wheregoes.com Open in urlscan Pro
2606:4700:3034::6815:240d Public Scan

ec2-52-213-193-244.eu-west-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

c6e667ea4670c86fb9e6ed0177ddbcd06a7a2365b10773a10d2b16a89a65241f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
content-encoding: gzip
an-x-request-uuid: a8f7e025-4877-4959-a028-6726836578f1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 433 B
771 B 320ms
255ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=3f4425f5-2de2-4296-a4f5-fa0c6be47da9&l_pb_bid_id=18e8dcc9e31328d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3f4425f5-2de2-4296-a4f5-fa0c6be47da9&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&slots=1&rand=0.031182542028125093
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d20e7a65a8a4956635e85b03c1ffc83c222079cf0134c37a899b1b265bdd52b5

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 433
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 411 B
747 B 239ms
174ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=1276a9db-925a-48bb-8bbe-85a7d851bf28&l_pb_bid_id=196194e354ea397&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=1276a9db-925a-48bb-8bbe-85a7d851bf28&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&slots=1&rand=0.8156996630004261
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 2fbb85ddc10223570bfabce9eb20b3da91a3a3287e3a0a7d0ac34bab3a466f3b

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 411
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 442 B
954 B 168ms
103ms XHR
application/json 2602:803:c003:200::91
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.domain=wheregoes.com&tg_i.page=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&tk_flint=pbjs_lite_v7.54.0&x_source.tid=0a709694-4611-4887-96a8-af11e1443764&l_pb_bid_id=20a58b7859862ca&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=0a709694-4611-4887-96a8-af11e1443764&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&slots=1&rand=0.48565240738748816
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::91 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 66c8c3b264efd2a2d21ea69ae7185e41586d5277947d7efab31f3fbdec30a847

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 442
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 29 KB
8 KB 198ms
154ms XHR
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 2e19a8517bf4a358abbf22945b66ebc5bd155fdef2e79b5d90bd6c2a6e37d9ba

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:20 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 136
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 17 Dec 2023 18:05:21 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
400 B 67ms
26ms XHR
application/json 216.52.2.16
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.16 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: ced51b82139e1d3fd4c1a939933cd263e51ced2a105b665f818d6b37f995100a

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 17 Dec 2023 18:05:21 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 1 KB
847 B 800ms
666ms XHR
application/json 52.213.193.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&PageUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&PageReferrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.193.244 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

3e4c94e85e79ab700df5d07d011807691632f86ad0c21b6bf7fe3568e499920a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
via: kong/2.8.4
x-content-type-options: nosniff
content-encoding: gzip
x-kong-proxy-latency: 0
x-kong-upstream-latency: 548
pragma: no-cache
access-control-max-age: 3600
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://wheregoes.com
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 59ms
28ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 18:05:21 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 49ms
14ms Script
text/javascript 18.239.18.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.18.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-18-118.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 04:16:06 GMT
content-encoding: gzip
via: 1.1 6f348d610065e2c8eb4f3a0d2f7caa8e.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P6
age: 49756
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: fOPEmkOEnJdkR9-FMjYmOQO0GQ0_Qmn0Z8Iu7ECl-XaMS8IV2m4c1Q==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 43ms
10ms Script
text/javascript 2600:9000:243d:2c00:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:2c00:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Sun, 17 Dec 2023 06:19:35 GMT
Via: 1.1 a6f3857eba4e91de5ecf52859c1f6856.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P4
Age: 42347
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: 2isiH2xipazRVswT9KQD9T-d87LgXP87i4kzJ52-VrFMVuX8VeJ3DA==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 34ms
11ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 18:27:07 GMT
content-encoding: gzip
age: 949094
x-guploader-uploadid: ABPtcPrGkX9WdEfraM_2GOgvO4XFku4h6LV8hSZGRCBWDldVHkLv6s4LjI-J4Ekw5y2K4Y2B5aE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 05 Dec 2024 18:27:07 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
34 KB 44ms
27ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d03eb82a79a732d7c0180593c4f5dc98a8fac5c20c3a5446c4f14bf93d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: FANESDDW9B9E9DSA
age: 34
etag: W/"5fcefeebf5ddc7b2ddf2435967e63de9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 83711801bae71e32-FRA
x-amz-id-2: 3/X8tH8E5rO8cGeSb+lNhU+ULwy45NMG2aWlCk5dk6b5qqPhSq/HFmIcDoU2bo2DgxRunmOxmgUfKwp80TBIyA==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 42ms
15ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7512
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230065-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MW3IydpV9EZdjIGVsyOKdwPgw6iufUE12fLdGID2uC4vWM3hq5ERigNWLR2iqCO21rlBesI0BEoLswXaT0RdLvuddkG8X25fPDb6sDbnkut1v1BC1eG%2FfN4PSkLM8zjo8bBvrt3kRGhTKELY%2F7Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 83711801ca6d4d22-FRA

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&rid=esp&cc=1

85 B
194 B

119ms
119ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: d4ad057d6be69d3faedc8b5de63a77178405025de45bf692b4d5b2ce94899459

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:21 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-qntGVWHJGwUbFsMEczigm76x9WY"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sun, 17 Dec 2023 18:05:21 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://wheregoes.com
location: /esp?url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
229 B 42ms
8ms XHR
text/plain 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
333 B 100ms
28ms XHR
application/json 34.241.138.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.241.138.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-241-138-233.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 5d989dcb2f9bd2c4d572d313d97badfdc2e2378fbc202f488f5e6b42f201d266

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache
x-server: 10.45.13.248
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame DEE4 15 KB
6 KB 47ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fd8c1cf4274cae5e1e5a37133cc23b80392ef88c43b798d3748f43948dbb53f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 326452
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

sid Show response
mug.criteo.com/ Frame DEE4
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=86p-lnxGKzdpWW1yR1lCem85WXpJaXdaaWlpRXZiYWRnbER6bi9wYUk0SWIzZ1IrckRzK2UzcXRaRnBOVEJQREFyR1Z6QzZMYUtUOEFuNUJENUlzeDlqRHNWZEFOWC9qVEFxTCtzMEc2dXU1cUdZZlgvWHZxMFVDVHBWdG...

431 B
653 B

14ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=86p-lnxGKzdpWW1yR1lCem85WXpJaXdaaWlpRXZiYWRnbER6bi9wYUk0SWIzZ1IrckRzK2UzcXRaRnBOVEJQREFyR1Z6QzZMYUtUOEFuNUJENUlzeDlqRHNWZEFOWC9qVEFxTCtzMEc2dXU1cUdZZlgvWHZxMFVDVHBWdGFtZ0IyYjFTRjBXMTdJUVJyc21ISGxlMFcvY0R0RlpORGsvakhDMDZZS2VxUllWOG0ybEtTSlBHUzF6T3lZa0NEYkN3OG1VVTI4V0FtTWJjT3pFbWV1R2JMS0UzUGd4ekM5TVVOcHFTMHNOZXFjMVFUZDE1QzZOZUYySEEvNllGY3UrRmI3NTNNYTZnaVkzUnoyQmF1VnJJd2E4dHhvZ2JvSTFGQTNFSDd2bjFEbmdFYnZFMD18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

008d9cc66bc106688deb2b4fe163e5535237a1ba5bf62e793d0583fa1c4514f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1075431
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=86p-lnxGKzdpWW1yR1lCem85WXpJaXdaaWlpRXZiYWRnbER6bi9wYUk0SWIzZ1IrckRzK2UzcXRaRnBOVEJQREFyR1Z6QzZMYUtUOEFuNUJENUlzeDlqRHNWZEFOWC9qVEFxTCtzMEc2dXU1cUdZZlgvWHZxMFVDVHBWdGFtZ0IyYjFTRjBXMTdJUVJyc21ISGxlMFcvY0R0RlpORGsvakhDMDZZS2VxUllWOG0ybEtTSlBHUzF6T3lZa0NEYkN3OG1VVTI4V0FtTWJjT3pFbWV1R2JMS0UzUGd4ekM5TVVOcHFTMHNOZXFjMVFUZDE1QzZOZUYySEEvNllGY3UrRmI3NTNNYTZnaVkzUnoyQmF1VnJJd2E4dHhvZ2JvSTFGQTNFSDd2bjFEbmdFYnZFMD18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 224041
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 5D2C 0
167 B 44ms
16ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sun, 17 Dec 2023 18:05:21 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 96 KB
17 KB 71ms
70ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1125956065890868&correlator=3541221175554092&eid=44809527%2C31080122%2C31080057%2C31079525%2C31080115%2C21065725&output=ldjh&gdfp_req=1&vrg=202312070101&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=728x90%7C970x90%2C300x250%2C300x250%7C120x600%7C160x600%7C300x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1702836322350&lmt=1702836322&adxs=436%2C1091%2C1091&adys=440%2C666%2C950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vis=1&psz=960x267%7C300x952%7C300x952&msz=960x90%7C300x250%7C300x600&fws=516%2C0%2C512&ohw=960%2C0%2C0&ga_vid=658331408.1702836322&ga_sid=1702836322&ga_hid=387254060&ga_fc=false&dlt=1702836320662&idt=829&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D728x90%26hb_pb%3D0.04%26hb_creative%3DS0300080711068000728009099999900%26hb_adid%3D46399438feaa8d7%26hb_bidder%3Dmedianet%26_bd%3Dbid%26_pl%3D0.04%26hb_size_medianet%3D728x90%26hb_pb_medianet%3D0.04%26hb_adid_medianet%3D46399438feaa8d7%26hb_bidder_medianet%3Dmedianet%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D4872ad943c3f7b%26hb_bidder_appnexus%3Dappnexus%7Coptimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size%3D300x600%26hb_pb%3D0.01%26hb_creative%3DS0300080711068000300060099999900%26hb_adid%3D475526270bfea33%26hb_bidder%3Dmedianet%26_bd%3Dbid%26_pl%3D0.01%26hb_size_medianet%3D300x600%26hb_pb_medianet%3D0.01%26hb_adid_medianet%3D475526270bfea33%26hb_bidder_medianet%3Dmedianet&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&adks=1696759606%2C2861055222%2C3809685794&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6556b1fd750c04f82ee934406821c5fc2d6ed2ab3a9a606d6030b8193982989b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17488
x-xss-protection: 0
google-lineitem-id: 5936457980,5320060794,5936457971
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383350357,138305489837,138383350363
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 80ms
59ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202312070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a8f37c5992a83a529fdeb8e6177475e02205a7b1a931d8d250fa68db8fbb85c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12203
x-xss-protection: 0

GET
H2 200 container.html Show response
3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 52F6 6 KB
3 KB 77ms
42ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Mon, 16 Dec 2024 18:05:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E5C 0
0 47ms
47ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst70_2pWMQ745kvr6dfsy9t-xf-iMSimv_8sUwFp4_eoQqaq2JwAa4RKwuogiBv66u2u4UpagXplKlokdwCONwCnzZRevK4_gDzPaZzuy2fwQkgJI9YDr__NscSRHNtKEC9f4v3gQRGqHGZWnOxOF6mlEglCNpLjYqdGucisyjKpBxKWxqIlJP6NwJ5doYVq4ghya6Pc8cFOujicZHMCFJ0AUEUYaGHDYb4aRyL_8z_QlvzKb1e71FWuKrA7CL3olpBEFZiCuIaYtWxqDXw8aOcOdzN3bjLkwoBwJTuHqeGYLt6cwTkUGXBNvRG34hFnhE7J4l9P6xIMOkaJ9W8-mL-R7rgS-afrSiFVnZKEW6fMLq9&sai=AMfl-YS30AbM27Pbz7bedqM9MJvjbl3-0yhb8LxS43_KotzKbYsMeY1sbGbobC5Ku__karomAoFk1jmPZArg7MmYENrbcXB1w5QhT0ybPwvNkBrDz8Kun3ZFSZaolsmi4EdZgTtMLxfEXVge8Ii4uC5la-V7&sig=Cg0ArKJSzBlISEzdxb8WEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame 9E5C 26 KB
9 KB 25ms
25ms Script
application/javascript 64.227.38.224
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.227.38.224 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-ldn-17.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: eaf67431972d3e9d0888a562c64f1e353894aa5fd5c38afaad32003404c2f467

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
cache-control: public, max-age=600, stale-while-revalidate
content-encoding: gzip
server: //srv.buysellads.com
etag: 196270e7fcc49a0af36f5d62866c973b3ad33942
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9E5C 203 KB
65 KB 38ms
16ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 container.html Show response
3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 678A 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Mon, 16 Dec 2024 18:05:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3BB2 0
0 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvBKrVhUNb3qyzJ1iUTHOo881maJnH6myl-EGSlHaDHHvNpgSzW1PYx9SvqcZQ88ebw-6FUuLzDXnW2rSvUizYtq50k4jJykwtswpxDXDWdBYwxxuW06n4lB9wBQmsR49oJylsjf7UV1FXJBZhuNMVmhshPX3luOoERaVJHvpYcoQbqUdErjv57_2pptoji91KnsQX-sFbPrBl-o-KfaCorD8KJyUWGsCre7udkNwBTmxyJWl0r5_nLOFwLpplfdtggrSdU8qgqEeO8Q27MkSIPAJhJaOdRZvC8fO02GWV-6JYhJ9LWkHiZdKvdUNaeOTaNYo0OOLCbLU_el0FnSdeRjy4k3kzFvRahQnagFf12cqmJoXccvw&sai=AMfl-YSm8NkQI2vknA0a0GgOoys-g-_rVzoKa8zPnbsrPp-JhAQNuxzbjGZdvfXE2ANl1sWLb8zKjLXggX9kGCdHAXmyz3mBiLM_6tPxXTKnbP3-GN1jxEGMwGIRoVHSTwSlMM_NcvZvs2uyBJ6WVuC1VMso&sig=Cg0ArKJSzEHcgs4WxTKuEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame 3BB2 26 KB
9 KB 29ms
29ms Script
application/javascript 64.227.38.224
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.227.38.224 Slough, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-ldn-17.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: eaf67431972d3e9d0888a562c64f1e353894aa5fd5c38afaad32003404c2f467

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
cache-control: public, max-age=600, stale-while-revalidate
content-encoding: gzip
server: //srv.buysellads.com
etag: 196270e7fcc49a0af36f5d62866c973b3ad33942
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3BB2 203 KB
64 KB 59ms
53ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 109ms
86ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 678A 24 KB
7 KB 18ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:36:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 491333
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 11 Dec 2024 01:36:29 GMT

