbsPbtS51j3sEQouOhlQQeL-j2cQvOomVZu5ICVR2tRktxlbUNM0OBsM3wW6GhnLY9u8ov8UwQSHmTVxtsq3XFmraKy1YbW2Il9QoxV1WBWvRBulNcAoJR2mN2gLrGPaoB8a7rFJb52mZ64EVxQQBSwnUAAKQu9fb_qnAbEwguLLdpibVTlAaGacmP7W5oKXiUyj9fiTKho7aEwcxTY73UO16Fjf_qcE2B-PsYQi8I-iiPUpJwBkOLnGq2tj9Q5RqXt98KKnEe3M_kJolow-3JCeQupFN1Ij5jmfveeTii3O8SYMUwdE53jWnUwetzA6q9UWiXz6knwJk9ratuqUydK83UTRdMAJo99z3v9c7hGGz1YnuY5BeNTte_6VIFCE-puzP81-iFc0xp4cDHzLD9VZMCqnsCKGTcMX39smG-Zcz3JO9VyK8qBFLiSjYebGez3ZQdExusypZXCs-1igvN873xRMMKAFMbPXiwG_SYNjLH_RL9bnCap4x0sajkJO4Df77UN4YUqauSN8IUd3XCz-yLC7Wyr8fhaO6YiAS3D-y-7tVSJLY8VfZyF1GD7uAgZizM1NlAaYweaHjI9hpF0a2GTGbQviXUtQCgGUh-woJfppS2jZTjbNUhT226ZpoToQUaY-t5SJXGTvbsrPaSiXKF8Pu7n-xaCJ6YLfGYOEVaQPX827ONzld745yThTO9XCZBVQv7EgyE61DtZFb70yxyM6OVrfXl59VyUUB9fUZbNb2GZ9n3eSYikIZP5U7aMZioOoMaYUQHw2350Lx8hS27sAsnj7ihsDr547ahJJIrYvz6giqk-_V6mmOipg2uTyEP3Td0207kDYfwaWMrkSHTX93L3K2iBcGliup_T27L4Bv2wShPU6LDO-PPYQpznDQ5KJmmA_oWJ03yskyRyuWHFuARCVN4uU-5qN3sdCJFPMBTzihsLo_ivIcOsjAzzEDnwaxduw-OnxeFYp39soY2jPN3uVoa9POaWq5TpCwoKv8o-LX2yRE8Ul8Dfg_EPqyrLjJY0DL6wWXLMHEXb0uqSWOuv-GVWtz3G2WEe1lgLuI_NAIWMCqu8eMDNEw0X-g1omS_GNewagZCiTAkOZo6I8GeIbT0B9fi6mAhThBvHKVjz0iXcJwZOGrChmf_euWbTE6E10KgwF-HletjkX2qxeKL8LmZSn2stCNHneuv246UENmJdcKe4BPWXZX9jcsVvpmYJLj-RuS6hEwJlc6Ro7WsYL1vk2toVWSKXiJswbjL0cmVa8a99mL1NNx2tagLAZvfYKA5BIfcoj8UUReChSs1hiEm6eelPjkSxdUyqWnJwvHK44cXQ7chHsvFc-PbMN6nyAwxCF1PBj9xB9VWzVME7Gvon7jmt060IKkxm7LqJaKLa_Ndj7T5JKOefJXnkLtCksGLoJkVdQePHBLNzm0ePTJFmStawCE7R1B82FxQTgAuTO1280lIT73-ZVprp3KPUrEm56ogcxnYjHtLwjD1tUzn4YI1i9zZijF9JDotcA0Mm8baNek9ZiqzBQkpDqH6M665adByZjrGNwpxDe1mzluqrS94pqeBDxTK_LwHgkPJyfUCN3pxbV2k0cZpo8EYJ20l5Ah0QDPbR-YJ65yJtzIRoos5BcUUl5rGH0zeLqqZDSt5MgliIMTf1_jVPEBofVYvawFxNZBJJj6GPf_wHm1Z2O-sqYruiHBfC8EVWQtpetSdipfHaEanTGQZBQLL4D0PW3OhfZb_mDuDm253xqSWqPRO1dRxXaeQwBrNHMTdQooPXPr_2IRs0iMdT3j--UC_MlLaw77G5GMpXjJkWiMoqco1LMpyRzYoLgAJMJtMdO41r-l2GPAOIYpDrF6CG0tU6_Mkj4xby0u1-JSXYB-ckrPCFtbK0xvbHDJpujFPx9M2ZvMv4gZH8oMt00f9uxMXiiQ2kSppIhe-e664WmvaAobj00H3aVjCSm2p1p13Nimuf04zJFoDb1cdjPPrGiHRaKlAists3TrqXVTC_by0crzha-FzsCr-g2LfK7gTNttJo5D6897LVjw_ekblw7CTEcNFwby8YH4gWAtRrLvRKMD-tKrDFCKPfpmmupd6EGWV_PEFVcxbcJPwt8O64CJESs9D251fH9XOooKdcs74sdpEUfcBkcxM-tS-GSQYzB3wrm8j4yBUtfvNYqlezACIImVK6Upm5nQ2xxVooBYRD8la1hHtqFGmY3PTkIpmSyHZX3Jn-roBzni_5-DKwrdU4syswr0KiVXrPtRsKaTb5Wl6xdpAmflqlttz8QjgmgS_rgYyBdjKIbKXN3wayTnpUfdYAD1hh77k-McfK3r0QzEOFldKEpnAzNe3qTapXM_Vfpen4wcNJTrD2Wj0LWxnaR-EGz8GlQ6vNWqh-la3bpz5p78tvW7eEtywFzS80n1gXjaICpra1KApluGIzuNV98Id3xvJPaRX4-50szZME0iHf-kb1s_6LGfA_CHu8JJhwB3P2HByARkZIChnY7r_9qP2tkbdU_D4OBl5wzS7osRMwqCmTKRXdjCfX3DqCKp0rtE4ZqUGTwXXxELfJl8vs0Awp34aYfOv5VeAkL9zOt0oUe6Z1GOsytQMutOAr1u9LlGW_gYOUCsGJL1pnPOPhQttKw3KeAOtmvpGY7W3LKhsdzNLkO2vb5SOS4SxFpAIY5UE8nwz77r0SgNTBnw9f2F33UD7QQImE6dblhBr72Dqc6K5gpxEtyl_xHDhxqYNtVter_TzEgMscYndb5D80VWH-lGnyfmjeFcZWZJXwwfsdtwClcTcJ1s4_TBiW7qHJ9i5rC0Tcx7Fw49bVsv-35o4rW0XO2Yd2PohYHkmipZ0kuLsQVBjhxpTNzH5149b3EGp-gEXK5HtSBZLWa6PLsP7U_wSm9CzR6yK68nCdpY96r_4Xz5L4KXo6TJZSo7_9Qwd-XRAUlETvUQdYlb5JoihlsgmXwZzkopSvoE4E&cid=CAQSPABygQiDE0Juwkt3YXlDZUJI1aJQnBuTE1bN9ViJa8dHdrq3PR6YeNloXZ_yMKrKrN4FmndCMS-30qnvWxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=4950728767053787000&adk=2857193498&idt=105&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b0d8a677f419fd4a6e819981bd26d40d38c980b1d9d90795bdb76a4b3170d80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9579 0
26 B 47ms
47ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BpaARg1CTZIuZIcLygAfSyoqADgAAAAA4AeAEAg&bg=!nJ-ln8vNAAYQ3eRoMN07ADkAdvg8Wh-hVMAflMYEjrCY-qi_kF66bIoSZv3pq_kLBx6uKQH4oRbCYwp0UUeK1s20IT6NvSVPbUcCAAAB01IAAAADaAEHCgCEbcxaDz3QGSPDW0DaizlYjNtNgcuEWhB2751N8LYPCg6xFnrvRCvezUQIWpc1SxZfn9yT6qi_Wn8MQh4PvS4jKRXhlsMGv92nHDmOxQl4MJWB1JxD97l9_rwiBD2qu_2KhLc6qOEzp_B6WHHwPacnXWc6YrBd85AY9MlkzGk3wkGHIaWemQL24nGrAjHG890G8gR7fI6Ug9KVOF4mHt1HKd-W1dbq7UUY0a9nuRODz6icVxdnGGOgigxQQRexFCDZueeRyskHKWIl2POuIqNvRXBXMh7J0ChkMS4NfTHRBUC8socbKvjfAc_tSaDvuswxivhVE9dvJC9eLZs8kS9ZyUAyfoV-jJ-1IhHF3_6Ci0ZZlyhr4Ihcg9jFaBJYWYXfNRoJcLJAkXMxCZ6Urav9HEJ-Qfw868Gakms2n3IjM4CxaoWpyRpsT7hVtG4L3e8ftmeMIx1cnPjljv_FSHrOKSs1wK-40fyd7nXPxFy6VwMpTg_tUOeB2jzuLAyHKHY7OceAatuquyFVBy58yzPlUZx9vlnDhjc5ePny9bJIDRvZHVETA6HZah_FQMw9H78uwPXYPdWyFecEbVVVNpU6_7nzuDY1Or4eR655bQo8IyDBIZ16DMaN-uQysUPWKPecXv6sRoYS1_GQg0eOBsYx7UC8PbByPB0LIRGHPMRPpJtrjGlyjcuc5h7HtroYQQDe5s1jPpaTC0nx57apra8dBMfVvLZQfB8MFIqv4jhNVvZ3OTKBVN9oMgvZ5_EbG-d-mdyZvBwEu7nXhCvNDmKxNMVn3ZP7V3uMVX1-Yuazcc29YXIZj0zcPg7evK56DO17Ac1bhEM8MQJSwiZRIlnZx7SU_hjLvH8_Cr5I2T7kycvJBlRrRFdG8izXbY8Ps1XrBjxE57OQOmOmrpIV4go16BFMW9DcSyWIZWrVx01m2U-FnZZRrByj9rEq9fZvrEfPKsUYJKGq57VhFITzJgPE1bFHqN0k08ACFBYJTv25ilvLd3dxN_7fngeC4JKKfw6ri7wkHHtB3lwMsV-RkNsygHuYvX5pFKK1WqOxfQ3vsgqQN2Pkq-QqOfK4pXzwN-Z9i5goAFQeKi-eC0UdHuApwl8_mBVHaknPuTx_Ws45GAv49vFGZwdvKWdu_c8XSLaB1oFkEroCB54ti_Y4oRto02oUL1NR3-ff1g9Wpls

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 congstarfont.woff2
s0.2mdn.net/creatives/assets/4234010/ Frame 7118 98 KB
98 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4234010/congstarfont.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:28:09 GMT
x-content-type-options: nosniff
age: 315
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100772
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 09:13:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Jun 2023 19:43:09 GMT