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 678A 8 KB
4 KB 14ms
13ms Script
application/javascript 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1869682767&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

8ec6afb7109e41904cff643ebac059c6e2d957f12c30d018fa5128cd8944d40b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
an-x-request-uuid: fb0a4004-bdc6-40e2-bb78-74b863869773
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 678A 203 KB
64 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame E689 94 KB
36 KB 143ms
75ms Script
text/javascript 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

9e5e5c035954f6c47e63325c899c97350ec874146d69f7a6cc230238663b0285

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-mnt-h: 22-s1v0
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sun, 17 Dec 2023 18:05:22 GMT
server: Apache
etag: "abc755cdfc095fcbf61aab035f9c5414"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-s1v0
timing-allow-origin: *
content-length: 36444
expires: Sun, 17 Dec 2023 18:10:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame E689 35 B
296 B 84ms
12ms Image
image/gif 2.22.242.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=c76a6ca3005191a45f4222e7dd86496f&algo=unison26&bdp=0.0900&bidfp=0.0000&capd=0&cc=DE&cid=8CU18831I&crid=950152417&ct=nuremberg&dc=eu_be&dfpbd=0.0468&dn=wheregoes.com&iwb=1&ogcbdp=0.0900&other_bids=0.09&other_prv=459&pbshr=100.0000&prdp=0.0468&requrl=wheregoes.com%2Ftrace%2F20235982975%2F&sat=0&sc=BY&sc_pvid=459&send_erpm=true&server=1&size=728x90&strg=harmony&totalTime=4708420&ugd=4&ver=9.6.4&cliIP=1358891520&time_stamp=2023-12-17%2018%3A05%3A21&seat=BID_API&itype=prebid&req_id=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&dfp_bucket=0.0&level_base=0&bdp_bucket=0.1&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F120.0.6099.109%20Safari%2F537.36&br_ver=120.0.6099.109&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_1-cid_3&ogerpm=0.0900&ogerpm_used=false&rawbid=0.0900&totalTimeBucket=4&as_cache=0&sub_bidder=196&current_day=0.0&current_hour=18&cut=48&floor_bucket=0.00&model_version=202312161507_generic_prebid_1-cid_3&erpm_bucket=0.10&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=1&viewability=0.6100&stid=bsa-zone_1641228026595-4_123456&pvid_seat=459_BID_API&ckfl=0&mnckfl=0&sd=-1&predicted_wr=7.2031&bdp_wider_bucket=1&splid=bsa-zone_1641228026595-4_123456&dim10=false&dmm_m9=0.0000&dmm_m10=1393673&log_less=false&cut_bkt=50&advurl=generalsearch.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&url_l1=trace&url_l2=20235982975&clisp=rtb-common-5c85f5bcc7-tkmwm.BE&dmm_m1=2023-12-17%2018%3A05%3A21.718487464&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0900&adtyp=0&gpid_format=DEFAULT&gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&gpid_sent=true&pst=EMS&bcrid=S0300080711068000728009099999900&erpm_mult=1.000000&zone=b&rc=1&sfm_key=mowx_System_459&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-74b5d97f5b-hxdzc&rel_cut_bkt=50&djvm=9.5.8&optimal_cut=0.0&cut_cluster=0.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.242.80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-22-242-80.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:22 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 release-20231121-135-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 9E5C 72 KB
25 KB 78ms
34ms Script
application/javascript 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20231121-135-adperformance.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-122-24-29.deploy.static.akamaitechnologies.com

Software

UploadServer /

Resource Hash

1616c8cd083e6b17f6a75ab0695bd4a4573b31ae8398ffb43758288028f6a773

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Sun, 17 Dec 2023 18:05:22 GMT
x-guploader-uploadid: ABPtcPpIo_b_NcMKOwHvGDCTG05XY1UknAvtaGcrwEzGBq16PDG4pYQRlOGIdNZ7w2_WERaEBt4
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25147
server: UploadServer
etag: "841dabce0b477a93d9cf7379b9eb1368"
vary: Accept-Encoding
x-goog-hash: md5=hB2rzgtHepPZz3N5uesTaA==, crc32c=iBXD1A==
content-type: application/javascript
x-goog-generation: 1700562102250666
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Sun, 17 Dec 2023 19:05:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 87ms
15ms Image
image/gif 2.22.242.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&cid=8CU18831I&crid=673699537&adunit_count=1&dn=wheregoes.com&requrl=https://wheregoes.com/trace/20235982975/&istop=true&event=client_bid_won&value=0.047&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.242.80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-22-242-80.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:22 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 log
hblg.media.net/ Frame 9E5C 35 B
191 B 75ms
35ms Image
image/gif 104.122.24.29
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAMNAATjEyMzMwMDAzNjM0NDcwXzE0NDc2ODUyMzdfOTUwMTUyNDE3NDU5MUBjNzZhNmNhMzAwNTE5MWE0NWY0MjIyZTdkZDg2NDk2ZpYHCtejcD0Ktz9QaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjM1OTgyOTc1LwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxSQgMNzI4eDkwCjAuMDQ3CmV1X2JlDFBSRUJJRAZhZG0AAAAAAACATkC49aGPj2MCMQAAAAAAAPC_PHJ0Yi1jb21tb24tNWM4NWY1YmNjNy10a213bS5CRUBTMDMwMDA4MDcxMTA2ODAwMDcyODAwOTA5OTk5OTkwMAIQNmM4MTdmOWYCYgI&cpr=0.33313036426128506

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.122.24.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 clog
hblg.media.net/ Frame 9E5C 35 B
191 B 118ms
77ms Image
image/gif 104.122.24.29
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=5852&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=DE&cid=8CU18831I&reqid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&vid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&dn=wheregoes.com&rawDn=wheregoes.com&requrl_dn=wheregoes.com&pid=8PRW23HG5&ugd=4&fleet=common&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=BY&ct=nuremberg&zip=90403&pubid=pub-8CU18831I&tgtval=pub-8CU18831I&csip=rtb-common-5c85f5bcc7-tkmwm.BE&dtc=eu_be&zone=b&sd=-1&ptype=23&tmax=2500&xtmax=345&gdpr=1&gsi=0&gpp_present=false&csex=0&app=0&sat=0&screeninfo=1600x1200&asn=201011&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&mspa_enforced=true&pexid=PREBID-8CU18831I&geoll=false&is_ortb=false&s_city=Allersberg&commit_id=6c817f9f&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-12-15+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=DE&is_msnnative_src=false&proxy=envoy&rtttime=133&req_tid_present=false&pvid=459&prvAccId=849523371&prvApiId=8CUWMQE3H&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=950152417&prspt=headerBid&prvReqId=12330003634470_1447685237_9501524174591&size=728x90&chnl=HARMONY&bdp=0.090&bid_uuid=c7cde2401c99b734033a9a8d3d5b729c&cbdp=0.047&og_cbdp=0.090&ogbdp=0.09&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Fgeneralsearch.net&dfpBd=0.047&dsrc=-2&dp=0&dbf=1&epc=849523371&s=1&snm=SUCCESS&pcrid=8CUWMQE3H-849523371-51-17&tpbTkn=false&exid=217&bidflr=0.000&pbidflr=0.000&opbidflr=0.000&spbf=0&viewability=61&sbdrid=196&bdata=sd2%3Dnull%7Eiurl_l%3D20%7Eogerpm%3D0.09%7Evis_sd%3D418%7Erf_cnt%3D1%7Edc2%3D1%7Escd%3Dby%7Ev_asn%3D201011%7Evl2r_sd%3D2023121711%7Eiurl_b%3D7546.03%7Eurl_tkc%3D0%7Estd%3Dbsa-zone_1641228026595-4_123456%7Elast%3D%7Evis_url_b%3D0.76%7Eip%3D1tXLLa%7Efbb%3D0%7Evis_url_l%3D30%7Eriipua%3D0%2C0%7Eet%3D16%7Erc%3D1%7Emtid%3DPO000012%7Erps_sd%3D2023121516%7Evis_b%3D751.21%7Eurl_b%3D0.13%7Evl2r_url_b%3D0%7Evl2r_url_vi%3D1E-16%7Eurl_tvi%3D0%7Eurl_l%3D20%7Egcat%3D-1%7Ebb%3D196%7Evv%3D0%7El2r_b%3D1000%7Eerpm%3D0.09%7Evl2r_url_kc%3D0E0%7Ebm%3D1%7Ea3p_b%3D1.03%2C111.02%7Esid%3D4699db585c64000b4b70b68e17dde28e%7Esd%3D-1%7Euid%3D22d5GdVL7X7X4Cqqr9%7Ebtd%3D3079991045418671531522186152951861467535621085637744679701794404146706082620966013569198567130289016832%7Evwu%3D-1%7Ed2p_l%3D10%7E3pcf%3D1000%7Euim%3D0%7Evw_med%3D0.61%7Edmm_strg%3Dharmony%7Ed2p_b%3D1%7Eogd2p_b%3D0.96%7Evurl_b%3D0.24%7Ess%3D1600x1200%7Ecc%3DDE%7Euiw%3D-1%7Ece%3D0%7Erps_b%3D111.02%7Evurl_l%3D20%7ECI%3D3062%7Ekb_uc%3D-2%7Ents%3D1%7Ekb_ccks%3D-2%7Ect%3Dnuremberg%7Ebss_KTW%3DNA%2CNA%7Ebasis2%3D196%7Ebasis1%3D196%7EisRef%3D0%7Eivurl_b%3D4.16%7Eisif%3D0%7Ebid%3D0.09%7Edc%3D7%7Evl2r_b%3D1.03%7Eivurl_l%3D20%7Ecbdp%3D0.047%7Esd%3D-1%7Eitype_id%3D3%7Eseller_tag_id%3Dbsa-zone_1641228026595-4_123456%7Esupply_tag_id%3Dbsa-zone_1641228026595-4_123456%7Epos%3D1%7Eref_cnt%3D1%7EcarrierId%3D0%7Eogbid%3D0.090%7Ebflr%3D0.000%7Edtc%3Deu_be%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Dunison26%7Esobp%3D%7Ehtml%3D1%7Edcut%3D50%7Edogb%3D0-1%7Eibc%3D1%7Ensz%3D1%7Etgs%3D728x90%7Ebsb%3D0%7Ebsp%3D0%7Etmx%3D283&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1702836321628&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.09&dmm_erpm=true&dmm_ogerpm=false&bcrid=S0300080711068000728009099999900&strg=HARMONY&stagid=bsa-zone_1641228026595-4_123456&vls=0&scrid=S0300080711068000728009099999900&mang=1&pvdTmax=283&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&apTags%3C%3E=75&dt=O&mx_svc_mode=http&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_sdr=false&mx_sbp=-10.0&mx_sua_cvg=0000000&mx_tid_sent=false&mx_epbc=8CUWMQE3H&mx_SPRIG=0&mx_bsBucket=0&mx_ssProfile=0&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CU18831I&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=bsa-zone_1641228026595-4_123456&mx_tgs=728x90&mx_bsProfileRa=0&mx_IAB2=0&mx_gpid_format=DEFAULT&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=true&mx_commit_id=e647832764&mx_exp_tokens%3C%3E=IPBLOCK_DM%3AGCS%23%23ctx_canonical_exp%3Atrue%23%23launchexp%3Atoken1%23%23bsNed%3AnoAdd%23%23NedCkflWithData%3ANoBlk%23%23prll_req%3ADEFAULT%23%23NedCkfl%3ANoBlk%23%23BssTgtMig%3ADEFAULT&native_ver=1.1&acid=c76a6ca3005191a45f4222e7dd86496f&rtime=16.0&wsip=mowx-74b5d97f5b-hxdzc&ltime=26.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D345%7Cbrr%3D0&adtypes=0&impId=233bb7f9204069b&reftime=15000&reftype=0&dsid=bsa-zone_1641228026595-4_123456&gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mowxReqId=c76a6ca3005191a45f4222e7dd86496f_3&req_size=970x90%7C728x90&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=bsa-zone_1641228026595-4_123456&feedback_id=3f4425f5-2de2-4296-a4f5-fa0c6be47da9&supplyTagId=950152417&pub_pbslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=61&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202312171042_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=true&debug_ts=2023-12-17+18%3A05%3A21&__expireat=1702836921972&mview=1&lo_pvid=%5B459%5D&lo_dp=0&lo_bdp=0.090&lo_cbdp=0.047&actltime=115&rme=adm&utime=764&sf=0&cpr=0.04686857379396492

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.122.24.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-122-24-29.deploy.static.akamaitechnologies.com

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 nmedianet.js Show response
contextual.media.net/ Frame F458 94 KB
36 KB 112ms
56ms Script
text/javascript 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

f5a9e4f88e241e51bd7a7c3b5cc3a19f1434562732e216d70b244f1839058133

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-mnt-h: 22-s1v0
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sun, 17 Dec 2023 18:05:22 GMT
server: Apache
etag: "f42e1e58d720b4b93efbd26e50267322"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-5h9m
timing-allow-origin: *
content-length: 36448
expires: Sun, 17 Dec 2023 18:10:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame F458 35 B
296 B 73ms
13ms Image
image/gif 2.22.242.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=100ec790163eb6c01c3223a409eafb23&algo=unison12&bdp=0.0200&bidfp=0.0000&capd=0&cc=DE&cid=8CU18831I&crid=742696110&ct=nuremberg&dc=eu_be&dfpbd=0.0104&dn=wheregoes.com&iwb=1&ogcbdp=0.0200&other_bids=0.02&other_prv=459&pbshr=100.0000&prdp=0.0104&requrl=wheregoes.com%2Ftrace%2F20235982975%2F&sat=0&sc=BY&sc_pvid=459&send_erpm=true&server=1&size=300x600&strg=harmony&totalTime=3220430&ugd=4&ver=9.6.4&cliIP=1358891520&time_stamp=2023-12-17%2018%3A05%3A21&seat=BID_API&itype=prebid&req_id=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&dfp_bucket=0.0&level_base=0&bdp_bucket=0.0&app_type=prod&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F120.0.6099.109%20Safari%2F537.36&br_ver=120.0.6099.109&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&model_key=generic_prebid_1-cid_3&ogerpm=0.0700&ogerpm_used=false&rawbid=0.0200&totalTimeBucket=3&as_cache=0&sub_bidder=196&current_day=0.0&current_hour=18&cut=48&floor_bucket=0.00&model_version=202312161507_generic_prebid_1-cid_3&erpm_bucket=0.00&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=2&viewability=0.3500&stid=bsa-zone_1641318529900-6_123456&pvid_seat=459_BID_API&ckfl=0&mnckfl=0&sd=-1&predicted_wr=4.1814&bdp_wider_bucket=1&splid=bsa-zone_1641318529900-6_123456&dim10=false&dmm_m9=0.0000&dmm_m10=1239617&log_less=false&cut_bkt=85&advurl=generalsearch.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&url_l1=trace&url_l2=20235982975&clisp=rtb-common-5c85f5bcc7-tkmwm.BE&dmm_m1=2023-12-17%2018%3A05%3A21.718385228&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=1600x1200&ss_d1=1600&ss_d2=1200&dmm_m22=0.0200&adtyp=0&gpid_format=DEFAULT&gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&gpid_sent=true&pst=EMS&bcrid=S0300080711068000300060099999900&erpm_mult=1.000000&zone=b&rc=1&sfm_key=mowx_System_459&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=3&wsip=mowx-74b5d97f5b-8gvwq&rel_cut_bkt=85&djvm=9.5.8&optimal_cut=0.0&cut_cluster=0.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.242.80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-22-242-80.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:22 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 release-20231121-135-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 3BB2 72 KB
25 KB 47ms
16ms Script
application/javascript 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20231121-135-adperformance.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-122-24-29.deploy.static.akamaitechnologies.com