GET
H3 200 86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame 7118 57 KB
57 KB 10ms
9ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:38 GMT
x-content-type-options: nosniff
age: 826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58447
x-xss-protection: 0
last-modified: Wed, 15 Feb 2017 10:23:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Jun 2023 19:34:38 GMT

GET
H3 200 mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js Show response
pagead2.googlesyndication.com/bg/ Frame 37F5 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mZQVpQj-eDQajpu59Vq9E2pMu32_YVAoNW79LAI6QMI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

999415a508fe78341a8e9bb9f55abd136a4cbb7dbf615028356efd2c023a40c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 12:32:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25238
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14716
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Jun 2024 12:32:46 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 19D2 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Origin: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:52:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20430
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:52:54 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 19D2 11 KB
4 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DdlQ_cqLjEP-TnWTjmKaWFSRhw9hkYS8zmQV8fvCrjDGAs8UcFADlicUSnm_-4p24WDg7p10t__v2zlUS5_RxVwtOwlA&cry=1&dbm_d=AKAmf-CZL8tjPDvbADAVXR59yY5GKMAoOqbP2bu9EQSdY10ASn9L-c9GQ7IiYXQ58CLk7f9NDyAGa-rRSspKXIMLfNhdOAx2GcC0vEb2ugniNH8xmxVN8YJBz_Lcobu6iyfTrwQW62uYTpYe3o71t7HnQKYS4l_XvisBD021Z0S7bdbL4JEFk2pizoj1PbG1BIj-g5kPs3Eamn3TTwxucpX07dPyZReoaGqE_7Ri-M7shIh3y9UVcMzHSUD_fE5sgKKCkqiO1d88vqr17CjZCrHlsJ_8XyIW_JxqHD_y0CcA1XHZHIVZB1Czt2uQRosEVkS8Nyi0eAijGmRzHv1-1D7kMjQF1KNhzMF2jes0qMSWq7ykXzFEvb-7Qtx8a5GAxYbyFKtXapZIkFRgT-IDcLtXnohImHMt5wo1dLYUOB15iBfQD85GSfyrd3HxOnqdTHfz9-9fCHjwep8vVYpcUDa2ryzqT3NJU9YIvE9eIzJ_eJnkYMzkWUc7-Yedy_yf1csknXtWVn7aKyD4-0loIsanG46RF71TK6orZIo1_QaoPElSb-Ta6ifGhxwubqdPMABnNbrtdEK3t0pyZPcSTqNtxB4qjBZy5fQZoq_WOs8R0B0r9T53NAKGsTOipnXQBMcmgJ7e18e8ix6trV3cbwFFUIFYa5CvSWtDqw6WtDvSsKRp03pY2MCA0OXoslnlAhvI-HtaFVh_DR0OIqHzav5cAYZAEoqkqOys693F9kzYbTqKtUCYwOhoQU_KGXiX8NLNPUbK3HehCCAPlaYHsbsPbtS51j3sEQouOhlQQeL-j2cQvOomVZu5ICVR2tRktxlbUNM0OBsM3wW6GhnLY9u8ov8UwQSHmTVxtsq3XFmraKy1YbW2Il9QoxV1WBWvRBulNcAoJR2mN2gLrGPaoB8a7rFJb52mZ64EVxQQBSwnUAAKQu9fb_qnAbEwguLLdpibVTlAaGacmP7W5oKXiUyj9fiTKho7aEwcxTY73UO16Fjf_qcE2B-PsYQi8I-iiPUpJwBkOLnGq2tj9Q5RqXt98KKnEe3M_kJolow-3JCeQupFN1Ij5jmfveeTii3O8SYMUwdE53jWnUwetzA6q9UWiXz6knwJk9ratuqUydK83UTRdMAJo99z3v9c7hGGz1YnuY5BeNTte_6VIFCE-puzP81-iFc0xp4cDHzLD9VZMCqnsCKGTcMX39smG-Zcz3JO9VyK8qBFLiSjYebGez3ZQdExusypZXCs-1igvN873xRMMKAFMbPXiwG_SYNjLH_RL9bnCap4x0sajkJO4Df77UN4YUqauSN8IUd3XCz-yLC7Wyr8fhaO6YiAS3D-y-7tVSJLY8VfZyF1GD7uAgZizM1NlAaYweaHjI9hpF0a2GTGbQviXUtQCgGUh-woJfppS2jZTjbNUhT226ZpoToQUaY-t5SJXGTvbsrPaSiXKF8Pu7n-xaCJ6YLfGYOEVaQPX827ONzld745yThTO9XCZBVQv7EgyE61DtZFb70yxyM6OVrfXl59VyUUB9fUZbNb2GZ9n3eSYikIZP5U7aMZioOoMaYUQHw2350Lx8hS27sAsnj7ihsDr547ahJJIrYvz6giqk-_V6mmOipg2uTyEP3Td0207kDYfwaWMrkSHTX93L3K2iBcGliup_T27L4Bv2wShPU6LDO-PPYQpznDQ5KJmmA_oWJ03yskyRyuWHFuARCVN4uU-5qN3sdCJFPMBTzihsLo_ivIcOsjAzzEDnwaxduw-OnxeFYp39soY2jPN3uVoa9POaWq5TpCwoKv8o-LX2yRE8Ul8Dfg_EPqyrLjJY0DL6wWXLMHEXb0uqSWOuv-GVWtz3G2WEe1lgLuI_NAIWMCqu8eMDNEw0X-g1omS_GNewagZCiTAkOZo6I8GeIbT0B9fi6mAhThBvHKVjz0iXcJwZOGrChmf_euWbTE6E10KgwF-HletjkX2qxeKL8LmZSn2stCNHneuv246UENmJdcKe4BPWXZX9jcsVvpmYJLj-RuS6hEwJlc6Ro7WsYL1vk2toVWSKXiJswbjL0cmVa8a99mL1NNx2tagLAZvfYKA5BIfcoj8UUReChSs1hiEm6eelPjkSxdUyqWnJwvHK44cXQ7chHsvFc-PbMN6nyAwxCF1PBj9xB9VWzVME7Gvon7jmt060IKkxm7LqJaKLa_Ndj7T5JKOefJXnkLtCksGLoJkVdQePHBLNzm0ePTJFmStawCE7R1B82FxQTgAuTO1280lIT73-ZVprp3KPUrEm56ogcxnYjHtLwjD1tUzn4YI1i9zZijF9JDotcA0Mm8baNek9ZiqzBQkpDqH6M665adByZjrGNwpxDe1mzluqrS94pqeBDxTK_LwHgkPJyfUCN3pxbV2k0cZpo8EYJ20l5Ah0QDPbR-YJ65yJtzIRoos5BcUUl5rGH0zeLqqZDSt5MgliIMTf1_jVPEBofVYvawFxNZBJJj6GPf_wHm1Z2O-sqYruiHBfC8EVWQtpetSdipfHaEanTGQZBQLL4D0PW3OhfZb_mDuDm253xqSWqPRO1dRxXaeQwBrNHMTdQooPXPr_2IRs0iMdT3j--UC_MlLaw77G5GMpXjJkWiMoqco1LMpyRzYoLgAJMJtMdO41r-l2GPAOIYpDrF6CG0tU6_Mkj4xby0u1-JSXYB-ckrPCFtbK0xvbHDJpujFPx9M2ZvMv4gZH8oMt00f9uxMXiiQ2kSppIhe-e664WmvaAobj00H3aVjCSm2p1p13Nimuf04zJFoDb1cdjPPrGiHRaKlAists3TrqXVTC_by0crzha-FzsCr-g2LfK7gTNttJo5D6897LVjw_ekblw7CTEcNFwby8YH4gWAtRrLvRKMD-tKrDFCKPfpmmupd6EGWV_PEFVcxbcJPwt8O64CJESs9D251fH9XOooKdcs74sdpEUfcBkcxM-tS-GSQYzB3wrm8j4yBUtfvNYqlezACIImVK6Upm5nQ2xxVooBYRD8la1hHtqFGmY3PTkIpmSyHZX3Jn-roBzni_5-DKwrdU4syswr0KiVXrPtRsKaTb5Wl6xdpAmflqlttz8QjgmgS_rgYyBdjKIbKXN3wayTnpUfdYAD1hh77k-McfK3r0QzEOFldKEpnAzNe3qTapXM_Vfpen4wcNJTrD2Wj0LWxnaR-EGz8GlQ6vNWqh-la3bpz5p78tvW7eEtywFzS80n1gXjaICpra1KApluGIzuNV98Id3xvJPaRX4-50szZME0iHf-kb1s_6LGfA_CHu8JJhwB3P2HByARkZIChnY7r_9qP2tkbdU_D4OBl5wzS7osRMwqCmTKRXdjCfX3DqCKp0rtE4ZqUGTwXXxELfJl8vs0Awp34aYfOv5VeAkL9zOt0oUe6Z1GOsytQMutOAr1u9LlGW_gYOUCsGJL1pnPOPhQttKw3KeAOtmvpGY7W3LKhsdzNLkO2vb5SOS4SxFpAIY5UE8nwz77r0SgNTBnw9f2F33UD7QQImE6dblhBr72Dqc6K5gpxEtyl_xHDhxqYNtVter_TzEgMscYndb5D80VWH-lGnyfmjeFcZWZJXwwfsdtwClcTcJ1s4_TBiW7qHJ9i5rC0Tcx7Fw49bVsv-35o4rW0XO2Yd2PohYHkmipZ0kuLsQVBjhxpTNzH5149b3EGp-gEXK5HtSBZLWa6PLsP7U_wSm9CzR6yK68nCdpY96r_4Xz5L4KXo6TJZSo7_9Qwd-XRAUlETvUQdYlb5JoihlsgmXwZzkopSvoE4E&cid=CAQSPABygQiDE0Juwkt3YXlDZUJI1aJQnBuTE1bN9ViJa8dHdrq3PR6YeNloXZ_yMKrKrN4FmndCMS-30qnvWxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.ensonhaber.com%2F&ds=l&xdt=1&iif=1&cor=4950728767053787000&adk=2857193498&idt=105&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 830
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 5499578052516643378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:19:34 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 19D2 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11398
x-xss-protection: 0
server: cafe
etag: 3934322099733601226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Jul 2023 19:21:16 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 19D2 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 106849
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 13:52:35 GMT

GET
H3 200 03032023-031222251-320_1200_v_1050x2340_2210-anf-lb468fd76-0bc2-4269-8a6a-a41f4b96aff9.png
s0.2mdn.net/4528404/ Frame 7118 174 KB
174 KB 8ms
7ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031222251-320_1200_v_1050x2340_2210-anf-lb468fd76-0bc2-4269-8a6a-a41f4b96aff9.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80d2ea64feb90fec56aab7ae35078d8addd9033751386fdd52de2cab7bf87dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:34:54 GMT
x-content-type-options: nosniff
age: 3510
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 178134
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 18:34:54 GMT

GET
H3 200 03032023-031229407-320_1200_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame 7118 55 KB
55 KB 10ms
9ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031229407-320_1200_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2b86f468d5bf4d09d57039677a5b7aad9e9fc146b8d33e0686bbe7e0361c465

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:05:06 GMT
x-content-type-options: nosniff
age: 23298
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56185
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:05:06 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BDE6 1 KB
648 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22454
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 13:19:10 GMT
etag: 48472445140208031
expires: Thu, 22 Jun 2023 13:19:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 19D2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b15c647e3182c5d3756c08fbc673f5212d96de7257791a114e66cebe38781df

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 03032023-031222251-320_1200_v_1050x2340_2210-anf-lb468fd76-0bc2-4269-8a6a-a41f4b96aff9.png
s0.2mdn.net/4528404/ Frame 7118 174 KB
174 KB 7ms
7ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031222251-320_1200_v_1050x2340_2210-anf-lb468fd76-0bc2-4269-8a6a-a41f4b96aff9.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80d2ea64feb90fec56aab7ae35078d8addd9033751386fdd52de2cab7bf87dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 18:34:54 GMT
x-content-type-options: nosniff
age: 3510
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 178134
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 18:34:54 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/ Frame E7B7 7 KB
2 KB 8ms
7ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa74b2168acc1798dfb1036c1831c1564d5ba20ff2f0ece8fb69bbd25c3cc8be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 32411
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2115
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 21 Jun 2023 10:33:13 GMT
expires: Thu, 20 Jun 2024 10:33:13 GMT
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19D2 0
0 51ms
51ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsthXVEbPLJLxlt1-nlnfdOwdc8VDImBUCAhDqs9I1aCcWbJVPP2p1POy6ieWq7Zw6bMXjCwfk-ES2AU68yEB-aanAbPXODYEVGbVYiVFNrIPeGe109_uCkvT5pQdc9K-Xgkz00_Zy2KWEN5XoRwt-J7WLnkjdWPU8m1xiNBDrmlHUjMU5C91GJA0TGEMx-cjw1bltN0eeqa2oIs6AdfpDx9RVjU6Za-iQ4cZDdllBgj04iiTbg3_5tLVdRPNl9nYqggj5FusABS6UMeVAf1Od8xdxh-_-6FH2SyVCm7SLydbG3OrW8FWf__9RY3f9ZVYZ0OMr3cg5FkKhvt3i6RW0eVRTh4Lt7UgU-b0qIRf5s14zrwQB7niOdS72Xdw45asd31X7g9DCTFGv88YAuUCFzX4WTwSts9bhUKqGvfXE40uHTHdhuePbDK6nIZ4naCBtLOGrdMn7lhRo_iK7vp9MoKh8vHtJIsLI-ttOtrV4RF3qNyqn5d6Atchac8g9BKpkmqaTiYy9qIFzx4RNTgTENUgmvPTRh_QJtNzyW0cS219RE0uPi-zJbxAZqoV7hpln3xOMabXjX5HJ59lCUybgoANZOcNdQ1cPXaTdPXbjN7sSj5kp98kx9fWp44UeWNWSTH-gZllS-Yw5ZsZya64HZQsYwwxisYpsGA17KrerxN3yKw_lnJumfB_IOgZuPwoOimDbw-O7j-H2toFf3qT1kuC1gnK3sfkIv3AvT49WeLyerczV1RKj7CjiOHyJPe_7bexsPzfSrHRCyVhhcwfJ134iKgc1EQ0VpHZTq3sRTfdW0nd3xT30WrRzyYGLHX1n1MBetnNK_gukwpa-DOvwcUR2cyNk6ig2ad4EDpJU2X1_tq-PMtxn12J93fgPU-_hW-OyonXeOv4jmyZDm0UlBxwyMHbkdb6fNjIk858XWG1cALyy613fjgxNuIxxjNJF_ecfYy1YsHx6I_3lL46eIphcWrILrBenCHQlpM28qi0gAjmAjX4sP_jsUrjoRlvQb8UphMJBvITNY5lbMf51gMWC-EehxEj91TzNMpzM42rVPrl276FiJSVIDyTlw6Ws4V4EdD5FBcqskpFNczq5D1q__7MiVugdhNmUWHn2csAsQYzecEJ4bRW07-VrIE1AggptjcOxx4Jbn7JEAD4gJgtndTdDQaPGkNf8dwF2HY5XSh3R9JJnY_9W968bsJOCyICKZdJOgOHKZdG1bDJLxLXMAgxLDZ9OgM9CRxNctZGD_KffYQ7UQkx6K0bPyeycePXoN82I_VIpqFvwcZL5Jr1UJZvKUM57iGO79ncK-mGUrQ9mrz8aw&sai=AMfl-YQXfWgE7_6gZYGUpZKAA3qM0pxnUg_ftZkqGqiAjcIBOw8puFDLQoPV5lSB7Y5nTk4gLjSCDURWVRjnbkH5yEP2COlAFKqMx1f2cY0YW5h8giu_57-UsBvQLMaTvYt9_TKyzaOJHAiGNejnz-8uiNe2vqirZgzvXJQJa0wSyW_YFd0pA_CaovlRFzPXnAV400mGkkTw0f0RkCg6oKy-DgHH-TyNz5xZY9aLPYdG0OWYdZjgcRdfrsCHYx6zKbjApahhrnA&sig=Cg0ArKJSzNzs_qdGAQgQEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=144&cbvp=1&cstd=142&cisv=r20230620.24673&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 21 Jun 2023 19:33:24 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 636B 0
26 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=924308458592&version=m202301230201&ct=76&x=1&cor=9430209476401238000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDE6
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXBIY2MyZzQxUWMzQTA1&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjx...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXBIY2MyZzQxUWMzQTA1&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjxaYYJqRH7h_xB8FaCyoFlyslf0XmZ0i4vA-HW8GoadbFy8RicDxFf4VkwTSMx0eeaYlpiIgDTDXjiVI1nEENsApUzEtrK77jc

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 21 Jun 2023 19:33:24 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-780-gdfb6b2e#rel-ec2-master i-05a172857ebb8dd09@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXBIY2MyZzQxUWMzQTA1&google_gid=CAESEA-lZehx-EKpejd3emI0ZZU&google_cver=1&google_push=ATf1kGMbPWigY4nPVtEgV85zgatX5o6BKQl0FabLbMv_zjxaYYJqRH7h_xB8FaCyoFlyslf0XmZ0i4vA-HW8GoadbFy8RicDxFf4VkwTSMx0eeaYlpiIgDTDXjiVI1nEENsApUzEtrK77jc
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame BDE6 0
173 B 40ms
14ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEDPr3T4kKip98GmrODl4yy8&google_cver=1&google_push=ATf1kGOwyuu9w662yWD4l0j6a8GZMWJORl521MeWbvCa7rGBNv7mchbPQzncVRopFosMwNM8qRAnPb0JI3ntNgX1aU6_Y828_ir0IsxN7eU53pRwPSAJsJ8_HiNtWZ630hJaslq19TvglQ
Requested by: Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDE6
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMcG0i_h_qt2GhlL9-_hgYI&google_cver=1&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA17B...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA1...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA17BBCRGZ5dAn2EDiGIcVJ4JwLGwklPgoboxuDpP3avnEK-Yt8UgfCbdPGp9DhEZKjs

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjQwODI4MjA5MDM4NzkxNjUxMg&google_push=ATf1kGOFMvWHGUyMYU0gSHXOb8OlsoLP3rLOgZLhi2oNc8_pYkhGQkAaopw6uLMJ5lu6dhG9PilzA17BBCRGZ5dAn2EDiGIcVJ4JwLGwklPgoboxuDpP3avnEK-Yt8UgfCbdPGp9DhEZKjs
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDE6
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEOaYCQme2t6C5NX5Q4td-eM&google_cver=1&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZbx38qy4c...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZb...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZbx38qy4ceq52NMd_mc6Nd-bcGGTXuhSA3_tTtxnBF1NShPZ6yQr51cLQ

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=9_Gr-EJ0QrihboK4Z3KcXQ&google_push=ATf1kGMMGloEXRM6btFFnDg0uyP32DepcHSoT_L0iRAw7zreUDCL4vidrn3abXhKsnEu7BmCwNO62gX41gGFbZbx38qy4ceq52NMd_mc6Nd-bcGGTXuhSA3_tTtxnBF1NShPZ6yQr51cLQ
access-control-allow-origin: *
date: Wed, 21 Jun 2023 19:33:24 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDE6
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEP...
https://sync.targeting.unrulymedia.com/csync/RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGNmrajg7liJmvd5Mq4Ui...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn8_ylH54&google_hm=A8K7p089pEo4onG7tVag138

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNmrajg7liJmvd5Mq4UiLoswvWI8b73k-3itvH31FSWqVk0sEBwB15Wa4-CQXmkSO48pLbV72ZGXafFKQF4LXXlS6On0NTnHgMqvjLvgto6kzWj0ax-rJ5Dgn2qF_089VYn8_ylH54&google_hm=A8K7p089pEo4onG7tVag138
date: Wed, 21 Jun 2023 19:33:24 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXc2bba74f3da44a38a271bbb556a0d77f003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDE6
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBmTAG_TGswhQmxS2PnddiM&google_cver=1&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJf...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfm...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMDQyOTM4NjEyNzAyMjEzNTM3NA%3D%3D&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJp...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMDQyOTM4NjEyNzAyMjEzNTM3NA%3D%3D&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfmwEWHdFCOpwLPQDIJiiHHz63N6YrzNIi4nAaMEvF3DCoE

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMxMDQyOTM4NjEyNzAyMjEzNTM3NA%3D%3D&google_push=ATf1kGMEOb-LmGLkJnrw6q5e37_U3yCobxC_GS8MtQ9OUhlk3AS2bVJpxIEdLotiUtW24tE55BjUWQWyknpz2pNf2Azq-CqGJfmwEWHdFCOpwLPQDIJiiHHz63N6YrzNIi4nAaMEvF3DCoE
date: Wed, 21 Jun 2023 19:33:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame BDE6
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEFj62qNn1NAEW1nhlK0lCgg&google_cver=1&google_push=ATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3pEJpWvr6aE-FfMLSKELGlNCraJYri-kKqLwuW4Mm3pmUiaN_2z5GWPG1...
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3...