Software

UploadServer /

Resource Hash

1616c8cd083e6b17f6a75ab0695bd4a4573b31ae8398ffb43758288028f6a773

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Sun, 17 Dec 2023 18:05:22 GMT
x-guploader-uploadid: ABPtcPpIo_b_NcMKOwHvGDCTG05XY1UknAvtaGcrwEzGBq16PDG4pYQRlOGIdNZ7w2_WERaEBt4
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25147
server: UploadServer
etag: "841dabce0b477a93d9cf7379b9eb1368"
vary: Accept-Encoding
x-goog-hash: md5=hB2rzgtHepPZz3N5uesTaA==, crc32c=iBXD1A==
content-type: application/javascript
x-goog-generation: 1700562102250666
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Sun, 17 Dec 2023 19:05:22 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ 35 B
296 B 76ms
17ms Image
image/gif 2.22.242.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=projectevents&project=prebid&acid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&cid=8CU18831I&crid=742696110&adunit_count=1&dn=wheregoes.com&requrl=https://wheregoes.com/trace/20235982975/&istop=true&event=client_bid_won&value=0.01&rd=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.22.242.80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-22-242-80.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:22 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 log
hblg.media.net/ Frame 3BB2 35 B
191 B 41ms
13ms Image
image/gif 104.122.24.29
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELAQCAAABAAAAAgAAAAAAAAEABgAAQIABAAgAMNAATjM3NDIxNTM4NTkxODMwXzE0NDI3ODkyMTJfNzQyNjk2MTEwNDU5MUAxMDBlYzc5MDE2M2ViNmMwMWMzMjIzYTQwOWVhZmIyM5YHexSuR-F6lD9QaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjM1OTgyOTc1LwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxSQgOMzAweDYwMAowLjAxMApldV9iZQxQUkVCSUQGYWRtAAAAAAAAgEFA5Pahj49jAjIAAAAAAADwvzxydGItY29tbW9uLTVjODVmNWJjYzctdGttd20uQkVAUzAzMDAwODA3MTEwNjgwMDAzMDAwNjAwOTk5OTk5MDACEDZjODE3ZjlmAmIC&cpr=0.6803123712271124

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.122.24.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H2 200 clog
hblg.media.net/ Frame 3BB2 35 B
191 B 96ms
68ms Image
image/gif 104.122.24.29
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=5891&logid=awlog&lper=1&itypeid=3&itype=PREBID&cc=DE&cid=8CU18831I&reqid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&vid=cd6f6c4f-0e95-4885-bcf7-1b9ea54ad05c&dn=wheregoes.com&rawDn=wheregoes.com&requrl_dn=wheregoes.com&pid=8PRW23HG5&ugd=4&fleet=common&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&cliIPType=v4&coppa_status=N&coppa_applied=N&coppa_enf=true&lmt_enf=true&dnt_enf=false&geo_source=2&sc=BY&ct=nuremberg&zip=90403&pubid=pub-8CU18831I&tgtval=pub-8CU18831I&csip=rtb-common-5c85f5bcc7-tkmwm.BE&dtc=eu_be&zone=b&sd=-1&ptype=23&tmax=2500&xtmax=345&gdpr=1&gsi=0&gpp_present=false&csex=0&app=0&sat=0&screeninfo=1600x1200&asn=201011&sckfl=0&sckfl2=0&usp_status=0&usp_enf=1&mspa_enforced=true&pexid=PREBID-8CU18831I&geoll=false&is_ortb=false&s_city=Allersberg&commit_id=6c817f9f&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-12-15+00%3A00%3A00&pbasrc=0&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&second_call=false&ipcc=DE&is_msnnative_src=false&proxy=envoy&rtttime=133&req_tid_present=false&pvid=459&prvAccId=151714331&prvApiId=8CUWMQE3H&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=742696110&prspt=headerBid&prvReqId=37421538591830_1442789212_7426961104591&size=300x600&chnl=HARMONY&bdp=0.020&bid_uuid=6cb673296407552e88f1a5e4f57ce562&cbdp=0.010&og_cbdp=0.020&ogbdp=0.02&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Fgeneralsearch.net&dfpBd=0.010&dsrc=-2&dp=0&dbf=1&epc=151714331&s=1&snm=SUCCESS&pcrid=8CUWMQE3H-151714331-51-10&tpbTkn=false&exid=217&bidflr=0.000&pbidflr=0.000&opbidflr=0.000&spbf=0&viewability=35&sbdrid=196&bdata=sd2%3Dnull%7Eiurl_l%3D20%7Eogerpm%3D0.07%7Evis_sd%3D418%7Erf_cnt%3D1%7Edc2%3D1%7Ebat%3D0%2C0%2C0%7Escd%3Dby%7Ev_asn%3D201011%7Evl2r_sd%3D2023121711%7Eiurl_b%3D7546.03%7Eurl_tkc%3D0%7Estd%3Dbsa-zone_1641318529900-6_123456%7Elast%3D%7Evis_url_b%3D0.62%7Eip%3D1tXLLa%7Efbb%3D0%7Evis_url_l%3D20%7Eriipua%3D0%2C0%7Eet%3D19%7Erc%3D1%7Emtid%3DPO000012%7Erps_sd%3D2023121516%7Evis_b%3D467.58%7Eurl_b%3D0.13%7Evl2r_url_b%3D0%7Evl2r_url_vi%3D1E-16%7Eurl_tvi%3D0%7Eurl_l%3D20%7Egcat%3D-1%7Ebb%3D196%7Evv%3D0%7El2r_b%3D1000%7Eerpm%3D0.02%7Evl2r_url_kc%3D0E0%7Ebm%3D0.25%7Ea3p_b%3D1.46%2C108.16%7Esid%3D151714331%7Esd%3D-1%7Euid%3D22d5FKcP9JHzspzR1V%7Ebtd%3D3079991045418798846270707058332253245391146671772810396476398525162370841399051871326253390303600185344%7Evwu%3D-1%7Ed2p_l%3D10%7E3pcf%3D1000%7Euim%3D0%7Evw_med%3D0.35%7Edmm_strg%3Dharmony%7Ed2p_b%3D1%7Eogd2p_b%3D0.96%7Evurl_b%3D0.24%7Ess%3D1600x1200%7Ecc%3DDE%7Euiw%3D-1%7Ece%3D0%7Erps_b%3D108.16%7Evurl_l%3D20%7ECI%3D3062%7Ekb_uc%3D-2%7Ents%3D1%7Ekb_ccks%3D-2%7Ect%3Dnuremberg%7Ebss_KTW%3DNA%2CNA%7Ebasis2%3D196%7Ebasis1%3D196%7EisRef%3D0%7Eivurl_b%3D4.16%7Eisif%3D0%7Ebid%3D0.02%7Edc%3D7%7Evl2r_b%3D1.46%7Eivurl_l%3D20%7Ecbdp%3D0.010%7Esd%3D-1%7Eitype_id%3D3%7Eseller_tag_id%3Dbsa-zone_1641318529900-6_123456%7Esupply_tag_id%3Dbsa-zone_1641318529900-6_123456%7Epos%3D3%7Eref_cnt%3D1%7EcarrierId%3D0%7Eogbid%3D0.020%7Ebflr%3D0.000%7Edtc%3Deu_be%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Dunison12%7Esobp%3D%7Ehtml%3D1%7Edcut%3D85%7Edogb%3D0-1%7Eibc%3D1%7Ensz%3D1%7Etgs%3D300x600%7Ebsb%3D0%7Ebsp%3D0%7Etmx%3D283&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1702836321714&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.02&dmm_erpm=true&dmm_ogerpm=false&bcrid=S0300080711068000300060099999900&strg=HARMONY&stagid=bsa-zone_1641318529900-6_123456&vls=0&scrid=S0300080711068000300060099999900&mang=1&pvdTmax=283&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&apTags%3C%3E=75&dt=O&mx_svc_mode=http&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_sdr=false&mx_sbp=-10.0&mx_sua_cvg=0000000&mx_tid_sent=false&mx_epbc=8CUWMQE3H&mx_SPRIG=0&mx_bsBucket=0&mx_ssProfile=0&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_bsBucketRa=0&mx_sid=8CU18831I&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_bsBucketKtwRl=0&mx_divid=bsa-zone_1641318529900-6_123456&mx_tgs=300x600&mx_bsProfileRa=0&mx_IAB2=0&mx_gpid_format=DEFAULT&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=1&mx_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=true&mx_commit_id=e647832764&mx_exp_tokens%3C%3E=IPBLOCK_DM%3AGCS%23%23ctx_canonical_exp%3Atrue%23%23bsNed%3AnoAdd%23%23NedCkflWithData%3ADEFAULT%23%23launchexp%3Atoken2%23%23prll_req%3ADEFAULT%23%23NedCkfl%3ADEFAULT%23%23BssTgtMig%3ADEFAULT&native_ver=1.1&acid=100ec790163eb6c01c3223a409eafb23&rtime=21.0&wsip=mowx-74b5d97f5b-8gvwq&ltime=112.0&act=headerBid&abs=0%7C0%7Cnxblock%3D-1%7Cxtmax%3D345%7Cbrr%3D0&adtypes=0&impId=2595dd6ef8fa48&reftime=15000&reftype=0&dsid=bsa-zone_1641318529900-6_123456&gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mowxReqId=100ec790163eb6c01c3223a409eafb23_3&req_size=300x250%7C120x600%7C160x600%7C300x600&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=2&adpos=3&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=1&skadidfl=0&dfpDiv=bsa-zone_1641318529900-6_123456&feedback_id=0a709694-4611-4887-96a8-af11e1443764&supplyTagId=742696110&pub_pbslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&mnrfc=1&viewability_vendor=MEDIA.NET+EXCHANGE&viewability_mnet=35&v_mkey=gen-vblt_prebid_test_2_1&v_mver=202312171042_gen-vblt_prebid_test_2&v_alg=gen-vblt_prebid_all&vcmplrt=-1.0&imp_tid_present=true&debug_ts=2023-12-17+18%3A05%3A21&__expireat=1702836921972&mview=1&lo_pvid=%5B459%5D&lo_dp=0&lo_bdp=0.020&lo_cbdp=0.010&actltime=115&rme=adm&utime=777&sf=0&cpr=0.26573535704001205

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.122.24.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-122-24-29.deploy.static.akamaitechnologies.com

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 678A 0
0 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuvhF6NxRgm6hLALsN82zie-zNQY1nGctb2Ldj6xU0YNUNNk_W0XmpSkp68zMk_rVXHPZ0l04ahpZz4GJYNJL5L5W93e8OPXMq_IAd-OV-nUKIzs1lU-3VZO38_F_aTLqMKxBPiYpKfEuvr4M39MU-nJIkdS29necntzRoW_ysd5pDS15TO_6SUEJyl31QsTg11eEQj8d3OMr7cCeqw7-mUaU3I3ubrhOldSGNz69W70xtZAIuxYpUEG5dqhrf6Huv3PWm-eiOlivx9w6GeR5hNMNqnrUR5i3K7p1l2YLsqRPJ3HIiAVjcbsNoVHPePJ5E_Cm3hkYV6BIs-u-xDdwVO0BemhjZergiL4PaUqw&sai=AMfl-YTVOnt-HTevDyfn_s2ZB-13TWHwQLndKDVzyVskhAZueLnmWp1cb2i5ZqVOIsulFsH7pPQYPAp5Qu-8VGAgt82-qj8ViA930NTt-cd357SDBiNzMk9fEJYlAy86lNRKr1qH4HPZPabYgB9TbAmqotyB&sig=Cg0ArKJSzJd8O3IV3n5xEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sync Show response
gum.criteo.com/ Frame 678A 51 B
293 B 14ms
14ms Script
text/javascript 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1869682767&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1009843
expires: 60

GET
H2 200 ttj Show response
secure.adnxs.com/ Frame 678A 9 KB
5 KB 348ms
348ms Script
application/javascript 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1702836322&bdh=Uio1U2Z52n_0ZkiaO8nxZ6gftss.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1869682767&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

9f20376badf3946833f6be25cd03ab7e5cf520659b7c49edfab26b163adf7ff0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-creative-id: 476571773
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: bbbb3d23-a0fe-46f7-b932-85f86efe2d24
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312070101/pubads_impl.js?cb=31080057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
DATA 200
OK truncated
/ Frame 3BB2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7c81ce122e0155d09dc4134b3d1dd1c303b046d93b850bb46965a85568e7b9d4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 77AF 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 8888
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 15:37:14 GMT
expires: Mon, 16 Dec 2024 15:37:14 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 663A 829 B
1 KB 39ms
17ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