43 B
1 KB

40ms
11ms

Image
image/gif

141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3pEJpWvr6aE-FfMLSKELGlNCraJYri-kKqLwuW4Mm3pmUiaN_2z5GWPG1k-nGv5nnl8aIpwVRyUTBWhKRjH1GKWSmiNo5EgY

Protocol

HTTP/1.1

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Wed, 21 Jun 2023 19:33:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Wed, 21 Jun 2023 19:33:25 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGODjupdXEuGlEeEzbGW2_8RswarIkSv1pTYIQ8iPF_3pEJpWvr6aE-FfMLSKELGlNCraJYri-kKqLwuW4Mm3pmUiaN_2z5GWPG1k-nGv5nnl8aIpwVRyUTBWhKRjH1GKWSmiNo5EgY
x-download-options: noopen
vary: Accept
content-length: 314
x-xss-protection: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame BDE6 0
12 B 16ms
14ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KCvU27nS7GWZqlIUsEVyGj2F1KjhXX851RCkwZEh1Kz4bqk4d_JzxsOyiKwDoXM4cZemQWag

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DA3F 22 KB
8 KB 9ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 106817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 20 Jun 2023 13:53:07 GMT
expires: Wed, 19 Jun 2024 13:53:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 style.css
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/styles/ Frame E7B7 4 KB
1 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/styles/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f780d8ef9385a7f0398b7707b8c5bed5c144050c6071828196906d2baf469f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1376
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:05 GMT

GET
H3 200 responsive.css
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/styles/ Frame E7B7 3 KB
871 B 9ms
8ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/styles/responsive.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b95cd5ba6f76e9fc0d9a21d8a08007a3522b988d320517eba8723a6a2b1b493

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 834
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:05 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E7B7 60 KB
24 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 21 Jun 2023 19:33:24 GMT

GET
H3 200 model.svg
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/ Frame E7B7 910 B
466 B 8ms
8ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/model.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

499d37bfc4999187c4c93732d143aaa8946aa63dfd380c54130457e7000cd1d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32420
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 428
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:05 GMT

GET
H3 200 ctaShapeLine.png
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/ Frame E7B7 6 KB
6 KB 7ms
7ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/ctaShapeLine.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f12aca719abc5d5d5e131937088372640a98837acd615dddff9db43ca7522f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:05 GMT
x-content-type-options: nosniff
age: 32420
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6572
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:05 GMT

GET
H3 200 hoxton.js Show response
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/ Frame E7B7 8 KB
3 KB 13ms
13ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/hoxton.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc57fc68d3757326755245bfe0def53dad7a9ac4de98281bb51807f3e0b88068

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32418
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2990
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:06 GMT

GET
H3 200 logic.js Show response
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/ Frame E7B7 3 KB
1 KB 8ms
7ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/logic.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d75bfbf5ba3de72260b76ec939d4854161d75995b9eb74bea8416c9aad5e0b33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1293
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:06 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7061 0
27 B 45ms
45ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9fyKg1CTZK2DMouY-gansq3QAwAAAAA4AeAEAg&bg=!GRqlGk7NAAYQ3eRoMN07ADkAdvg8Wvbpb3MqiwIp_RzLpoQIRREPmrq5jDaSJm-k8b9JB73cBIMr0HVq2MDNve8oR65b-F71vNYCAAABgFIAAAADaAEHCgCHLSZGdoQ9X6SEtCFZBz0Kol0l8Qp8EGZMVawzYHR6JkJjo6cCVaoK7hv18ZRP58ZHUlHe7PbU4QrmR3-vECHT8dUERsg_R7oZ6sP2CroMmmG3vEoKEWV4aqH6HybBzztVWd_x3aSXfAg0j0Wpw_KbJ4x253iIbvdiP3LgfJhS7kHoBZEZ51WemQLtFFNaVMupa1dRHcF5dtPU8uZF5KHnjUXreDzgFm57iWda1ZRFxBMDCzQJPX3pTdpk7-Ke5TI4j5LqwrULmo22r9ZHCXR6GMrWRETUtIsfBoFwheTfQLX94KskC2HUzrBa4CLpWpaSKzt8l2rOdR1U7E7UavCVi662OVZHTHB8qEyrpxR_ThCXo82r7l8Ap5Ei3gE1zEm149uiXfTrRRRSnADJ2soOtTHYtB4EGj90CI2WGaaEZyHx1WguMKjdKNyJtETEHcHfN_w5LI4osUPuGm8_cOX4ewMnoGm0jn9dnX4lCbeZHS49EU6rwNnMFwu-CuijwcgZZhZYu4dRjblybPGBW4Sd1DKlYEahwqhnJ1C2F0Q4-jOcwlGPQsWcjWHSpSsP9u5FtICn6h8Of5aMReGoibrG3sqEw6eoCIpFgvdguACybT54RxSZ-JPsvs5JSvF0Qb6rBFfyDsY7BiCx3SEJxBkW2SKBzBFUYEhBH_Wr4WMyLEbGdk6QUTiTykxSrdXz1FaRXiaKMp3dhbN8ZURfyhPKqcsUXmpcFGP-xxfVXiN7XBXnzJpbHAtXGAGXHVZAWAx7B4wviGsJONtQq2DQ9MnybG56Pt9cAVG0tvRPGdKyPKJep0mD3J6EWSoGQ7ZavC4JmWkpAmjxqhgAdy2bA8SC1eFffQdjCh7AmpIurfnsgyB1uSj_5H9Zo8XrIn8XXcrF3Tvngw35JzXhqgjsww_9dtRC6nRuXjd7NRjUuAeCcf_d1x6FDjre1rWzavILG62xESfBGSJpPmLGSNZ7pZ04AG88IztzrDuX6U3GE5qrWv-KofGCVQy1-eHuj0QFVvUKi75jvGA27Espa71HwApViAnqdhNNjBNRKUUgmvYNG0qcWtrT0YkVSeu9KRZ3QU-GRaa6D8wEJz5tBO99SkEl2abctq7GcYT-FYH41ntzxe9ZO1vEmJLigvVw6duVNPUABuE33ki6hBxu3O9MzvSOQJm9BF4NQQ4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js Show response
pagead2.googlesyndication.com/bg/ Frame DA3F 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qZsn1HeCCcmFdGByhVB6w33s6gTjWS7DN31yxJZZZvY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 19:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14515
x-xss-protection: 0
last-modified: Mon, 19 Jun 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Jun 2024 19:21:16 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 10DB 0
27 B 45ms
44ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bbp_2hFCTZLbXA_Hkx_APlbCY6AEAAAAAOAHgBAI&bg=!VFelVwPNAAYQ3eRoMN07ADkAdvg8Wm8vDS_c0xCwcNcGRMr4rE7N6ScmZ8JA6Y9itFAEN2hEEC2M1CW4rwnPIoS0EPyvPpbuPQwCAAABY1IAAAAEaAEHmQLvFc3nTT6DsDx8rMmxA_utRvQiN0CUV056gbCc5yYs75ddAjgCh5wsCgPZFIUQuAkwSdm3yjbf0xM5lyzf62QW9Jcu7gnwNqxDXNbUP7ft_bTnG7gfp3HQ0L9ZyS2LLoPGNbAe-GFMTq6VkqBGOE2n_Ta0Eiiqgm-Sm0JfWVpCUrq5yfdzP3sAcmu1mbzXRjNfak5ZnaAAZLaS5R1kfDrrn7GWHV4izugc9p47Zyo9XxNUwDgTu7WQegnneZ9wNGqKy_XbFhE7BN3tOVeS2c-tK08pykKYWBUWaLTXMaQC_ix_wkRI4SWsbITAwqX4wUrSgWh_JlDkZYT3LDxLkg1sse9wkDfQBQGz0MTyKWRMQqLaP9OBhzdOMxfoNgIWIBTQzE5116xGCwjYgxApmBoVYuLjzYx9V8ELWngwVWRtqRaGHK165_R8mlYbJeQqTgPIKVNvfabq41GZT80E5k5b9zyFJ32nRMqu8XYMshTYwFEHjQ3AseyK99zTK4CPMu6UVdWtfyGREuT1L10wofA5PA4TJgMVFqT-FU0FETDJl11PXigX7c0aL4wMQRPBvyhHP-PH1KORuWrfXY7sWwO-kBRc9wmlyAKwxfaCNO9CkXN0f-psc5gdY43W3K2f0LFqxtR7OM27KMl6CvTvCp82P98_zyGXzGrAkNQJu8JQDFGoZvyfCeNwUDrgp1YU7BnzpmJI1ZTPvyvO-YB1JPW5h3750A1UjC-r1DLuXi-UE0Ydmi87BxTFS04Q5N-zRFkWq-jVNx8qcJNElMVYNVItyOT5rPFmLWADuuOFQAudKjUl1XwTTiEv77vNwDOhaJW6sUVn4-EWo52oUXfLbSAaajk9OUu26qXIVvyEbEn8CJowWrjeMWnL9ZV7Drw5DZXFgHvgXntm69iFK0NUFf_prHitfyxCTQ0lAQUM6JDkAzy-eiv0UYUwMspvXpZZj4hHzxZzSsMvatCkoW6k7H5i0F8TXnu3meTpazrUvg7kkQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 970x250.jpg
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/ Frame E7B7 41 KB
41 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/970x250.jpg

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed016e73950774c7c93a1b3286285c8ea12082efb2875589d8b059b777e07cb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 20:24:06 GMT
x-content-type-options: nosniff
age: 83359
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42325
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jun 2024 20:24:06 GMT

GET
H3 200 noimage-MekMR78rBf.png
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/ Frame E7B7 95 B
130 B 8ms
8ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/noimage-MekMR78rBf.png