495a516939e953cb54011dd2f90b0cae860a1a30e218384b7520e8567a1e5284

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L8QBzCSS6akOdGnKCovzuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-L8QBzCSS6akOdGnKCovzuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Sun, 17 Dec 2023 18:05:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame 9E5C 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e51e506d95ebed043680e5b9f850ea85780c25ce4b7790a5626683430210642f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 77AF 39 KB
15 KB 23ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 15:22:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9798
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Dec 2024 15:22:04 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame C2AF 75 KB
29 KB 303ms
302ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2245&&kkdd=3W%7CW%7CAh3H9nu*&cT=P!6p_xjxppxp4K_6_P*&7rNw=P&RaNU=6&brc=PPx6&Mabg=hx*6&bTr=_nmd1JVxe&bNbr=1QILjQdGipx9G4r!(XrQx7%3D%3D&bwTr=P*P!PKxxP&aTEg=x66ij66&bb=CV&ab=98&bAqR=eY21oF8&NTr=_Donh4Pjh&MNTr=HDjOpmj&AMMNa=P&www=ME2WAhbyWh4eNDNt_lJ98yRb!wbol(pHK.I!pKVmVcD2tUaDxQD~rj0FmeeOlk2q&SkwZ=AMMNa%3A%2F%2FkAgwg7(ga3b(R&gSkwZ=k!!VJ%3Att9klhl.RlJ3FR8&qag=*&yk=P&B7r=K&UrMP=_nmP__xPQ&UrMp=!Kpj4jPP6&zrUMU=arp%3DqByy)TBwy~y%3Dp6)(7gwNR%3D636!)cTa~ar%3DKP_)wZ~bqM%3DP)rbp%3DP)zUM%3D6%2C6%2C6)abr%3Dz.)c~Uaq%3Dp6P6PP)cypw~ar%3Dp6pxPpP!PP)TBwy~z%3D!*Kj36x)Bwy~MSb%3D6)aMr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)yUaM%3D)cTa~Bwy~z%3D63jp)TN%3DPMshhU)Zzz%3D6)cTa~Bwy~y%3Dp6)wTTNBU%3D6%2C6)gM%3DP4)wb%3DP)RMTr%3DDo6666Pp)wNa~ar%3Dp6pxPpP*Pj)cTa~z%3DKj!3*_)Bwy~z%3D63Px)cypw~Bwy~z%3D6)cypw~Bwy~cT%3DPVWPj)Bwy~McT%3D6)Bwy~y%3Dp6)7bUM%3DWP)zz%3DP4j)cc%3D6)ypw~z%3DP666)gwNR%3D636p)cypw~Bwy~Sb%3D6V6)zR%3D63p*)UxN~z%3DP3Kj%2CP6_3Pj)aTr%3DP*P!PKxxP)ar%3DWP)BTr%3Dppr*G-bD4leEaNE2P0)zMr%3Dx6!444P6K*KP_!4__Kjp!6!6!6*_xxpp*xpK*x4PPKjj!P!!p_P6x4jK!jx4_*p*Pjpx!6_KPx446*P_!Pxpjp*xx46x6xj66P_*xKK)ckB%3DWP)rpN~y%3DP6)xNbZ%3DP666)BTR%3D6)ck~Rgr%3D63x*)rRR~aMw7%3DAUwR(q.)rpN~z%3DP)(7rpN~z%3D634j)cBwy~z%3D63pK)aa%3DPj66iPp66)bb%3DCV)BTk%3DWP)bg%3D6)wNa~z%3DP6_3Pj)cBwy~y%3Dp6)nQ%3Dx6jp)Sz~Bb%3DWp)qMa%3DP)Sz~bbSa%3DWp)bM%3DqBwgRzgw7)zaa~-Hd%3DFY%2CFY)zUaTap%3DP4j)zUaTaP%3DP4j)Ta2gZ%3D6)TcBwy~z%3DK3Pj)TaTZ%3D6)zTr%3D636p)rb%3D!)cypw~z%3DP3Kj)TcBwy~y%3Dp6)bzrN%3D636P6)ar%3DWP)TM.Ng~Tr%3Dx)agyygw~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)aBNNy.~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)N(a%3Dx)wgZ~bqM%3DP)bUwwTgwQr%3D6)(7zTr%3D636p6)zZyw%3D63666)rMb%3DgB~zg)rRR~gwNR%3DZUyag)rRR%3DAUwR(q.)zrNbUNr%3D6)rUy7%3DBqTa(qPp)a(zN%3D)AMRy%3DP)rbBM%3D_*)r(7z%3D6WP)Tzb%3DP)qaE%3DP)M7a%3Dx66ij66)zaz%3D6)zaN%3D6)MRi%3Dp_x&qMc=6&RRR=Bs(aFZQCIVS%3D&Tk=x66&TqQZw=P&zrwQr=K*4&zTr=xK46jj&SMMyg=HwUbg%202gaByMa%20%7C%20dAgwgO(ga&RbZ=!j*4p&.raNw=P&zUg=9ig7I%2FKU79&SUMNwg=P&SUMzTr=WP6x&bUr(RUTq=ME2WAhbyWh_-MohKlX(Tn-A_MbxYNEBxN0_TN6gKDEV%3D&.NyN=P&TaTr=*&N7Tr=NPP_4KKP6pPpMp6pxPpP!P_6*&aayr=%7B%22aaTN%22%3A%22_63p**3P636%22%2C%22aabb%22%3A%22CV%22%2C%22aaab%22%3A%2298%22%2C%22aabM.%22%3A%22qBwgRzgw7%22%7D&AMRyawb=P&sflct=8062825&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

16448b6af5e46efe82e44ea8f43ffe97575e9a75821c5bca4736c9a185c6c7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 29135
content-type: text/html
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Sun, 17 Dec 2023 18:05:22 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-l2sx

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9F3D 16 KB
6 KB 38ms
37ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&ckdel=1&cs=2&cv=31&cid=8CUWMQE3H&https=1&itype=CM

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

1ff431fe8ec11f34c7c0dc7a78163543975eaa19c08a09781eeff31fa00e6e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5967
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Tue, 19 Dec 2023 18:05:22 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 bping.php
lg3.media.net/ Frame F458 35 B
176 B 87ms
54ms Image
image/gif 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2053&&vgd_cdv=1130&vgd_cage=4&vgd_tsce=L350&vgd_mcf=76592&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=151714331&vi=1702836322329480815&ugd=4&lf=6&kwrf=https%3A%2F%2Fwheregoes.com&cc=DE&sc=BY&lper=100&wsip=170785052&r=1702836322633&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvPRSasP3IP_d6VNUHHGJwRn&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9h~e8QMQOvHuW~LkMNz7vu~ONfvu~G17v9%2C9%2C9~QNOvG5~eM1Qzvf9u9uu~ejfLMQOvf9fAufuhuu~8xLjMGvhXHF.9A~xLjM7UNv9~Q7OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~j1Q7v~e8QMxLjMGv9.Ff~8Evu7tTT1~kGGv9~e8QMxLjMjvf9~L88Ex1v9%2C9~J7vui~LNvu~Y78Ov0a9999uf~LEQMQOvf9fAufuXuF~e8QMGvHFh.XW~xLjMGv9.uA~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9f~ejfLMxLjMUNv949~GYv9.fX~1AEMGvu.HF%2Cu9W.uF~Q8OvuXuhuHAAu~QOvou~x8OvffOXsCN0i6qlQElDu%2F~G7OvA9hiiiu9HXHuWhiWWHFfh9h9h9XWAAffXAfHXAiuuHFFhuhhfWu9AiFHhFAiWXfXuFfAh9WHuAii9XuWhuAfFfXAAi9A9AF99uWXAHH~eBxvou~OfEMjvu9~AENkvu999~x8Yv9~eBMYJOv9.AX~OYYMQ7Lyvw1LYmz5~OfEMGvu~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvu9W.uF~exLjMjvf9~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vzxLJYGJLy~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9f~ONvh~ejfLMGvu.HF~8exLjMjvf9~NGOEv9.9u9~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~EmQvA~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9f9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8Qmzuf~QmGEv~w7Yjvu~ONx7vWX~OmyGv9ou~8GNvu~zQlvu~7yQvA99-F99~GQGv9~GQEv9~7Y-vfWA&ssld=%7B%22QQ8E%22%3A%22W9.fXX.u9.9%22%2C%22QQNN%22%3A%22r4%22%2C%22QQQN%22%3A%22R3%22%2C%22QQN75%22%3A%22zxLJYGJLy%22%7D&vgd_bid=349066&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=201011&vgd_rakh=1702836322147392133&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=742696110&vgd_pgid=p11894410212t202312171805&vgd_pgids=1&vgd_uspa=0&hvsid=00001702836322632013588915209148&gdpr=1&mspa=0&vgd_l2type=scs_newfl&vgd_end=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sun, 17 Dec 2023 18:05:22 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 663A 0
0 41ms
41ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202312070101&jk=1125956065890868&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame D972 70 KB
28 KB 303ms
303ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2243&&kkdd=nH%7CH%7CA9*n&111=wTaGkSUp*Ro%3D&3z=)dDxlsCsxxdCFfxDs)s&J2vh=)&1GvK=D&r23=))sD&QGrA=4sFD&rz2=l9mP~ZRs8&rvr2=~U*5CUPbBxsXbf2daW2UsJ%3D%3D&rhz2=lifFxssd)&GzgA=dxlBfD&rr=pR&Gr=Xu&rOE1=8-t~nku&vz2=lYn94f)C4&Qvz2=HYCIxmC&OQQvG=)&hhh=Qgt.O4ry.4f8vYvel(ZXuy1rdhrn(axHi6*dxiRmR3YteKGYsUYq2C_km88I(!tE&o!hS=OQQvG%3A%2F%2F!OAhAJaAGVra1&Ao!hS=!ddRZ%3AeeX!(4(61(ZVk1u&EGA=F&y!=)&wJ2=i&K2Q)=l9m)lls)U&K2Qx=fFD)Fxi)d&N2KQK=G2x%3DEwyy7zwhyqy%3DxD7aJAhv1%3DDVDf73zGqG2%3Di)l7hSqrEQ%3D)72rx%3D)7Gr2%3DN673qKGE%3DxD)D))73yxhqG2%3DxDxs)x)d))7zwhyqN%3DdFiCVDs7whyqQor%3DD7GQ2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7yKGQ%3D73zGqwhyqN%3DDVdC7zv%3D)QT44K7SNN%3DD73zGqwhyqy%3DsD7hzzvwK%3DD%2CD7AQ%3D)C7hr%3D)71Qz2%3DYnDDDD)x7hvGqG2%3DxDxs)x)F)C73zGqN%3DdF)Vx)7whyqN%3DDV)s73yxhqwhyqN%3DD73yxhqwhyq3z%3D)R.)C7whyqQ3z%3DD7whyqy%3DxD7JrKQ%3D.)7NN%3D)fC733%3DD7yxhqN%3D)DDD7Ahv1%3DDVDf73yxhqwhyqor%3DDRD7N1%3D)7KsvqN%3D)VDs%2C)))VDx7Gz2%3DiCff2NFlFrCiDDDNiNdDNClA)d22AxlA7G2%3D.)7wz2%3Dxx2FI2_4dTdTi9**hf7NQ2%3DsDdfff)DiFi)lCd)Fs)Fxx)lC)FxfF)lC)iCdFsFCx)DlFCsddiiCdfdD)dfiiDi)iCdDCDlxCxDfCCD)sFCf)flFCd)sDxlfD)Clsx73!w%3D.)72xvqy%3D)D7svrS%3D)DDD7wz1%3DD73!q1A2%3DDVC)7211qGQhJ%3DOKh1aE672xvqN%3D)7aJ2xvqN%3DDVfC73whyqN%3DDVxi7GG%3D)CDDB)xDD7rr%3DpR7wz!%3D.)7rA%3DD7hvGqN%3D)))VDx73whyqy%3DxD79U%3DsDCx7oNqwr%3D.x7EQG%3D)7oNqrroG%3D.x7rQ%3DEwhA1NAhJ7NGGqMHP%3Dk-%2Ck-7NKGzGx%3D)fC7NKGzG)%3D)fC7zGtAS%3DD7z3whyqN%3DiV)C7zGzS%3DD7Nz2%3DDVDf72r%3Dd73yxhqN%3D)VDs7z3whyqy%3DxD7rN2v%3DDVDid7G2%3D.)7zQ6vAqz2%3Ds7GAyyAhqQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7Gwvvy6qQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7vaG%3D)7hASqrEQ%3D)7rKhhzAhU2%3DD7aJNz2%3DDVDfD7NSyh%3DDVDDD72Qr%3DAwqNA7211qAhv1%3DSKyGA7211%3DOKh1aE67N2vrKv2%3DD72KyJ%3DwEzGaExC7GaNv%3D7OQ1y%3D)72rwQ%3DFD72aJN%3DD.)7zNr%3D)7EGg%3D)7QJG%3DdxlBfD7NGN%3DD7NGv%3DD7Q1B%3Dxls&EQ3=D&z!=dxl&zEUSh=)&N2hU2=iFf&Nz2=sifDDl&oQQyA=HhKrA%20tAGwyQG%20%7C%20POAhAIaAG&1rS=dCFfx&62Gvh=)&NKA=XBAJ*%2FiKJX&oKQvhA=)&oKQNz2=.)Ds&rK2a1KzE=Qgt.O4ry.4lMQn4i(Waz9MOlQrs-vgwsv_lzvDAiYgR%3D&6vyv=)&zGz2=F&vJz2=v))lfii)Dx)xQxDxs)x)d)lDF&GGy2=%7B%22GGzv%22%3A%22lDVxFFV)DVD%22%2C%22GGrr%22%3A%22pR%22%2C%22GGGr%22%3A%22Xu%22%2C%22GGrQ6%22%3A%22EwhA1NAhJ%22%7D&OQ1yGhr=)&sflct=2096410&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CUWMQE3H&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

e95b3976077e055032306bc69f2eb2d040a560cabc2918d85ce29b2c13f04b54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 28775
content-type: text/html
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Sun, 17 Dec 2023 18:05:22 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-lahh

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9B62 16 KB
6 KB 81ms
81ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&ckdel=1&cs=2&cv=31&cid=8CUWMQE3H&https=1&itype=CM

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

1ff431fe8ec11f34c7c0dc7a78163543975eaa19c08a09781eeff31fa00e6e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 5967
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 18:05:22 GMT
expires: Tue, 19 Dec 2023 18:05:22 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 bping.php
lg3.media.net/ Frame E689 35 B
176 B 54ms
54ms Image
image/gif 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2064&&vgd_cdv=1130&vgd_cage=4&vgd_tsce=L350&vgd_mcf=76592&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=849523371&vi=1702836322765920313&ugd=4&lf=6&kwrf=https%3A%2F%2Fwheregoes.com&cc=DE&sc=BY&lper=100&wsip=170785191&r=1702836322667&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvPRSasP3IP_d6VNUHHGJwRn&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9i~e8QMQOvHuW~LkMNz7vu~ONfvu~QNOvG5~eM1Qzvf9u9uu~ejfLMQOvf9fAufuhuu~8xLjMGvhXHF.9A~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hF~8Evu7tTT1~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~Y78Ov0a9999uf~LEQMQOvf9fAufuXuF~e8QMGvhXu.fu~xLjMGv9.uA~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9i~ejfLMxLjMUNv949~GYvu~1AEMGvu.9A%2Cuuu.9f~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZO%2FThthtH%3D%20%20Li~G7OvA9hiiiu9HXHuWFhuXAuXffuWFuXfiXuWFuHFhXAXFfu9WXFAhhHHFhih9uhiHH9HuHFh9F9WfFf9iFF9uAXFiuiWXFhuA9fWi9uFWAf~eBxvou~OfEMjvu9~AENkvu999~x8Yv9~eBMYJOv9.Fu~OYYMQ7Lyvw1LYmz5~OfEMGvu~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvuuu.9f~exLjMjvf9~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vzxLJYGJLy~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9i~ONvh~ejfLMGvu.9A~8exLjMjvf9~NGOEv9.9Hh~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9i9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfWA&ssld=%7B%22QQ8E%22%3A%22W9.fXX.u9.9%22%2C%22QQNN%22%3A%22r4%22%2C%22QQQN%22%3A%22R3%22%2C%22QQN75%22%3A%22zxLJYGJLy%22%7D&vgd_bid=349008&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=201011&vgd_rakh=1702836322164006407&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_pgid=p11894410212t202312171805&vgd_pgids=4&vgd_uspa=0&hvsid=00001702836322666013588915205270&gdpr=1&mspa=0&vgd_l2type=scs_newfl&vgd_end=1

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

server-13-227-219-23.ams54.r.cloudfront.net

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sun, 17 Dec 2023 18:05:22 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:22 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 77AF 0
10 B 7ms
7ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?J_7wSw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 678A 18 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702836322&bdh=Uio1U2Z52n_0ZkiaO8nxZ6gftss.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1869682767&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 17:14:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3076
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sun, 17 Dec 2023 18:14:06 GMT

GET
H2 200 apn
beacon.sojern.com/imp/ Frame 678A 42 B
199 B 60ms
17ms Image
image/gif 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/apn?auc=4019476741152927309&cr=476571773&seg=&st=0&bp=0.02202&pp=0.018704&aaid=&idfa=&ord=591248315
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702836322&bdh=Uio1U2Z52n_0ZkiaO8nxZ6gftss.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1869682767&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 ca Show response
choices.truste.com/ Frame 678A 2 KB
2 KB 153ms
101ms Script
text/javascript 13.227.219.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=591248315&sz=300x250&js=st_dapp

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a36403421b18ef7385d5575765e6c414.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS54-C1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 918
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: IxpkM8PRUR99kT0flaqzbzhrIFNNajhGyoZY1g9MixeLvq5H_4g7-Q==
expires: Sun, 17 Dec 2023 19:05:22 GMT

GET
H2 200 it
fra1-ib.adnxs.com/ Frame 678A 0
645 B 38ms
27ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLlD_BV5QcAAAMA1gAFAQji8PyrBhDN3PXazJmD5DcYlauQiN-4uvUaKjYJiT7odz8nkz8RpTZQ9O4kij8ZAAAAQOF6xD8hzjQGQlfHjj8plIJuL2mMlj8xAAABG7CEPzDjgvQIOMpBQOo_SAJQ_dCf4wFYmNVSYABokfdreLaHBoABAYoBA1VTRJIFBvRsBJgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gHDBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3RDbmxvVG4tUWtmdUgxVEx5N1RZU2g4aE5NOTlKYy1wZVBDNF9CSjZnbUF5Y2I5TjROaXVMenVBV19YM3ppbXMtUzBUZEN2UzVzLTNyR05mX1lSYUI2VG9vSWlxSUd1T2tyZXQtdUQxU2p6NWZXZ182YUdFQXNCTE83VnRZcDNkOVREM3NSQjVUQ0Rxb2M2VzdiOUF5djJwLXFUMzBvcGd2TlZ6T1hPOFE0d0hfN2JNY25uWXJBWTRDN2RYVjc2TVdYcHBuSXZod2ZieGhQRVBoOGJMb3RhdlkzaVFDLVdQMUdLODdacmpWMEQ2V2VaZ0Nhb1dSMDdlYi1pSjhGUjA3Z01wUGc1elZUd29vSU9OQ284bElnYXVZOXZ5eXVkeFhOQVRhWUwwOW0zdEVUQWVfUEhaRWlWZGxvd1JHTUxpZ2VEUXZFeEVuV1JLQ3RET3U2bFpIZkxONExjem15WUZmbzlRJTI1MjZzYWklMjUzREFNZmwtWVE2UE05QTFoNm1fU0dZc0dGMFI2OFJhM0tpcHhkSVhfM0ZFNnJQejlLTUZFMjFod1pfWG1Rb3hyMF9mRThtUHMzcGNBZ0lCSVpSSmVESEl0STE5LW9RN0NuNS1LOWRNRlBPa0twa0NKNUEwWlNDY2R1cHlXTDl6QUdPVndTWGhLZUlVMVN6YUlQMUY4dTUxMzFXVENRMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pEWDJfdFc0MHNCc0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTI1NUJnd19mYnNhZWlkJTI1MjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEAigJTdWYoJ2EnLCA1NjgzNzA3LCAwKTt1ZignaScsIDY1NTE5ODUsIDApO3VmKCdnJywgMTYzNTc4NzksIDApO3VmKCdyJywgNDc2NTcxNzczLCAwKTuSAo0EIW1GN3QwZ2pFbmJFWUVQM1FuLU1CR0FBZ21OVlNNQUE0QUVBQVNPb19VT09DOUFoWUFHQ3RCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCcWxiX2tsbU5sal9CQWFwV181SlpqWllfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiSHpqd1AxQWNkcXREeVlBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xHVWtFeE9qWTFPRFBnQTUxRmdBU3NoS0FIaUFURmhLQUhrQVFCbUFRQndRUUFBQUFBQUFBQUFNa0VBQUFBQUFBQUFBRFlCQUR4FaUoQUFBaUFXM002a0YBDAEBFDhELXhCUQEKCQEUd1FVME16AQIMUERQOAkoHFlCX0x3al9SLigACDJRVQkxwEFEd1AtQUZtaEh3QmZlejVnZjRCZnZ6MmdLQ0JnTlZVMFNJQmdTUUJnR1lCZ0NoQmcNNyxBQUFxQVlFc2dZa0MdgABFHQwARx0MAEkdDBh1QVlLZ1FnGahgdy4umgKZASE4QkM4d1FqRW5iRVlFUDNRbkERKEpqVlVpQUFLQUF4AXUNAUw2Q1VaU1FURTZOalU0TTBDZFJVaw0bEER3UDFFDQwMQUFBRhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERAERHcBnSzYAgDgAp_wP-oCFmih1fDJOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqAwDAA9gEyAMA2APF1PIB4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTgwLjI1NS4xMC4xOTmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA44MTcwI0ZSQTE6NjU4M9oEAggB4AQA8AT90J_jAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBZzUPPoFBAFuKJAGAJgGALgGAMEGBSIsAPA_0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB7aHBtIHDQkRKAEmCNoHBgFdvBgA4AcA6gcCCADwB71EiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=a07fb5de808680eefde330acdb90f5ee08e1ea9e

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
an-x-request-uuid: ad081524-c2cd-4190-89c2-6ccfa0b22be8
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/240/ Frame 678A 80 KB
27 KB 74ms
26ms Script
application/x-javascript 23.43.60.179
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/240/trk.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1702836322&bdh=Uio1U2Z52n_0ZkiaO8nxZ6gftss.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1869682767&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%2526sai%253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%2526sig%253DCg0ArKJSzDX2_tW40sBsEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.43.60.179 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-60-179.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 519e50788224b3422c6e6b1cce48d5decb83eece248558b54e48f88491e48aa4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 18:05:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Nov 2023 14:06:46 GMT
Server: AkamaiNetStorage
ETag: "ccac3ab7f323b8743d099010fcce15a4:1700057206.383562"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27680
Expires: Mon, 16 Dec 2024 18:05:22 GMT

GET
H2 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame 678A 59 KB
23 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 06:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 473632
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 11 Dec 2024 06:31:30 GMT

GET
H2 200 B31003176.380596325;dc_ver=99.292;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=4019476741152927309;crid=476571773;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_C... Show response
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame 678A 78 KB
33 KB 77ms
49ms Script
text/javascript 142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B31003176.380596325;dc_ver=99.292;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=4019476741152927309;crid=476571773;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=545847862;ord=iu4e8v;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKaAfCZmgAAAAMAxBkFAQji8PyrBhDN3PXazJmD5DcYlauQiN-4uvUaIOOC9AgoykEw6j84AkD90J_jAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG2hwaIAQGQAQKYAQWgAQKpAYk-6Hc_J5M_sQGlNlD07iSKP7kBAAAAQOF6xD_BAc40BkJXx44_yQGUgm4vaYyWP9gBAOABAA..%2Fs%3Db92004bd091355a9f45f7f25d465b99966e7c291%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%25218BC8wQjEnbEYEP3Qn-MBGJjVUiAAKAAxAAAAAAAAAAA6CUZSQTE6NjU4M0CdRUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DODE3MCNGUkExOjY1ODM%3D%2Fbn%3D99254%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%252526sai%25253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%252526sig%25253DCg0ArKJSzDX2_tW40sBsEAE%252526fbs_aeid%25253D%2525255Bgw_fbsaeid%2525255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=lv_)dzzoz4;gcsr=m;stc=1;chaa=1;sttr=28;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

fef37d453b626dd73af7a42a3b3cd431b20e31ad497457d2f55397344211687e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32928
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame C2AF 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C2AF 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C2AF 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Roboto-Bold.woff
contextual.media.net/__media__/fonts/Roboto-Bold/ Frame C2AF 24 KB
24 KB 28ms
28ms Font
font/woff 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/Roboto-Bold/Roboto-Bold.woff