Requested by

Host: 6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
URL: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f564cf133cfc26e10d80a745642081f4999ce7881c86b84814f168c88a9023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:06 GMT
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:06 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19D2 0
0 45ms
44ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsthXVEbPLJLxlt1-nlnfdOwdc8VDImBUCAhDqs9I1aCcWbJVPP2p1POy6ieWq7Zw6bMXjCwfk-ES2AU68yEB-aanAbPXODYEVGbVYiVFNrIPeGe109_uCkvT5pQdc9K-Xgkz00_Zy2KWEN5XoRwt-J7WLnkjdWPU8m1xiNBDrmlHUjMU5C91GJA0TGEMx-cjw1bltN0eeqa2oIs6AdfpDx9RVjU6Za-iQ4cZDdllBgj04iiTbg3_5tLVdRPNl9nYqggj5FusABS6UMeVAf1Od8xdxh-_-6FH2SyVCm7SLydbG3OrW8FWf__9RY3f9ZVYZ0OMr3cg5FkKhvt3i6RW0eVRTh4Lt7UgU-b0qIRf5s14zrwQB7niOdS72Xdw45asd31X7g9DCTFGv88YAuUCFzX4WTwSts9bhUKqGvfXE40uHTHdhuePbDK6nIZ4naCBtLOGrdMn7lhRo_iK7vp9MoKh8vHtJIsLI-ttOtrV4RF3qNyqn5d6Atchac8g9BKpkmqaTiYy9qIFzx4RNTgTENUgmvPTRh_QJtNzyW0cS219RE0uPi-zJbxAZqoV7hpln3xOMabXjX5HJ59lCUybgoANZOcNdQ1cPXaTdPXbjN7sSj5kp98kx9fWp44UeWNWSTH-gZllS-Yw5ZsZya64HZQsYwwxisYpsGA17KrerxN3yKw_lnJumfB_IOgZuPwoOimDbw-O7j-H2toFf3qT1kuC1gnK3sfkIv3AvT49WeLyerczV1RKj7CjiOHyJPe_7bexsPzfSrHRCyVhhcwfJ134iKgc1EQ0VpHZTq3sRTfdW0nd3xT30WrRzyYGLHX1n1MBetnNK_gukwpa-DOvwcUR2cyNk6ig2ad4EDpJU2X1_tq-PMtxn12J93fgPU-_hW-OyonXeOv4jmyZDm0UlBxwyMHbkdb6fNjIk858XWG1cALyy613fjgxNuIxxjNJF_ecfYy1YsHx6I_3lL46eIphcWrILrBenCHQlpM28qi0gAjmAjX4sP_jsUrjoRlvQb8UphMJBvITNY5lbMf51gMWC-EehxEj91TzNMpzM42rVPrl276FiJSVIDyTlw6Ws4V4EdD5FBcqskpFNczq5D1q__7MiVugdhNmUWHn2csAsQYzecEJ4bRW07-VrIE1AggptjcOxx4Jbn7JEAD4gJgtndTdDQaPGkNf8dwF2HY5XSh3R9JJnY_9W968bsJOCyICKZdJOgOHKZdG1bDJLxLXMAgxLDZ9OgM9CRxNctZGD_KffYQ7UQkx6K0bPyeycePXoN82I_VIpqFvwcZL5Jr1UJZvKUM57iGO79ncK-mGUrQ9mrz8aw&sai=AMfl-YQXfWgE7_6gZYGUpZKAA3qM0pxnUg_ftZkqGqiAjcIBOw8puFDLQoPV5lSB7Y5nTk4gLjSCDURWVRjnbkH5yEP2COlAFKqMx1f2cY0YW5h8giu_57-UsBvQLMaTvYt9_TKyzaOJHAiGNejnz-8uiNe2vqirZgzvXJQJa0wSyW_YFd0pA_CaovlRFzPXnAV400mGkkTw0f0RkCg6oKy-DgHH-TyNz5xZY9aLPYdG0OWYdZjgcRdfrsCHYx6zKbjApahhrnA&sig=Cg0ArKJSzNzs_qdGAQgQEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=335&vt=11&dtpt=191&dett=3&cstd=142&cisv=r20230620.24673&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.ensonhaber.com
URL: https://www.ensonhaber.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Jun 2023 19:33:25 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/970x250.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/hoxton.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed016e73950774c7c93a1b3286285c8ea12082efb2875589d8b059b777e07cb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 20:24:06 GMT
x-content-type-options: nosniff
age: 83359
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42325
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jun 2024 20:24:06 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/assets/noimage-MekMR78rBf.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/js/hoxton.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f564cf133cfc26e10d80a745642081f4999ce7881c86b84814f168c88a9023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:06 GMT
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:06 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/ Frame E7B7 2 KB
916 B 9ms
8ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/images/logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92ccabf0692100aa94c81769d0f69dca14045cc2ae93a68212b3613b75840010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1069254919150873022/Lotus_Eletre_CONVERSION_Display_Banner_Animated_Feature_12B_970x250_DE-DE/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 10:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 878
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 14:23:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jun 2024 10:33:06 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0C71 42 B
64 B 59ms
59ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsurCGYrt4yEN4xZioDA0fDgz69cEGHBH3Ipw5Y2gXOA8PUQKScgJCE4hr9m-1mw78ce9gpct6xXf4v9zCSAGcEpEemsR_nCZfVCP4rw3jEXRw_8Qume5xkxK2IW8IIdkMBZE0udfA3X3hpc&sai=AMfl-YRxyvPwRWMHKe6UGMbQoqSegizvHd6O3LyjbGRdhClVbliV0z-MOWTf37YGo1OqwK95_cJWgfKIpvTLC_D1kKZClhyP9FGC_bxLHGeRsEMANxjhI6kHfwm2oFY&sig=Cg0ArKJSzLJwVy3YQrmgEAE&cid=CAQSOwBygQiDohorIuvFUMW4XQSYTjsBs5mc13HDv3isIl__OrbdTLJnXWcP_R7njdjYYFngCy1OqAmgZY6YGAE&id=lidar2&mcvt=1016&p=153,1407,753,1567&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20230620&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2966292975&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687376003246&rpt=852&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FBB0 42 B
64 B 55ms
55ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssVDn-pb3xe7KjK8Wu7R72TBgIzYb8ppBYvX4tqCEJZjaq4VPh6bWd17LpxCXPeZ7TYIqzHs5HBfAOCAiDG0BSRKotmB-Uzq6gmzP9AZUoma0o0dpX3dNztNqWFw8kwcL8HRb3gcY1Eyvq9&sai=AMfl-YTQZhZu_AJuyXB0ndrkqaha9YHlLFkwnSOJRCYEsG4LNyoanemUyP6hrfRkCgXPkDxKIU_obIGGiWsrNjt3rtsKPP7togwS_SbMksmzSfVdihdP56Ti2JxpQ5jv&sig=Cg0ArKJSzKaXtW_ipT-8EAE&cid=CAQSPABygQiDBWeSF_qv_-DuapSBgA2j_IAouLcsLVU04cXQwSGZ0AqROzcvEvhAm0QD92wyp4IMdElXqJYg5RgB&id=lidar2&mcvt=1019&p=153,152,193,193&mtos=1019,1019,1019,1019,1019&tos=1019,0,0,0,0&v=20230620&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1502987301&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687376003481&rpt=535&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA3F 0
27 B 44ms
44ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B7Qg3hFCTZJj7J8S1-gbhuaPYCgAAAAA4AeAEAg&bg=!v7ylvOjNAAYQ3eRoMN07ADkAdvg8WkA3cg5LjIFFHfG22ZYkKTNUon8L4mPBJ12KlN1amFvc67E78wiO43WEbqRaSHDF7lsQqW8CAAAAoVIAAAAEaAEHmQL3XzKR2HCNnLCjciV8jff1AVJoAO0Vk0gycLee44GV-0zMBmgUtKTJdmQV1NnMhb7l5gG3Qqe9hRFT018ZhTDOHoJej_i97WlWg4avWEU-5c52hmbHteySjXCP3AqdBIZ4R7MdCIzP5AEvgxIx1TmuHi94UZwV-ehSM_zKsg-CFvvUWN0Azvpx-GDEbuNDSo6Z02XWdBjXv5lKncSFZvCEOFTgCaghZE2UBN8RpNq1R9bmjSUkrtiZkuJutKMRsdvQIXY6qV1LGNhE1Nt1oA-vW2pViyCY7PmMsPhsV5mf5709QSBtmLWVAzbqhOOxAB_MZ5ZH2Qk6cH9d_uQW5s1R1-AU0wTjNGBV9hE02leaNF1wrYRXd-Xz4sanTE7vM23OexrJZmsBkq1jkWzLvlfUgs-fqOuxnUl9dh_TKjYpLWwfsVePe0B6fd-qI3SmtHTsvgG36Hf0e9mv_m7mxeSexecM5Oau7Eohys2jvihpeyhMBwhd-z5w9Ab9UE870gzjKp8NXcrZUGQHXNufPXnzBd7CRMCD7nltbPpsngpzGH0ecyfmSmyk9OkFclJ018x4UsarlabgPlrWFGD9r71h2gOAd3xqkV2YuMHzvkFlrB4B6Xp_h2Z1ZLEifYNyzlwGXEJMjgJEonjYoZ29N7afMpAse7MhCLSXsCxCJ6I9x-bD5frBTJe2sOudhAUhBk47nescE22C1EYm5kBQRy2AGZ0XZmJkjU1YDEXxyXI6puG_nYNA-GYCugdY9OHbuk_0iEQgJv53oDNi09SJz-uhfX2JwiIy8delrkH_rcJMr2-HWoxlJsSzD_25VVEzsoJzcI9t9xOJl5eR6Hxd7G0SRAtQ8mxBvXxI4x4GxFAM0XTwpH07wDbyfP5LvkEAyJU_Qtd76niJkVybOSOzfh_GJILZGN7t7qRmh8t9qiAbDfZhpnOGMG8zWf7vOa57KITeiKyCmFArgFTOly9jkosUcrd-GLqU7oX60ueaSm22ZIPMEA5iTI3P

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 95ms
94ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDi0y,pingTime:1,time:1722,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D,%7Bpiv:100,vs:i,r:,t:696%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1026,o:696,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B686~0%5D,as:%5B686~160.600%5D%7D%7D,%7Bsl:i,t:696,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1026~100%5D,as:%5B1026~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:180,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:41,sis:326%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 95ms
95ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDi0y,pingTime:1,time:1722,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D,%7Bpiv:100,vs:i,r:,t:696%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1026,o:696,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B686~0%5D,as:%5B686~160.600%5D%7D%7D,%7Bsl:i,t:696,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1026~100%5D,as:%5B1026~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:180,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:41,sis:326%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 24E8 42 B
64 B 51ms
51ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuUtPfOky33Q4YG7rzyzvDujg-mwphuKjfPz3mPfZpwLVb59E3tlqWGvEoJzOYNjXGVZ49rQkEU5u-715WEAWXQ-fF99jeEz7VWitAPcNwrHik05TkW8pejz4aBCz5MpcppB2xYhO297hsT&sai=AMfl-YQzlrLtm1WzPvZwj-NNb_lJZtn5sfvNCKFBsVIxSxCdiY8DK6uPE9uQfIcG-0w2oCevJOXCdPpqpAETY8lcgDrdETcY_PjDuqh9-97EeHhw4ioNeCFXaMOYKojt&sig=Cg0ArKJSzFGYFUpSnUfMEAE&cid=CAQSPABygQiDDcubzUPIUAUR-cENsgp2an17qPunSIBQsiGo245MZSuSKj2bVpmDK4LoALP91lZDmeIRLtTMcxgB&id=lidar2&mcvt=1000&p=155,315,405,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230620&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2619639180&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687376003738&rpt=607&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBB0 0
27 B 42ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=3030842695668&version=m202301230201&ct=76&x=1&cor=9072290020843977000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C71 0
27 B 42ms
42ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=550741679676&version=m202301230201&ct=76&x=1&cor=8110768988406991000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24E8 0
27 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4094770207436&version=m202301230201&ct=76&x=1&cor=9966132341682260000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19D2 0
27 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4023091464838&version=m202301230201&ct=76&x=1&cor=4950728767053787000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 03032023-031229407-320_1200_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png
s0.2mdn.net/4528404/ Frame 7118 55 KB
55 KB 7ms
7ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031229407-320_1200_720x610_stoerer-gbplusdd45da6a-b9ac-4a7c-9506-d902c6e1e866.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2b86f468d5bf4d09d57039677a5b7aad9e9fc146b8d33e0686bbe7e0361c465