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2245&&kkdd=3W%7CW%7CAh3H9nu*&cT=P!6p_xjxppxp4K_6_P*&7rNw=P&RaNU=6&brc=PPx6&Mabg=hx*6&bTr=_nmd1JVxe&bNbr=1QILjQdGipx9G4r!(XrQx7%3D%3D&bwTr=P*P!PKxxP&aTEg=x66ij66&bb=CV&ab=98&bAqR=eY21oF8&NTr=_Donh4Pjh&MNTr=HDjOpmj&AMMNa=P&www=ME2WAhbyWh4eNDNt_lJ98yRb!wbol(pHK.I!pKVmVcD2tUaDxQD~rj0FmeeOlk2q&SkwZ=AMMNa%3A%2F%2FkAgwg7(ga3b(R&gSkwZ=k!!VJ%3Att9klhl.RlJ3FR8&qag=*&yk=P&B7r=K&UrMP=_nmP__xPQ&UrMp=!Kpj4jPP6&zrUMU=arp%3DqByy)TBwy~y%3Dp6)(7gwNR%3D636!)cTa~ar%3DKP_)wZ~bqM%3DP)rbp%3DP)zUM%3D6%2C6%2C6)abr%3Dz.)c~Uaq%3Dp6P6PP)cypw~ar%3Dp6pxPpP!PP)TBwy~z%3D!*Kj36x)Bwy~MSb%3D6)aMr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)yUaM%3D)cTa~Bwy~z%3D63jp)TN%3DPMshhU)Zzz%3D6)cTa~Bwy~y%3Dp6)wTTNBU%3D6%2C6)gM%3DP4)wb%3DP)RMTr%3DDo6666Pp)wNa~ar%3Dp6pxPpP*Pj)cTa~z%3DKj!3*_)Bwy~z%3D63Px)cypw~Bwy~z%3D6)cypw~Bwy~cT%3DPVWPj)Bwy~McT%3D6)Bwy~y%3Dp6)7bUM%3DWP)zz%3DP4j)cc%3D6)ypw~z%3DP666)gwNR%3D636p)cypw~Bwy~Sb%3D6V6)zR%3D63p*)UxN~z%3DP3Kj%2CP6_3Pj)aTr%3DP*P!PKxxP)ar%3DWP)BTr%3Dppr*G-bD4leEaNE2P0)zMr%3Dx6!444P6K*KP_!4__Kjp!6!6!6*_xxpp*xpK*x4PPKjj!P!!p_P6x4jK!jx4_*p*Pjpx!6_KPx446*P_!Pxpjp*xx46x6xj66P_*xKK)ckB%3DWP)rpN~y%3DP6)xNbZ%3DP666)BTR%3D6)ck~Rgr%3D63x*)rRR~aMw7%3DAUwR(q.)rpN~z%3DP)(7rpN~z%3D634j)cBwy~z%3D63pK)aa%3DPj66iPp66)bb%3DCV)BTk%3DWP)bg%3D6)wNa~z%3DP6_3Pj)cBwy~y%3Dp6)nQ%3Dx6jp)Sz~Bb%3DWp)qMa%3DP)Sz~bbSa%3DWp)bM%3DqBwgRzgw7)zaa~-Hd%3DFY%2CFY)zUaTap%3DP4j)zUaTaP%3DP4j)Ta2gZ%3D6)TcBwy~z%3DK3Pj)TaTZ%3D6)zTr%3D636p)rb%3D!)cypw~z%3DP3Kj)TcBwy~y%3Dp6)bzrN%3D636P6)ar%3DWP)TM.Ng~Tr%3Dx)agyygw~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)aBNNy.~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)N(a%3Dx)wgZ~bqM%3DP)bUwwTgwQr%3D6)(7zTr%3D636p6)zZyw%3D63666)rMb%3DgB~zg)rRR~gwNR%3DZUyag)rRR%3DAUwR(q.)zrNbUNr%3D6)rUy7%3DBqTa(qPp)a(zN%3D)AMRy%3DP)rbBM%3D_*)r(7z%3D6WP)Tzb%3DP)qaE%3DP)M7a%3Dx66ij66)zaz%3D6)zaN%3D6)MRi%3Dp_x&qMc=6&RRR=Bs(aFZQCIVS%3D&Tk=x66&TqQZw=P&zrwQr=K*4&zTr=xK46jj&SMMyg=HwUbg%202gaByMa%20%7C%20dAgwgO(ga&RbZ=!j*4p&.raNw=P&zUg=9ig7I%2FKU79&SUMNwg=P&SUMzTr=WP6x&bUr(RUTq=ME2WAhbyWh_-MohKlX(Tn-A_MbxYNEBxN0_TN6gKDEV%3D&.NyN=P&TaTr=*&N7Tr=NPP_4KKP6pPpMp6pxPpP!P_6*&aayr=%7B%22aaTN%22%3A%22_63p**3P636%22%2C%22aabb%22%3A%22CV%22%2C%22aaab%22%3A%2298%22%2C%22aabM.%22%3A%22qBwgRzgw7%22%7D&AMRyawb=P&sflct=8062825&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c8a7ea184c79a6f61c400968314d03aae7c327f03efc03603f6a3cbada7bfb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2245&&kkdd=3W%7CW%7CAh3H9nu*&cT=P!6p_xjxppxp4K_6_P*&7rNw=P&RaNU=6&brc=PPx6&Mabg=hx*6&bTr=_nmd1JVxe&bNbr=1QILjQdGipx9G4r!(XrQx7%3D%3D&bwTr=P*P!PKxxP&aTEg=x66ij66&bb=CV&ab=98&bAqR=eY21oF8&NTr=_Donh4Pjh&MNTr=HDjOpmj&AMMNa=P&www=ME2WAhbyWh4eNDNt_lJ98yRb!wbol(pHK.I!pKVmVcD2tUaDxQD~rj0FmeeOlk2q&SkwZ=AMMNa%3A%2F%2FkAgwg7(ga3b(R&gSkwZ=k!!VJ%3Att9klhl.RlJ3FR8&qag=*&yk=P&B7r=K&UrMP=_nmP__xPQ&UrMp=!Kpj4jPP6&zrUMU=arp%3DqByy)TBwy~y%3Dp6)(7gwNR%3D636!)cTa~ar%3DKP_)wZ~bqM%3DP)rbp%3DP)zUM%3D6%2C6%2C6)abr%3Dz.)c~Uaq%3Dp6P6PP)cypw~ar%3Dp6pxPpP!PP)TBwy~z%3D!*Kj36x)Bwy~MSb%3D6)aMr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)yUaM%3D)cTa~Bwy~z%3D63jp)TN%3DPMshhU)Zzz%3D6)cTa~Bwy~y%3Dp6)wTTNBU%3D6%2C6)gM%3DP4)wb%3DP)RMTr%3DDo6666Pp)wNa~ar%3Dp6pxPpP*Pj)cTa~z%3DKj!3*_)Bwy~z%3D63Px)cypw~Bwy~z%3D6)cypw~Bwy~cT%3DPVWPj)Bwy~McT%3D6)Bwy~y%3Dp6)7bUM%3DWP)zz%3DP4j)cc%3D6)ypw~z%3DP666)gwNR%3D636p)cypw~Bwy~Sb%3D6V6)zR%3D63p*)UxN~z%3DP3Kj%2CP6_3Pj)aTr%3DP*P!PKxxP)ar%3DWP)BTr%3Dppr*G-bD4leEaNE2P0)zMr%3Dx6!444P6K*KP_!4__Kjp!6!6!6*_xxpp*xpK*x4PPKjj!P!!p_P6x4jK!jx4_*p*Pjpx!6_KPx446*P_!Pxpjp*xx46x6xj66P_*xKK)ckB%3DWP)rpN~y%3DP6)xNbZ%3DP666)BTR%3D6)ck~Rgr%3D63x*)rRR~aMw7%3DAUwR(q.)rpN~z%3DP)(7rpN~z%3D634j)cBwy~z%3D63pK)aa%3DPj66iPp66)bb%3DCV)BTk%3DWP)bg%3D6)wNa~z%3DP6_3Pj)cBwy~y%3Dp6)nQ%3Dx6jp)Sz~Bb%3DWp)qMa%3DP)Sz~bbSa%3DWp)bM%3DqBwgRzgw7)zaa~-Hd%3DFY%2CFY)zUaTap%3DP4j)zUaTaP%3DP4j)Ta2gZ%3D6)TcBwy~z%3DK3Pj)TaTZ%3D6)zTr%3D636p)rb%3D!)cypw~z%3DP3Kj)TcBwy~y%3Dp6)bzrN%3D636P6)ar%3DWP)TM.Ng~Tr%3Dx)agyygw~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)aBNNy.~MU7~Tr%3DzaUWE(qg~PjKPxP_*p4466Wj~PpxK*j)N(a%3Dx)wgZ~bqM%3DP)bUwwTgwQr%3D6)(7zTr%3D636p6)zZyw%3D63666)rMb%3DgB~zg)rRR~gwNR%3DZUyag)rRR%3DAUwR(q.)zrNbUNr%3D6)rUy7%3DBqTa(qPp)a(zN%3D)AMRy%3DP)rbBM%3D_*)r(7z%3D6WP)Tzb%3DP)qaE%3DP)M7a%3Dx66ij66)zaz%3D6)zaN%3D6)MRi%3Dp_x&qMc=6&RRR=Bs(aFZQCIVS%3D&Tk=x66&TqQZw=P&zrwQr=K*4&zTr=xK46jj&SMMyg=HwUbg%202gaByMa%20%7C%20dAgwgO(ga&RbZ=!j*4p&.raNw=P&zUg=9ig7I%2FKU79&SUMNwg=P&SUMzTr=WP6x&bUr(RUTq=ME2WAhbyWh_-MohKlX(Tn-A_MbxYNEBxN0_TN6gKDEV%3D&.NyN=P&TaTr=*&N7Tr=NPP_4KKP6pPpMp6pxPpP!P_6*&aayr=%7B%22aaTN%22%3A%22_63p**3P636%22%2C%22aabb%22%3A%22CV%22%2C%22aaab%22%3A%2298%22%2C%22aabM.%22%3A%22qBwgRzgw7%22%7D&AMRyawb=P&sflct=8062825&ure=1
Origin: https://contextual.media.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 24816
expires: Mon, 18 Dec 2023 18:05:22 GMT

GET
DATA 200
OK truncated
/ Frame D972 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D972 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D972 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Roboto-Bold.woff
contextual.media.net/__media__/fonts/Roboto-Bold/ Frame D972 24 KB
24 KB 31ms
31ms Font
font/woff 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/Roboto-Bold/Roboto-Bold.woff

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2243&&kkdd=nH%7CH%7CA9*n&111=wTaGkSUp*Ro%3D&3z=)dDxlsCsxxdCFfxDs)s&J2vh=)&1GvK=D&r23=))sD&QGrA=4sFD&rz2=l9mP~ZRs8&rvr2=~U*5CUPbBxsXbf2daW2UsJ%3D%3D&rhz2=lifFxssd)&GzgA=dxlBfD&rr=pR&Gr=Xu&rOE1=8-t~nku&vz2=lYn94f)C4&Qvz2=HYCIxmC&OQQvG=)&hhh=Qgt.O4ry.4f8vYvel(ZXuy1rdhrn(axHi6*dxiRmR3YteKGYsUYq2C_km88I(!tE&o!hS=OQQvG%3A%2F%2F!OAhAJaAGVra1&Ao!hS=!ddRZ%3AeeX!(4(61(ZVk1u&EGA=F&y!=)&wJ2=i&K2Q)=l9m)lls)U&K2Qx=fFD)Fxi)d&N2KQK=G2x%3DEwyy7zwhyqy%3DxD7aJAhv1%3DDVDf73zGqG2%3Di)l7hSqrEQ%3D)72rx%3D)7Gr2%3DN673qKGE%3DxD)D))73yxhqG2%3DxDxs)x)d))7zwhyqN%3DdFiCVDs7whyqQor%3DD7GQ2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7yKGQ%3D73zGqwhyqN%3DDVdC7zv%3D)QT44K7SNN%3DD73zGqwhyqy%3DsD7hzzvwK%3DD%2CD7AQ%3D)C7hr%3D)71Qz2%3DYnDDDD)x7hvGqG2%3DxDxs)x)F)C73zGqN%3DdF)Vx)7whyqN%3DDV)s73yxhqwhyqN%3DD73yxhqwhyq3z%3D)R.)C7whyqQ3z%3DD7whyqy%3DxD7JrKQ%3D.)7NN%3D)fC733%3DD7yxhqN%3D)DDD7Ahv1%3DDVDf73yxhqwhyqor%3DDRD7N1%3D)7KsvqN%3D)VDs%2C)))VDx7Gz2%3DiCff2NFlFrCiDDDNiNdDNClA)d22AxlA7G2%3D.)7wz2%3Dxx2FI2_4dTdTi9**hf7NQ2%3DsDdfff)DiFi)lCd)Fs)Fxx)lC)FxfF)lC)iCdFsFCx)DlFCsddiiCdfdD)dfiiDi)iCdDCDlxCxDfCCD)sFCf)flFCd)sDxlfD)Clsx73!w%3D.)72xvqy%3D)D7svrS%3D)DDD7wz1%3DD73!q1A2%3DDVC)7211qGQhJ%3DOKh1aE672xvqN%3D)7aJ2xvqN%3DDVfC73whyqN%3DDVxi7GG%3D)CDDB)xDD7rr%3DpR7wz!%3D.)7rA%3DD7hvGqN%3D)))VDx73whyqy%3DxD79U%3DsDCx7oNqwr%3D.x7EQG%3D)7oNqrroG%3D.x7rQ%3DEwhA1NAhJ7NGGqMHP%3Dk-%2Ck-7NKGzGx%3D)fC7NKGzG)%3D)fC7zGtAS%3DD7z3whyqN%3DiV)C7zGzS%3DD7Nz2%3DDVDf72r%3Dd73yxhqN%3D)VDs7z3whyqy%3DxD7rN2v%3DDVDid7G2%3D.)7zQ6vAqz2%3Ds7GAyyAhqQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7Gwvvy6qQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7vaG%3D)7hASqrEQ%3D)7rKhhzAhU2%3DD7aJNz2%3DDVDfD7NSyh%3DDVDDD72Qr%3DAwqNA7211qAhv1%3DSKyGA7211%3DOKh1aE67N2vrKv2%3DD72KyJ%3DwEzGaExC7GaNv%3D7OQ1y%3D)72rwQ%3DFD72aJN%3DD.)7zNr%3D)7EGg%3D)7QJG%3DdxlBfD7NGN%3DD7NGv%3DD7Q1B%3Dxls&EQ3=D&z!=dxl&zEUSh=)&N2hU2=iFf&Nz2=sifDDl&oQQyA=HhKrA%20tAGwyQG%20%7C%20POAhAIaAG&1rS=dCFfx&62Gvh=)&NKA=XBAJ*%2FiKJX&oKQvhA=)&oKQNz2=.)Ds&rK2a1KzE=Qgt.O4ry.4lMQn4i(Waz9MOlQrs-vgwsv_lzvDAiYgR%3D&6vyv=)&zGz2=F&vJz2=v))lfii)Dx)xQxDxs)x)d)lDF&GGy2=%7B%22GGzv%22%3A%22lDVxFFV)DVD%22%2C%22GGrr%22%3A%22pR%22%2C%22GGGr%22%3A%22Xu%22%2C%22GGrQ6%22%3A%22EwhA1NAhJ%22%7D&OQ1yGhr=)&sflct=2096410&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c8a7ea184c79a6f61c400968314d03aae7c327f03efc03603f6a3cbada7bfb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2243&&kkdd=nH%7CH%7CA9*n&111=wTaGkSUp*Ro%3D&3z=)dDxlsCsxxdCFfxDs)s&J2vh=)&1GvK=D&r23=))sD&QGrA=4sFD&rz2=l9mP~ZRs8&rvr2=~U*5CUPbBxsXbf2daW2UsJ%3D%3D&rhz2=lifFxssd)&GzgA=dxlBfD&rr=pR&Gr=Xu&rOE1=8-t~nku&vz2=lYn94f)C4&Qvz2=HYCIxmC&OQQvG=)&hhh=Qgt.O4ry.4f8vYvel(ZXuy1rdhrn(axHi6*dxiRmR3YteKGYsUYq2C_km88I(!tE&o!hS=OQQvG%3A%2F%2F!OAhAJaAGVra1&Ao!hS=!ddRZ%3AeeX!(4(61(ZVk1u&EGA=F&y!=)&wJ2=i&K2Q)=l9m)lls)U&K2Qx=fFD)Fxi)d&N2KQK=G2x%3DEwyy7zwhyqy%3DxD7aJAhv1%3DDVDf73zGqG2%3Di)l7hSqrEQ%3D)72rx%3D)7Gr2%3DN673qKGE%3DxD)D))73yxhqG2%3DxDxs)x)d))7zwhyqN%3DdFiCVDs7whyqQor%3DD7GQ2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7yKGQ%3D73zGqwhyqN%3DDVdC7zv%3D)QT44K7SNN%3DD73zGqwhyqy%3DsD7hzzvwK%3DD%2CD7AQ%3D)C7hr%3D)71Qz2%3DYnDDDD)x7hvGqG2%3DxDxs)x)F)C73zGqN%3DdF)Vx)7whyqN%3DDV)s73yxhqwhyqN%3DD73yxhqwhyq3z%3D)R.)C7whyqQ3z%3DD7whyqy%3DxD7JrKQ%3D.)7NN%3D)fC733%3DD7yxhqN%3D)DDD7Ahv1%3DDVDf73yxhqwhyqor%3DDRD7N1%3D)7KsvqN%3D)VDs%2C)))VDx7Gz2%3DiCff2NFlFrCiDDDNiNdDNClA)d22AxlA7G2%3D.)7wz2%3Dxx2FI2_4dTdTi9**hf7NQ2%3DsDdfff)DiFi)lCd)Fs)Fxx)lC)FxfF)lC)iCdFsFCx)DlFCsddiiCdfdD)dfiiDi)iCdDCDlxCxDfCCD)sFCf)flFCd)sDxlfD)Clsx73!w%3D.)72xvqy%3D)D7svrS%3D)DDD7wz1%3DD73!q1A2%3DDVC)7211qGQhJ%3DOKh1aE672xvqN%3D)7aJ2xvqN%3DDVfC73whyqN%3DDVxi7GG%3D)CDDB)xDD7rr%3DpR7wz!%3D.)7rA%3DD7hvGqN%3D)))VDx73whyqy%3DxD79U%3DsDCx7oNqwr%3D.x7EQG%3D)7oNqrroG%3D.x7rQ%3DEwhA1NAhJ7NGGqMHP%3Dk-%2Ck-7NKGzGx%3D)fC7NKGzG)%3D)fC7zGtAS%3DD7z3whyqN%3DiV)C7zGzS%3DD7Nz2%3DDVDf72r%3Dd73yxhqN%3D)VDs7z3whyqy%3DxD7rN2v%3DDVDid7G2%3D.)7zQ6vAqz2%3Ds7GAyyAhqQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7Gwvvy6qQKJqz2%3DNGK.gaEAq)Ci)xxlDxCFfF.iq)xsiFC7vaG%3D)7hASqrEQ%3D)7rKhhzAhU2%3DD7aJNz2%3DDVDfD7NSyh%3DDVDDD72Qr%3DAwqNA7211qAhv1%3DSKyGA7211%3DOKh1aE67N2vrKv2%3DD72KyJ%3DwEzGaExC7GaNv%3D7OQ1y%3D)72rwQ%3DFD72aJN%3DD.)7zNr%3D)7EGg%3D)7QJG%3DdxlBfD7NGN%3DD7NGv%3DD7Q1B%3Dxls&EQ3=D&z!=dxl&zEUSh=)&N2hU2=iFf&Nz2=sifDDl&oQQyA=HhKrA%20tAGwyQG%20%7C%20POAhAIaAG&1rS=dCFfx&62Gvh=)&NKA=XBAJ*%2FiKJX&oKQvhA=)&oKQNz2=.)Ds&rK2a1KzE=Qgt.O4ry.4lMQn4i(Waz9MOlQrs-vgwsv_lzvDAiYgR%3D&6vyv=)&zGz2=F&vJz2=v))lfii)Dx)xQxDxs)x)d)lDF&GGy2=%7B%22GGzv%22%3A%22lDVxFFV)DVD%22%2C%22GGrr%22%3A%22pR%22%2C%22GGGr%22%3A%22Xu%22%2C%22GGrQ6%22%3A%22EwhA1NAhJ%22%7D&OQ1yGhr=)&sflct=2096410&ure=1
Origin: https://contextual.media.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:22 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 24816
expires: Mon, 18 Dec 2023 18:05:22 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame C2AF 15 B
178 B 69ms
69ms Script
text/javascript 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=6357&&vgd_canary=0&vgd_l2type=scs_newfl&fp=W0cfseha3aKdfMTCv5h_5RiDYZFYrWuEb5pxDp4Ed4mr5gGcxVCsDMRl8FxVkrkJYrQP6wpYfZ5UMxx8DwT6EuUkX7x1nHvIX7-P0Er8SwB3j6bwmm6k6gDXnvxzm_UeXl1VP--J3GVf4-34GA1Y5A%3D%3D&cme=ygqpBKP0uIK7hfqXkckEigQiKW1XgII0VuCZSdtEPnuUvxA9SboMXYXHy-BSJ_XsLQh2jVldowZk9N5CWXwQYmJynRimqLgjRrCCsOudd7qbylwiVVrWpO-dKbNkekEKrEsIrx_VDGvbuKOZXF9QgPRrh8Ilenwexa1vBxaM7Th9a76akavQpGJfX09KE7-8haVCwj8xjt1rXoql_Ockmfc6wFDjNuiM3cM3R7MZHGc3Bot0RcR6hA%3D%3D%7C%7Cu8A6SM53vAd1h_O4ROJtLwq5PaKyqUuh%7CAas3KeVaKZSzW26uwmJe1jxeavT7bWHv%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD4xoVDcMCSohdoT-YwCWNAerAHD6uEMv1LMPM4wmCD6tETirIU9dkbLlREtdKSUgw0%3D%7Cxrl5Md8q4-8glDlbUPMSt3FeMVWn2h2mj7Xw_c-0vKM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7CYKD00Zfu-OzFKHUwh5xfFwLCHC5Cqpc5djfOU24KDZLVzltsLBrc3YOBquGEL-tD-DA1b68sv-NpIe167yeDdsdULdzsB7C-B-hjyWv6rqzvSOTwOrDcWUdXbvd417VDwpeSSCVj01jantsWdVM76CLOBuy4iIbmYzJtJGGNFCyNv1xRG13eToH5xE_V6xXwWLmfNSIM-2AKoPe0HIE6PQIyw9c679giKc-CSOuTehjhgwpCeQRqgW-1FDctTWSUWbtEIzJ9n2UPG2co7yMeM3YOa192zEDIYKUzO_fzmbY%3D%7C&subBdr=196&bdrid=459&ksu=243&fdkt=391&vgde_kbbh=ffoyxQJuO&kwd[]=Top+10+Kreditkarten&kwt[]=391&kbc[]=1300920941&kwp[]=1&kid[]=329509136&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.1103%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D2.01%7C2%3D4.69&ktd[]=4503874522120448&kwd[]=Kurze+Kleider+f%C3%BCr+Damen&kwt[]=391&kbc[]=1300920941&kwp[]=2&kid[]=326742187&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.0707%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.39%7C2%3D1.11&ktd[]=274894749952&kwd[]=Die+besten+Nebenjobs+von+Zuhause&kwt[]=391&kbc[]=1300920941&kwp[]=3&kid[]=350764522&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121708%7C13%3D0.1022%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D1.15%7C2%3D2.66&ktd[]=274894749952&kwd[]=Geldanlage+f%C3%BCr+Anf%C3%A4nger&kwt[]=391&kbc[]=1300920941&kwp[]=4&kid[]=329603537&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.0572%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.60%7C2%3D1.57&ktd[]=4503874522120448&kwd[]=Die+7+besten+Dividendenaktien&kwt[]=391&kbc[]=1300920941&kwp[]=5&kid[]=329545178&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121708%7C13%3D0.1033%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D2.13%7C2%3D6.75&ktd[]=274894749952&kwd[]=Lebensmittel+die+Fett+verbrennen&kwt[]=391&kbc[]=1300920941&kwp[]=6&kid[]=329459844&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121708%7C13%3D0.0922%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D1.39%7C2%3D4.27&ktd[]=274894749952&kwd[]=Zahnimplantate+f%C3%BCr+Senioren&kwt[]=391&kbc[]=1300920941&kwp[]=7&kid[]=329545200&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.0527%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.70%7C2%3D1.70&ktd[]=274894749952&kwd[]=Ausgefallene+M%C3%A4nnergeschenke&kwt[]=391&kbc[]=1300920941&kwp[]=8&kid[]=350738829&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.0508%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.79%7C2%3D1.98&ktd[]=4503874522120448&v=1&gdpr=1&geo=52.41%7C13.45&dlper=20&lper=100&lpid=&tsid=18&hint=&cc=DE&wsip=170774946&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22r4%22%2C%22QQN75%22%3A%22zxLJYGJLy%22%2C%22QQ8E%22%3A%22W9.fXX.u9.9%22%2C%22QQQN%22%3A%22R3%22%7D&cid=8CUWMQE3H&vi=1702836322329480815&vsid=DefVid&tdAdd[]=asnum%3D201011&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=1100&vgd_fm_lang=DE&vgd_implt=3&vgd_cage=4&vgd_tsce=L350-S350&vgd_l3_sc=BY&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=742696110&vgd_refdomain=wheregoes.com&vgd_katbid=-103&vgd_pdtid=1&vgd_nrrv=37575&vgd_nrrmf=3000c80a&vgd_nrrsf=scrr&vgd_cty=schonefeld&vgd_ifrmode=13&sttm=1702836322632&upk=1702836323.1261&hvsid=00001702836322632013588915209148&verid=3111299&sbdrId=196&tsrc=entity&vgd_l1rakh=1702836322147392133&vgd_ecrid=S0300080711068000300060099999900&vgd_isiolc=1&kbbq=%26asn%3D201011&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=76592&vgd_vstrid=DefVid&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9h~e8QMQOvHuW~LkMNz7vu~ONfvu~G17v9%2C9%2C9~QNOvG5~eM1Qzvf9u9uu~ejfLMQOvf9fAufuhuu~8xLjMGvhXHF.9A~xLjM7UNv9~Q7OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~j1Q7v~e8QMxLjMGv9.Ff~8Evu7tTT1~kGGv9~e8QMxLjMjvf9~L88Ex1v9%2C9~J7vui~LNvu~Y78Ov0a9999uf~LEQMQOvf9fAufuXuF~e8QMGvHFh.XW~xLjMGv9.uA~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9f~ejfLMxLjMUNv949~GYv9.fX~1AEMGvu.HF%2Cu9W.uF~Q8OvuXuhuHAAu~QOvou~x8OvffOXsCN0i6qlQElDu%2F~G7OvA9hiiiu9HXHuWhiWWHFfh9h9h9XWAAffXAfHXAiuuHFFhuhhfWu9AiFHhFAiWXfXuFfAh9WHuAii9XuWhuAfFfXAAi9A9AF99uWXAHH~eBxvou~OfEMjvu9~AENkvu999~x8Yv9~eBMYJOv9.AX~OYYMQ7Lyvw1LYmz5~OfEMGvu~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvu9W.uF~exLjMjvf9~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vzxLJYGJLy~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9f~ONvh~ejfLMGvu.HF~8exLjMjvf9~NGOEv9.9u9~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuAuWXfii99oFMufAHXF~EmQvA~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9f9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8Qmzuf~QmGEv~w7Yjvu~ONx7vWX~OmyGv9ou~8GNvu~zQlvu~7yQvA99-F99~GQGv9~GQEv9~7Y-vfWA&vgd_cfud=230119&vgd_scsver=296&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=300_600&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1130&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=500&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A600&vgd_uspa=0&vgd_sc=BY&vgd_l1rhst=contextual.media.net&hvsid=00001702836322632013588915209148&rc=0&rand=1702836322954&acid=100ec790163eb6c01c3223a409eafb23&matm=1702836322954&vgd_ltimesrc=1&vgd_ltime=492&vgd_rtime=460&vgd_etm=8&vgd_l1hcsd=Ss1v0%7C8270&vgd_l1ch=1&vgd_lhl=1302&vgd_pgid=p11894410212t202312171805&vgd_csip=rtb-common-5c85f5bcc7-tkmwm.BE&vgd_sbSup=1&vgd_nrrs=37575&vgd_cntrdt=SL%7CDIV-rc_6cb673296407552e88f1a5e4f57ce562%7CDIV&vgd_crefurl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sun, 17 Dec 2023 18:05:23 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 15
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3BB2 0
0 62ms
45ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsua3bpmjrhIXLQ4V0z-pvIEcLOL8XlFKICHgkljXTUmp786g_EFYWUYfhENxxFSrjjrX_dqHZrnwGOLAru_CYcQoG3d8l5Xh4ZS4v4cDLXyVfwY8yb8Bz6J4Gr3396ZehGFLThv6w3krnfUWLnKy2i0x6cCWhk1KfDlzZmezqSmdanjTsgEXXnKLyVgAwf2TfE1K5gghi-agOhIenr8nymRs-iEYwii6ral3WUHI5mvD_qnPTEbuqOZnDrb2mmgsufzFsB56KoHIHxBLzuWJgbrhnBgAUcO9Wr0cMEK7rOHQzVb2fL-ZKB-zJMQkLP2FlVSQyykhRUWUJ837yrsGPhrmd12L-h4Z-OVOL2lKlj7VmeBIdveKhFM&sai=AMfl-YQpfq2E_S3h1HeWJ5xJqZqG8hYsymakRPdC1cSDQKO6njO_tRMnC2Fk-vmWfxo5EhwhidciAhfNxNCZSnO8ThbaYnezNGxWyBBW992MSZ10XYThCvXS1yyi-hg82sm1Y_3q-4uUAkbBE_A3xLhW-qWT&sig=Cg0ArKJSzIB_rrZ4T-gEEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 678A 111 KB
39 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
Origin: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 06:30:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 18 Dec 2023 06:30:10 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 678A 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B31003176.380596325;dc_ver=99.292;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=4019476741152927309;crid=476571773;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=545847862;ord=iu4e8v;click=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick2%3Fe%3DwqT_3QKaAfCZmgAAAAMAxBkFAQji8PyrBhDN3PXazJmD5DcYlauQiN-4uvUaIOOC9AgoykEw6j84AkD90J_jAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG2hwaIAQGQAQKYAQWgAQKpAYk-6Hc_J5M_sQGlNlD07iSKP7kBAAAAQOF6xD_BAc40BkJXx44_yQGUgm4vaYyWP9gBAOABAA..%2Fs%3Db92004bd091355a9f45f7f25d465b99966e7c291%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%25218BC8wQjEnbEYEP3Qn-MBGJjVUiAAKAAxAAAAAAAAAAA6CUZSQTE6NjU4M0CdRUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca%3DODE3MCNGUkExOjY1ODM%3D%2Fbn%3D99254%2Fclickenc%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Fpcs%252Fclick%25253Fxai%25253DAKAOjstCnloTn-QkfuH1TLy7TYSh8hNM99Jc-pePC4_BJ6gmAycb9N4NiuLzuAW_X3zims-S0TdCvS5s-3rGNf_YRaB6TooIiqIGuOkret-uD1Sjz5fWg_6aGEAsBLO7VtYp3d9TD3sRB5TCDqoc6W7b9Ayv2p-qT30opgvNVzOXO8Q4wH_7bMcnnYrAY4C7dXV76MWXppnIvhwfbxhPEPh8bLotavY3iQC-WP1GK87ZrjV0D6WeZgCaoWR07eb-iJ8FR07gMpPg5zVTwooIONCo8lIgauY9vyyudxXNATaYL09m3tETAe_PHZEiVdlowRGMLigeDQvExEnWRKCtDOu6lZHfLN4LczmyYFfo9Q%252526sai%25253DAMfl-YQ6PM9A1h6m_SGYsGF0R68Ra3KipxdIX_3FE6rPz9KMFE21hwZ_XmQoxr0_fE8mPs3pcAgIBIZRJeDHItI19-oQ7Cn5-K9dMFPOkKpkCJ5A0ZSCcdupyWL9zAGOVwSXhKeIU1SzaIP1F8u5131WTCQ0%252526sig%25253DCg0ArKJSzDX2_tW40sBsEAE%252526fbs_aeid%25253D%2525255Bgw_fbsaeid%2525255D%252526urlfix%25253D1%252526adurl%25253D;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=1,https%3A%2F%2Fwheregoes.com%2F$0;xdt=1;crlt=lv_)dzzoz4;gcsr=m;stc=1;chaa=1;sttr=28;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 23:43:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66087
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 30 Dec 2023 23:43:56 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 678A 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 15 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 172815
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 14 Dec 2024 18:05:08 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame EFE2 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 463916
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Dec 2023 09:13:27 GMT
expires: Wed, 11 Dec 2024 09:13:27 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 678A 20 KB
8 KB 170ms
118ms Script
text/javascript 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?sz=300x250&c=591248315&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=591248315&sz=300x250&js=st_dapp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