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4323423352959208367/index.html?e=69&leftOffset=0&topOffset=0&c=NupszKAQxT&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:05:06 GMT
x-content-type-options: nosniff
age: 23301
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56185
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Jun 2023 13:05:06 GMT

GET
H2 200 dc_oe=ChMI7dC9uo3V_wIVC4zeCh0nWQs6EAAYACCQvfdKQhMIieiYuo3V_wIVSe3VCh0pRw44;stragg=1;&timestamp=1687376007840;str=Show%20Slide%200;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame FBB0 42 B
401 B 86ms
43ms Image
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI7dC9uo3V_wIVC4zeCh0nWQs6EAAYACCQvfdKQhMIieiYuo3V_wIVSe3VCh0pRw44;stragg=1;&timestamp=1687376007840;str=Show%20Slide%200;strtype=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
45 B 17ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-3G92ST5T0Z&gtm=45je36e2&_p=829601041&cid=1137403029.1687376003&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAI&ngs=1&sid=1687376002&sct=1&seg=0&dl=https%3A%2F%2Fwww.ensonhaber.com%2F&dt=Ensonhaber%20%E2%80%93%20Son%20Dakika%20Haber%2C%20G%C3%BCncel%20Haberler&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3G92ST5T0Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ensonhaber.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:28 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ensonhaber.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 95ms
95ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDj32,pingTime:5,time:5720,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D,%7Bpiv:100,vs:i,r:,t:696%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:5024,o:696,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B686~0%5D,as:%5B686~160.600%5D%7D%7D,%7Bsl:i,t:696,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5024~100%5D,as:%5B5024~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:100,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:41,sis:326%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:29 GMT
server: nginx
x-server-name: dt28.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0C71 43 B
215 B 94ms
94ms Image
image/gif 2600:1f18:1aca:4280:59b6:98e9:4469:e059
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1316115&asId=fe83c85e-6a84-4a6f-13aa-cddf127f38ed&tv=%7Bc:gcDj33,pingTime:5,time:5721,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:40%7D,%7Bpiv:100,vs:i,r:,t:696%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:5025,o:696,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B686~0%5D,as:%5B686~160.600%5D%7D%7D,%7Bsl:i,t:696,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5025~100%5D,as:%5B5025~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:100,fm:tHQtKyc+11%7C12%7C13%7C141%7C142%7C143%7C144%7C15%7C16*.1316115-71738579%7C161%7C171,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:41,sis:326%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:59b6:98e9:4469:e059 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Jun 2023 19:33:29 GMT
server: nginx
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 aksarayda-kayinpeder-dehseti-damadini-bicakladi_34315378.jpg
icdn.ensonhaber.com/crop/382x450-85/resimler/diger/kok/2023/06/21/ 63 KB
63 KB 20ms
19ms Image
image/jpeg 2606:4700:10::6816:3f4e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://icdn.ensonhaber.com/crop/382x450-85/resimler/diger/kok/2023/06/21/aksarayda-kayinpeder-dehseti-damadini-bicakladi_34315378.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3f4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0f99a25ed4cce62a4f679d89bdf6cd73ebb92a6ca38fb6fd8103f8cbf1ef62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ensonhaber.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 19:33:30 GMT
x-msg-05: fetch: save cache with 30m
cf-cache-status: HIT
age: 3354
cf-polished: origSize=66763
x-vtex-cache-status-nginx-thumbor: MISS
content-length: 64258
x-msg-cdn: TT12
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "e16facefd2ce9b59216e25e5fd908d419f25b2a3"
vary: Accept-Encoding
content-type: image/jpeg
x-msg-esh: crop
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 7daeaf039b4419ab-FRA
esh2: 382
expires: Thu, 20 Jun 2024 18:36:21 GMT

Verdicts & Comments Add Verdict or Comment

114 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

47 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ensonhaber.com/	1970-01-20 22:18:56	Name: _ga Value: GA1.1.1137403029.1687376003
.ensonhaber.com/	1970-01-20 14:52:32	Name: _gcl_au Value: 1.1.789136571.1687376003
.adnxs.com/	1970-01-20 14:52:32	Name: uuid2 Value: 158538110131769038
.criteo.com/	1970-01-20 22:04:32	Name: uid Value: 0a1c0daa-5a22-4338-b2ae-4a4002d75284
.casalemedia.com/	1970-01-20 21:28:32	Name: CMID Value: ZJNQg2gdFYgyxIJWskXx8AAA
.casalemedia.com/	1970-01-20 14:52:32	Name: CMPS Value: 1176
.casalemedia.com/	1970-01-20 14:52:32	Name: CMPRO Value: 1176
.ensonhaber.com/	1970-01-20 22:04:32	Name: cto_bundle Value: YI_4U19BZnFUYXZYSDdhUWNqc0txdXklMkZUem1VRmJISVdXdUlLVGpwSCUyRlYlMkZmR2tianMlMkJFelNrT1lQNUpFSmVmS004JTJCNCUyQjN6MGdFWjhqWFY0aERQY2YwZzVwN3FyeWYlMkZRaERKSTRRd254ZzVVeFlqeVRmQjhtdU51U0NmdFVBaGxIeDRwWjJNZUNsdUd5cWRqN1Y0QjRxNlZVQSUzRCUzRA
.pubmatic.com/	1970-01-20 12:44:22	Name: KTPCACOOKIE Value: YES
.360yield.com/	1970-01-20 14:52:32	Name: tuuid Value: f7f1abf8-4274-42b8-a16e-82b867729c5d
.360yield.com/	1970-01-20 14:52:32	Name: tuuid_lu Value: 1687376003
.everesttech.net/	1970-01-20 21:28:32	Name: everest_g_v2 Value: g_surferid~ZJNQgwAJR9DAWAAD
.pubmatic.com/	1970-01-20 21:28:32	Name: KADUSERCOOKIE Value: 6A930366-0F68-4D52-9662-BA97B074099A
.doubleclick.net/	1970-01-20 22:04:32	Name: IDE Value: AHWqTUkCQHM5I1M-861jZZC2hm4l2wjXbwhnZLk_OZ2roPPMxAywbsdmi3OhFMqruTY
.ensonhaber.com/	1970-01-20 22:04:32	Name: __gads Value: ID=bb049b8a1eadb93d:T=1687376002:RT=1687376002:S=ALNI_MZVYL1DCZhOJYjVwDLP4vi1gd7cgA
.ensonhaber.com/	1970-01-20 22:04:32	Name: __gpi Value: UID=00000c4ca10b5e2a:T=1687376002:RT=1687376002:S=ALNI_Matosp2MPvZVgv269h8KXkq8pr3Qg
.adnxs.com/	1970-01-20 14:52:32	Name: anj Value: dTM7k!M41.D>6NRF']wIg2HaRFa$ew!A#Eo(<j<dINiYhTyXnfi8FW/l#7Gq7zB#7]7$^NkBX/qde3G%4P%QenVtQs(j#iP(Md+>)fy)Tc*m#Y
.quantserve.com/	1970-01-20 14:52:32	Name: d Value: EBUBCQGkKYEA
.quantserve.com/	1970-01-20 22:13:10	Name: mc Value: 64935084-38750-c0f45-857ea
match.sharethrough.com/	1970-01-20 12:53:00	Name: AWSALBCORS Value: 1fDp3Z0jkd4Jl0pnH5PbdJG2Ivy3k897aBScDVZfssbd+p6sZA60VvNdp9EQP4tOrw7owiCjL6sJyUVxonON6585wCygOG/9pYe1kiDVcqwNc/eM7AeGPeStPmov
.de17a.com/	1970-01-20 21:21:20	Name: guid Value: 1.156396476665248521
.travelaudience.com/	1970-01-20 22:13:10	Name: _tracker Value: %7B%22UUID%22%3A%2241BC2212-86CE-4B41-A294-CDB653C8EED3%22%7D
.simpli.fi/	1970-01-20 21:29:58	Name: suid Value: 93547A5F1B5F4C84A8C184F2B5D4A934
.adform.net/	1970-01-20 13:26:08	Name: C Value: 1
.bidswitch.net/	1970-01-20 21:28:32	Name: tuuid Value: ef313630-10c1-4667-a7fd-4d8d2b9e160e
.bidswitch.net/	1970-01-20 21:28:32	Name: c Value: 1687376004
.bidswitch.net/	1970-01-20 21:28:32	Name: tuuid_lu Value: 1687376004
.mathtag.com/	1970-01-20 13:26:08	Name: mt_mop Value: 4:1687376004
.yieldmo.com/	1970-01-20 21:28:32	Name: yieldmo_id Value: gfdae025cdc15a742df4%7C1687376004304%7C0%7C
.yahoo.com/	1970-01-20 21:28:53	Name: A3 Value: d=AQABBIRQk2QCEPC6GikEHEnZpwkOp8X23oQFEgEBAQGilGSdZAAAAAAA_eMAAA&S=AQAAAkcKjsSTy3C_sRaBx3qxOnY
.bidswitch.net/	1970-01-20 12:42:56	Name: google_push Value: ATf1kGNQhPW7JkQzCmFh3-NBQVY4qpYDAYjEihb4iXnDAiefImlWg4PyL6ikW7M_cykCYGrCfo5BMJ5-EegD4vs8Lu6BVAgsZaoIRRpg8ADFGT1MCT07Dl1yhNV0llISa8XhkI0hDCjF6ATr
.adform.net/	1970-01-20 14:09:20	Name: uid Value: 2408282090387916512
.ensonhaber.com/	1970-01-20 22:18:56	Name: _ga_3G92ST5T0Z Value: GS1.1.1687376002.1.0.1687376004.0.0.0
ads.travelaudience.com/	1970-01-20 22:13:10	Name: _tracker Value: %7B%22UUID%22%3A%2241BC2212-86CE-4B41-A294-CDB653C8EED3%22%7D
.adfarm1.adition.com/	1970-01-20 14:52:32	Name: UserID1 Value: 7247224753256790165
.1rx.io/	1970-01-20 21:28:32	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003%22%7D
.targeting.unrulymedia.com/	1970-01-20 21:28:32	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-c2bba74f-3da4-4a38-a271-bbb556a0d77f-003%22%7D
.3lift.com/	1970-01-20 14:52:32	Name: tluid Value: 1310429386127022135374
.blismedia.com/	1970-01-20 21:28:36	Name: b Value: 64935084EAA1B714EF5B6883BLIS
.w55c.net/	1970-01-20 22:13:10	Name: wfivefivec Value: 9pHcc2g41Qc3A05
.w55c.net/	1970-01-20 13:26:08	Name: matchgoogle Value: 5
.id5-sync.com/	1970-01-20 12:42:56	Name: cf Value:
.id5-sync.com/	1970-01-20 12:42:56	Name: cip Value:
.id5-sync.com/	1970-01-20 12:42:56	Name: cnac Value:
.id5-sync.com/	1970-01-20 12:42:56	Name: car Value:
.id5-sync.com/	1970-01-20 12:42:56	Name: gdpr Value:
.id5-sync.com/	1970-01-20 12:42:56	Name: callback Value:

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://s.ensonhaber.com/assets/js/home.min.js?v=3.14.62_110bdcf(Line 9) Message: WebSocket connection to 'wss://ws01.ensonhaber.com/finance' failed: Error during WebSocket handshake: Unexpected response code: 500

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6ecf181b9bee539ab5e4bc77a5f07fbf.safeframe.googlesyndication.com
accounts.google.com
ade.googlesyndication.com
ads.travelaudience.com
ads.yieldmo.com
adservice.google.com
ajax.googleapis.com
api-stg.ensonhaber.com
bid.g.doubleclick.net
c1.adform.net
cdn-ima.33across.com
cm.g.doubleclick.net
cms.quantserve.com
d5p.de17a.com
dclk-match.dotomi.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
eb2.3lift.com
ensonhaber.com
esp.rtbhouse.com
fw.adsafeprotected.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
icdn.ensonhaber.com
id5-sync.com
image6.pubmatic.com
invstatic101.creativecdn.com
match.360yield.com
match.adsrvr.org
match.sharethrough.com
mug.criteo.com
onetag-sys.com
pagead2.googlesyndication.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
region1.google-analytics.com
s.ensonhaber.com
s0.2mdn.net
securepubads.g.doubleclick.net
ssbsync.smartadserver.com
static.adsafeprotected.com
static.criteo.net
sync-tm.everesttech.net
sync.1rx.io
sync.inmobi.com
sync.mathtag.com
sync.targeting.unrulymedia.com
tg.socdm.com
tpc.googlesyndication.com
tr.blismedia.com
um.simpli.fi
www.ensonhaber.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
124.146.215.46
141.95.33.111
142.250.185.98
142.250.186.34
151.101.66.49
172.217.16.194
172.64.152.222
178.250.1.11
18.156.187.34
18.203.5.185
185.29.134.248
185.64.190.78
185.80.39.216
185.86.139.94
20.127.253.7
2001:4860:4802:34::36
213.155.156.164
2600:1f18:1aca:4280:59b6:98e9:4469:e059
2600:9000:2450:6200:8:48e:53c0:93a1
2606:4700:10::6816:3f4e
2606:4700:10::ac43:28c4
2620:116:800d:21:93ca:31d8:d86e:38f6
2a00:1450:4001:800::200d
2a00:1450:4001:808::200a
2a00:1450:4001:80b::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::2003
2a00:1450:4001:828::2004
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2006
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2001
2a02:2638:3::3
2a02:2638:d::d
2a02:fa8:8806:16::1400
2a05:d018:d29:3601:8d68:cedd:2fd4:de35
3.33.220.150
3.76.139.6
34.96.105.8
34.96.70.87
35.156.203.47
35.190.0.66
35.190.39.111
35.204.158.49
37.157.4.29
37.252.171.53
46.228.174.117
51.89.9.254
52.215.105.179
69.173.144.165
74.125.133.155
76.223.111.18
85.114.159.93
89.187.169.43
99.81.190.73
009d4ceeb1168ae5d225f0898ba84f53743d9051b32b5a016bc7c867f32f0c5c
00f209e5346c214d363ba40bcb0d7dabfad704152bb606c4c9602e379bd42d0e
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
01e1caf58394f459b15a0754ea42341ff3c697adc5eb4c077f6d9af374654b0c
0205397c26f5c55a4911a68063bff397eebf95c71188a2c8777d230b570c561b
0486d620f8c483ed0fa8b56edfef5799ede455138606b4392604174847199be2
05ec57e3bf50c723dd83849e24de2ddd91ee49fb7c72c3a80e4061eb723cacde
084b60049497a98a794e99774a0e6471251120d462fbd6c75c7056ca94b8d4b7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ca8877766a4fcd6665a6fd63e69359eb0d19d47df34e399d34345c12e00db4c
101470fcde40e5ad29c691a0cc4276b7e311972a8e02a684f19db29fd4698645
102b58b4e227d81042c84d5eccdb17a607b87d33b01c258c1f820fe9bcc18b61
10c2718b5a8f0a342627ce1e4da4ee9ab45fcc24cff760530da5a33d2db6cdf4
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
127fc5122908ed58f8a0595d3c00f9202b406d774b2b6ecd834bfba408a374da
12bcad3deadc62829c01d1c4854713a237a74515c550c48b8cdab9e6e1bc9996
13206b0b7ede3e24e8e36376604cb4138487fce06098e85b2254f53083b549f5
13cab061ea47f0fe6c3fd6b37e6728beb40dc447c3086aef9ba1132eb0df6490
13e3adbde6b2b5292f5aa91c15bbaaf9771ca5c2e8d54a61f41837d1a13fa888
148c107d6580ac011291431566cc22525118c456c7cd6ebf82a6b967787a226e
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
18716a69ac05e85bcd36f171cf3517c6f86c48d2814cd715b8f212e1f93c845f
1b18344098c7beeb17792064f962b0325c6fe6b6b6e2708a521f346b71d4d283
1b34b3d2c1002127f4489735b49d53ab7d4a369930f9280cb4a3fef6e89ed439
1b86bb840a36f6a4bd1b1ff4f64f3b62acc8b7b8a868bbdbd9f5a24c6bdb0ddf
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122
1f43af206870986a648b5db6570c0488ead3ab087202e82168e57a73af4b5124
1f442f70032b533ebd29611e95f939fe820610aba25a11e776ddea4fe83e283a
2302716051f0963269ff25431c4c06772a2fd6fb9ea23f7ad5d5d5eb4f13478e
2618637b907790054e18fd6cfc745da918d2039de89109bb0890edf1ddb2c223
276e17bfb22e4bda39154fcf2fe17921a530e3b7c5697d92c09348e1ba60d042
2b95cd5ba6f76e9fc0d9a21d8a08007a3522b988d320517eba8723a6a2b1b493
2d0a8c318709b662988173b2343311cff1342159884ea66bb2f6a98287ca916f
2f2688eeeeb6d99e09adc5d8aeea2963fe4034ca8f98f639f24dea4e0d0f7d16
2f780d8ef9385a7f0398b7707b8c5bed5c144050c6071828196906d2baf469f6
309abe44eb60bb130df184f61f443953cd3fcbc5b909dd005ec72b3b15021c75
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32d75b8d9906e4fe046307d507ff6d1893ed34d99a6f28f931301ed5d296728b
332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
345b7b8da6f10a856720fd05570e1caa0e745fded85e2e51d27bd7c2b6da2398
34df2cadac0444599fe032eaa1b5d521809cbb2dc76c7368b66405217c7a67e3
34ece9c8a41733884a05c03aec9df49856e8c44a93a0960fd20f317a6d8b437b
39d4c4f0dfc10291d2697f8eb1274b6071ca11531b2a7f6bb109b9bbe91e32fa
3a1a47d73652bcc5b2be7cd02ffb055ac5a14d3424d949d1f9232a09d2720db0
3b0f99a25ed4cce62a4f679d89bdf6cd73ebb92a6ca38fb6fd8103f8cbf1ef62
3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b
3d36e747eb562ccce4eb72ec40b80fe06798d30975f4951a04aef2c60def318b
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
416a4c85b488c3fe2ca26298fc13a4fec28626649939aeab1f5862a27e046cf0
41a27147fbfef41f281db7f00102b2b4860422aae427740623a145892f477160
44390ffd4b53f31574a15edd86377376b061b7096ef0a5b1ff76da6dc4008ab6
446252cf4c3b550af3d4d61595d3660595b40a9cf495223b70920f18ff626ff8
44bd343862046968424f4d9db05d46c1e851bfca9c5005906894c157fde2473f
44e47e47c96c54501f577da9294014414a2f716ee0f6fa63a44f981be79337d2
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
492ad43c4dbd6e861f77eb18d1c76f9400ba294eddf6f58cf71946450d10a926
499d37bfc4999187c4c93732d143aaa8946aa63dfd380c54130457e7000cd1d6
4b0d8a677f419fd4a6e819981bd26d40d38c980b1d9d90795bdb76a4b3170d80
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f
4dde986d501f11f0aece25ea490512c34f0fdff0104a4858b61eacda34c107d9
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
512273e8d454edde250416038c73b4752bc4deecaf8bcad90bab27cbf9e4e497
53a42cf5d32fb8153b2f58d5ea30404e2c8cdac08e85153df1849682098c1cbb
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
586e363f37521dcbfcd7ba32cc2305081db89c33d632f9db1cb95a6eaf092031
592726dcd36e27f1287a1ff2e6d14e5e68b928cd4eebed720c267d4633277286
5d3a97eb0de0a03be74334808c5faad0ddb368de9dce18363702d500326f1a78
5ff78e2297a3556dfba37ba6769e1f8d722d2ea9dd2d8cba409f91c06cb25a18
60280b8ab4c8d489c74567c55e14945b935c2f5937855f808163ee40a65f065f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
642690da3a34058586de455c174c0ca0ac0cfe90621a06602a60fd94bd204218
645709dcb09b2700fd5a5938dbdf783ac90a88334e5104041db53302441f33e4
65803b3152b8225540cdda2ae8e3a298ba9eb591cc35d9e7fe4b906b0f515ead
68c54025d4765832f03ef10c8468ca1d849ee429b51b4f264890e54ce27f66a2
691257cf7d510da3434f5eedca2b2e0137949c698e3750c7705526a1ee75684c
6b05416d448486b4f4bb414d78be3b4a8f3666c7c51b8e6aa12e74ea35f10018
6b15c647e3182c5d3756c08fbc673f5212d96de7257791a114e66cebe38781df
6c2d6ce4a7f2a02270cd2693256f756b8ed4e2c64f2eb6b9b33cbadd22cc2140
6d285ae6755d52c452904f5bdfa4a6c2082186d695304b242e9db2f12461f02e
74d5ddb896390fbd0d379431074c833d31f208835ef558dd0ede1264e46a3a5f
768382b088c5cb58e4a670880ea33d6926e16ddb5923a937f41f660269c676d1
7955e24a04f0f6979b9730697b45921ab3f81b03ba0fcbb7325b668d6bd23da6
79574e015175b8ea2f0366b354be78ae5be45c89150d0a42b7bfa6c9963dd5cf
7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445
7c19206c024726a36da0e04d60a41053c3151874c32953bb90c46e79a0908685
7c5a4091ad723f5a0ee361cb4ec5ce851d11ed195d220647fe3399e0fa9f570a
7d652237f8e2a4a8d6db749b8f9be7ebde3372967fb4454887ccf380460c369f
7fcc05e8697e4fa1b9af99a987029133c782d8ad781d6251ea097cd2dfc5ee3e
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
800532bf9b839ea479ad22d9735b2de456c113e98869f3d63cf92fe1643e469a
80d2ea64feb90fec56aab7ae35078d8addd9033751386fdd52de2cab7bf87dd6
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
816d252bcef80b84b9ec2c9ca60fa16e4af7fd8dc2932f68c77844a74cd87a55
836b38cdbed3a29dc66669048e7c7f7588fbe2514f32b925a5f677e7c6722f36
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
84d4446663c5bb743f2f22240837118394ada81bae48ac3aa34bdc62a1016d7d
853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb
88b1258dac80af1416de261b7b1ed0c629ba684d62b2217d6429c3c609c007d3
8a212de6d8a0fc6a0d81aa275a848fe5de91a15be922fce6e31cd1a8d9fb526e
8b8da33976e16cb84f8ffe8224b95df6e90a1f81f604b99b0ed1b505c983f68b
8c3074afa0c578b83189e58c1adbf72ba45e77903f4fb8cdac3c1e5f4dc668d7
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ed948e6d6586fc5cfd9284799eb76290f6c6067a481efbb08e1720977b33c33
8f273840584f0246670b192fd23e6aac48cdad71d53ab3526d79f9fc90e88bb9
90980421e3762accc4e39e6d786c4fbf9cfc9b1e6bfc4a02550ef3fbbfc585f7
914e792e0d03a775a673f70736e89594938337065f4e5bc5906e3b5c3c5acf1a
923ac60ae2b51d9cb2025f34d30e8188c5bdfb61e04f7d5c88908b56800c7ed0
92ccabf0692100aa94c81769d0f69dca14045cc2ae93a68212b3613b75840010
96ad4daa65142f22e17fd212940a4997af6e475206bd70a8da1a4e293f9c2d88
9838cf0fe876be799851d050135c445d90b5bba432de6f60f4fa68ed7d6a0dc5
98ce235596c3042bd01d1609085f467f2d3630b54912434289bdf50c329d8c52
999415a508fe78341a8e9bb9f55abd136a4cbb7dbf615028356efd2c023a40c2
9a3a58738834d6debdc3f257a5775601741fe7ea062eb48c8eb02ee0ad601f20
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d12d07d40ba2f3439d466eba90f27f46581293306f8be3acbb0909a89b4e85a
9d7a6b1e7bc960187d4250c7b75e7c892a1169011a55718d6bfdaaf3fae9b2a0
9de4631fb6802442e80c56133c419f2ce1d5979d17c33b421d5dec1d23468571
9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1f7724ef64a25174ce00e12b55284e5fc652f58ef84a46bb6719d234fdb1e8e
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a6f564cf133cfc26e10d80a745642081f4999ce7881c86b84814f168c88a9023
a7b0e537ecabd3d1f81dc4c203a245b706c3cc3eed9089097c5c755a835786aa
a9328fea776122005c824c4e6a1e402ef53ad3ae9d5afe73f91681b0f0ce59e3
a99b27d4778209c98574607285507ac37decea04e3592ec3377d72c4965966f6
aa74b2168acc1798dfb1036c1831c1564d5ba20ff2f0ece8fb69bbd25c3cc8be
ab6608273f8d3c48c4080e531a5f99a8365dac7245e362cdb57c59e024b20a94
ac1f8c2a4ee7c0ee40acb4937d0459e1e290abfa8229c4b7fc4d7992858e1cd9
ac546194565bbef33495adfd3072005ecb03e2563f484d0228435a8c4ac42f51
aced13c5cde18af20f9f6d8691609ddd5c748c18e0437e5e887a960977f5c73d
ae8d2a30192388badb421ec0d60e4eb6a691164a1184dfd1dd956e5878993bb0
af418d23b71632f7ca5a43aced8c8ecf1d3e577ea866aab2cffbf6c3ca7d690b
b05c53bea43812b44e419f33dc164c279d0ee87cb23084d657202bca8017bec8
b0b6c2ef65f2486f7be1c3b49a50e88ed2602d29d1f9ecb03ddd4e198c8e5910
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b31b08f5197d4bce6f97586010b2699dd3574d0b5dcb9735aa4b31ebf7a39b77
b57c9aa30eb75613091d6753b26caa6b3a56e24b7326ec4512a2ba17678def7d
b7d079bf21e72c5449d5aa75a4916c4556a0fd2b02cadd2a93aa1d1529957722
ba6f4248b6606355f0ec65156d57203c548498013992b2806a776edab1d40a6d
bd0cba1a894b8a9bebd1394cfa675116713f9045497993f05291cd6a0b501f63
bd1f0ba991b730edbc9e72f9a6f8a290ef8d852644c9629dc479c7eb18c1ea1b
bdf77c2e2ee4fce5ccc2a8b4105861708c75bda5ffe264b80ba86d5201aa2aed
c17cf0e01b410087dbe8dc19706c995f4d3b246e64e1db192138dd6fe826cc4b
c27495eccd08463663385ae4ddc305e621dd1e1fe7a05d710733b0f388e6ef9f
c287ba7fe796611bb01f2fd3996698167128d05427019e7f97d48b961cba3b1f
c2d95b13f2805a42b1eae40e7d96574e0d844c0678f412844329038764573c78
c3f737780ba32e7fc297573bb8e339c7c20126e074761dcb0ea5106c4b0cf008
c467da3d749a15b2346139e7f9dfb19fe5a819e4345335be1997304e8e4da731
c49acbce18de283ee4d071ecb179378db91393dbf7ac081da6c321f866eed7b8
c98e974dade636fcd482b003077a1dfd617cc234459ab65007ca146847d00f0d
c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d
cc041c68a2177f55b4e9ce51c16fbd2c038effbaba704a9627e02e587d1bbc25
cff8001763a4cb0cb81352e07fb9927790673baaeda29140c072f30c5933cf10
d08b4ad7929d3ab1d02b1e60e0b29d4dedcba69a1152a257f92f4fa00213520d
d75bfbf5ba3de72260b76ec939d4854161d75995b9eb74bea8416c9aad5e0b33
db14f5793d357dcf51166ba19a5b233cc9d9bbcc059f160e2f0069b23441dca1
db8b02e27648c8923b73cb3b9582718641e079897b7bfd4b32e74786e8565200
dcdb25c59c07dfa5cdb4fa539245d0aa2141046352b9dc84e317db3d91546baf
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d250710905b1e58c752cfcb0b3a1f35623fd5b86764fbf9e8b0b0392f2ca32
e4521175a8b7a60fd7d7ca599212a6e15dfde0f747260f53584961befc21bdac
e71440bc2e2f56dda4e31fa8536c75b43283a87bb158b55484be9e1e23d50f0a
e92728d3f84f8648d013fffa073f09ffd774aefb957c5bc08b98c9af97c28979
ed016e73950774c7c93a1b3286285c8ea12082efb2875589d8b059b777e07cb3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef7461c0051b325805c887adc6357a464dae3efad3720214b91799a501afb62c
f0bdf831bc0414f96ebd455a30c1ded4739f659071f0dbb60be94a3d4acd8f4e
f12aca719abc5d5d5e131937088372640a98837acd615dddff9db43ca7522f47
f292c72aa85fdfd6d04f159436d8be01f6ca4186fe1442bf68c946a4a37811c3
f2b86f468d5bf4d09d57039677a5b7aad9e9fc146b8d33e0686bbe7e0361c465
f73a7c4662797dccfa62e357e6fa213570f595456b540ef9e916ec684162485a
f8ce6f350e90bbf4799d659b4555945cf96010490800a128ef48bcd33ece1b8e
f97e249d0d02045935033d1bf463910f81ae1fe89a5ed9b61c1dd369f18f06ea
f989066757a82b34734e6ba6823770f5f1b0f3da11595bf1cb846a91c602ec07
f9c22b1c52421d79788e5590f0b33e9847080e119b367d23f7a3ab8fc793d986
fb0e8e164f8f994c3be7045bd8eb86334380d96b47561956b046592d145d755a
fb578159169bb38173ca68b7f9ce061b18af4e4e6724bf3c9c3e745cc954f177
fc57fc68d3757326755245bfe0def53dad7a9ac4de98281bb51807f3e0b88068
fcdb3fca9bce88c148c41f71a730872366405ae600fbdae89a5439c685a79295
fdbf1de1c1d2b32ed534337136436e7519c3274d614ce809465065db84a35b3d
fe2182626d97612dfb6390dba18118a5f65a65d912fdbe4a9bc2e158f5c13dc3
feebe1fce6a2c5b44c30aca519403f048c63e4d0f021a472052065feccefc441
ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884

www.ensonhaber.com Open in urlscan Pro 89.187.169.43 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

362 Requests

86 %HTTPS

38 %IPv6

45 Domains

61 Subdomains

38 IPs

11 Countries

4643 kBTransfer

8707 kBSize

47 Cookies

22 Outgoing links

Page URL History

Redirected requests

362 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ensonhaber.com Open in urlscan Pro
89.187.169.43 Public Scan

Screenshot
Live screenshot

Full Image

362
Requests

86 %
HTTPS

38 %
IPv6

45
Domains

61
Subdomains

38
IPs

11
Countries

4643 kB
Transfer

8707 kB
Size

47
Cookies

362 HTTP transactions
11 data transactions