52b8d2941ed543641b228080824efd1d7e0a9de8d4489191c8488551ac543f39

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 7190
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: 0eopDP1iDWZpQnuQHC0_e96UUZsLYJ7dn6mVNnOCIPSwa2f2Cs1few==
expires: Sun, 17 Dec 2023 19:05:23 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame D972 15 B
178 B 41ms
41ms Script
text/javascript 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?vgd_len=5253&&vgd_canary=0&vgd_l2type=scs_newfl&fp=W0cfseha3aKdfMTCv5h_5RiDYZFYrWuEb5pxDp4Ed4mr5gGcxVCsDMRl8FxVkrkJYrQP6wpYfZ5UMxx8DwT6EuUkX7x1nHvIX7-P0Er8SwCc7guDeJ01aaaDUWi4GBL4WsoNR580poGPxc3KcOjtDw%3D%3D&cme=KR6HHT3NCc0T0tBWoUag_ATwdgbSM-92mSanp7zTg2Tw2I9QVRG-XsZNqpBoE-FIFKc5LsgRTqp-KmNc2Ko00KBoNBH6nabTRHFFwBTkr9Sn83E7iFMASaMdc2tEETK-GQJDT-Ylhgug4EgJsMfB1PdqsrHR8kURxe2WKe7fyRfgaFPmxpw8tiBWLvSpYLJ00v-PFbe4NoZ7RqzDRZDg7ScH296T8k0mva-TilV19fBpNLcMzapAvA%3D%3D%7C%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD4xoVDcMCSohdoT-YwCWNAerAHD6uEMv1LMPM4wmCD6tETirIU9dkbLlREtdKSUgw0%3D%7Cxrl5Md8q4-8glDlbUPMSt3FeMVWn2h2mj7Xw_c-0vKM%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7ChsrmibsJWPi67oROsKo7dqQ2hpogdkAwOIdo66t2k8Yt1xVZeCd6WpXA1emB1w8J4BEaEN5LMGCUh6jmYiSogO0H35pxzCWuAKz1Cuo0jjbhoIaAZJIuE2Ew8PegGsQXJOKl_Ji0t4ivB0vQMlSAZ3DuyDyoOqi_TkcVUSimgVnWFe7EF24lHSbfwc94-Jrmde4cgbUxR21PL3Llw5aZ7EQYSaA_AHM7WtXX1zVN3k7SpXxj90dafHUhMRH_baTQxnfcfQ0MyX44h4BEGUbP-TCgQwqpnelbiVDnVck3FUI%3D%7Cu8A6SM53vAd1h_O4ROJtLwq5PaKyqUuh%7CrOVKs0reXUTjiL-aIpkXfGE2Xr53FGjy%7C&subBdr=196&bdrid=459&ksu=243&fdkt=391&vgde_kbbh=ffoyxQJuO&kwd[]=Kanaren+Luxusreise+Angebote&kwt[]=391&kbc[]=1300920941&kwp[]=1&kid[]=329585879&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121708%7C13%3D0.0597%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.40%7C2%3D4.81&ktd[]=274894881024&kwd[]=Reiseangebote+f%C3%BCr+Senioren&kwt[]=391&kbc[]=1300920941&kwp[]=2&kid[]=329496807&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0001%7C8%3D121708%7C13%3D0.0598%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.79%7C2%3D2.42&ktd[]=274894881024&kwd[]=G%C3%BCnstige+Wohnungen+mieten&kwt[]=391&kbc[]=1300920941&kwp[]=3&kid[]=329610594&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0000%7C8%3D121708%7C13%3D0.0580%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.79%7C2%3D1.98&ktd[]=274894881024&kwd[]=Zahnimplantate+f%C3%BCr+Senioren&kwt[]=391&kbc[]=1300920941&kwp[]=4&kid[]=329545200&kbc2[]=pmb%3D1%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D121708%7C13%3D0.0578%7C14%3D121713%7Cokt%3D391%7Cbdkt%3D391%7Cps%3D0.379%7C1%3D0.70%7C2%3D1.70&ktd[]=274894881024&v=1&gdpr=1&geo=52.41%7C13.45&dlper=20&lper=100&lpid=&tsid=4&hint=&cc=DE&wsip=170774604&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22r4%22%2C%22QQN75%22%3A%22zxLJYGJLy%22%2C%22QQ8E%22%3A%22W9.fXX.u9.9%22%2C%22QQQN%22%3A%22R3%22%7D&cid=8CUWMQE3H&vi=1702836322765920313&vsid=DefVid&tdAdd[]=asnum%3D201011&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=1100&vgd_fm_lang=DE&vgd_implt=3&vgd_cage=4&vgd_tsce=L350-S350&vgd_l3_sc=BY&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_refdomain=wheregoes.com&vgd_katbid=-103&vgd_pdtid=1&vgd_nrrv=37575&vgd_nrrmf=3001c80a&vgd_nrrsf=scrr&vgd_cty=schonefeld&vgd_ifrmode=13&sttm=1702836322666&upk=1702836323.13694&hvsid=00001702836322666013588915205270&verid=3111299&sbdrId=196&tsrc=entity&vgd_l1rakh=1702836322164006407&vgd_ecrid=S0300080711068000728009099999900&vgd_isiolc=1&kbbq=%26asn%3D201011&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=76592&vgd_vstrid=DefVid&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9i~e8QMQOvHuW~LkMNz7vu~ONfvu~QNOvG5~eM1Qzvf9u9uu~ejfLMQOvf9fAufuhuu~8xLjMGvhXHF.9A~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hF~8Evu7tTT1~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~Y78Ov0a9999uf~LEQMQOvf9fAufuXuF~e8QMGvhXu.fu~xLjMGv9.uA~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9i~ejfLMxLjMUNv949~GYvu~1AEMGvu.9A%2Cuuu.9f~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZO%2FThthtH%3D%20%20Li~G7OvA9hiiiu9HXHuWFhuXAuXffuWFuXfiXuWFuHFhXAXFfu9WXFAhhHHFhih9uhiHH9HuHFh9F9WfFf9iFF9uAXFiuiWXFhuA9fWi9uFWAf~eBxvou~OfEMjvu9~AENkvu999~x8Yv9~eBMYJOv9.Fu~OYYMQ7Lyvw1LYmz5~OfEMGvu~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvuuu.9f~exLjMjvf9~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vzxLJYGJLy~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9i~ONvh~ejfLMGvu.9A~8exLjMjvf9~NGOEv9.9Hh~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9i9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfWA&vgd_cfud=230119&vgd_scsver=296&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=728_90&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1130&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=1000&vgd_mbr=1&vgd_pgids=4&tdAdd[]=uiparams%3D%3Brend_w%3A728%3Brend_h%3A90&vgd_uspa=0&vgd_sc=BY&vgd_l1rhst=contextual.media.net&hvsid=00001702836322666013588915205270&rc=0&rand=1702836322988&acid=c76a6ca3005191a45f4222e7dd86496f&matm=1702836322988&vgd_ltimesrc=1&vgd_ltime=534&vgd_rtime=503&vgd_etm=4&vgd_l1hcsd=Ss1v0%7C8270&vgd_l1ch=1&vgd_lhl=1304&vgd_pgid=p11894410212t202312171805&vgd_csip=rtb-common-5c85f5bcc7-tkmwm.BE&vgd_sbSup=1&vgd_nrrs=37575&vgd_cntrdt=SL%7CDIV-rc_c7cde2401c99b734033a9a8d3d5b729c%7CDIV&vgd_crefurl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

server-13-227-219-23.ams54.r.cloudfront.net

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sun, 17 Dec 2023 18:05:23 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 15
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E5C 0
0 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvK7nCpSDWKceO8LkJoP0yok2qy2COHHMwx7vjF_eP5XFoPl8dYVT8322YZ4HOpPL0Ybts51IbywKsVsUAVEPoTvkCS3lbOxp2iBhLCf3unebeX9EkKIL9m1kT1vjzCuXj0-9dou5CENC9tiVoBM_QoGodsFhsKIVy4vY6KfPqgzCSbMuM4Buk52gnclv34uP--MEy5YgtNxZM6-G6Oi0TaWcTH1mFPuqaw0aZSffYc1-d9zWkSq2uAAuIktNCOvzFdYPRxuYFLlDiOElB9YSnBJVKKl9WG5_GwdoDZpr934FHNGKnwOKhtK5if1AEvhFIbx3dGWRC8Qa3rrjfRWqj6o3c_zYXcqQGYWkeXUp-IGMIjBT4&sai=AMfl-YSjsAq8zyDP9m1d5GPgtdKXoVEQ8XEDXlh9EEPoeOHN1PgvpnAujzFUeDDrO7dUA7BP_KMTlIURSLXWRf-dOUhFVaGlNzikfLOYhlMmlqwk0jAT7m-a6h-PLmv1zNiso9QrY0T2725lHYIjycP8ee0n&sig=Cg0ArKJSzHrbIOBMEEPpEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame EFE2 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 15:22:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9799
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Dec 2024 15:22:04 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame 678A 28 KB
9 KB 100ms
100ms Script
text/javascript 13.227.219.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=31003176&js=st0

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dc22846dfc45027c10a5211144c4e770acdce77e81c67bd642e43c4320b16d85

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a36403421b18ef7385d5575765e6c414.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS54-C1
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8110
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: bY6i-6YcDeUCjQwkpE-RRdNIHm5CnD_QpBX5BQahyfGAoGTtR_kBWg==
expires: Sun, 17 Dec 2023 19:05:23 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18385945075831902745/ Frame 59FC 23 KB
5 KB 22ms
7ms Document
text/html 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6a2a1819484770a9b89a6507f0c9d08e766e3c9e0a2950fac93c078b8ace986

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 530284
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5535
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Dec 2023 14:47:19 GMT
expires: Tue, 10 Dec 2024 14:47:19 GMT
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 678A 0
0 103ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvVMe9Qkghqxc8cBbwI82QbmRpvIAioXzgQ_GyaShNj2OOyQ7K_iJr47o4q5SO79SuoqgTk-aPizNmvgcBDogWyKVFPloeXHMi-5uJbqAdInpd3reblkymI5OVEDaSvkJgUZLDxxo4LvFfjsfpH9XW-aLbIVo4LRFmKpg0&sai=AMfl-YQL6KFl3D58UU60p0mvmPEH5gR0zEb1u9ll-bQe-eKeXIqkx8BWlZyDNCl8Zk7bcmUZSnHnio8ktJroT_knGlZMAZPUJ0Ef-B3L5Q&sig=Cg0ArKJSzMl128Wi3_JiEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=43&cbvp=1&cstd=41&cisv=r20231207.99935&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dcm
beacon.sojern.com/imp/ Frame 678A 42 B
93 B 18ms
18ms Image
image/gif 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.sojern.com/imp/dcm?auc=4019476741152927309&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=476571773&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by: Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 678A 0
0 44ms
44ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsutnm77VgM_Kjn3gYgtZdFfp2eEAPjovc1u_ufJ2AK1te_ovymAndtcsAUEo0JZqbD_TN-E1b7FbvaPrCRrfVLsNCxTWUw3Zx3GbJ_2jJxbn7TF3LI1_V6lrmT4c_NbDWK8_N7snh9Vfk1v6MILd_Y2Du2Zpd3DwJE2StXcUN_v0aYKLgD0bGLI9ypET7SnstiWqHkHVVjsOsOP7DGLa_hUlEjluaBRbqovMXsr6s9G4O5IhJAcAQXt6QpHX96JJbv0wzW9uj7mcAqJ3dKz9hxOaSDEtqHuuHh_m5fdBbFXD7E7ZHIIEW7d_GxuKsOq8XiUk7vooH_MRkzzEOCa2DTMaFHzbrdqGLof2yeJpUxN&sai=AMfl-YRcvn2dK4s8g7bjx_w1bZRlnOKXpkvMDDdgYNGqXN5O5iVR1YlEHce-ccYlGjO-SSOcjHBCuVx6UtjOP2IzNEv3q426nNDwNCfehGYbZPaHAsPJJQzoxBlSv8HIxWclDOQu7KUlmurMuSMyrwRPok0D&sig=Cg0ArKJSzOyYsOxG-FkiEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H3 200 e7d195f4df29a3d29b15ca377e4690be.js Show response
s0.2mdn.net/sadbundle/18385945075831902745/ Frame 59FC 135 KB
39 KB 8ms
8ms Script
application/x-javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/e7d195f4df29a3d29b15ca377e4690be.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fe3e6ba4c1500f29d9c774864010039a6a191f209e3e7ca53b8300593562cba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 15:50:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 526498
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39464
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 15:50:25 GMT

GET
H3 200 345fa3e525057f6daec2f4c35f386a17.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 32 KB
32 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/345fa3e525057f6daec2f4c35f386a17.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50be855daaaff92bba14002c98b849118f7308b0879d9858eed9b58070ace86a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sun, 15 Dec 2024 14:02:02 GMT
date: Sat, 16 Dec 2023 14:02:02 GMT
x-content-type-options: nosniff
age: 101001
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32510
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 71bd228788a4cfd490b5e4a7b9f20dc9.png
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 49 KB
49 KB 9ms
9ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/71bd228788a4cfd490b5e4a7b9f20dc9.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c700170a869a0e7143e0235abc75d8d5d3c2c3a4285630e6d81703ed6a1f03c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:05:54 GMT
x-content-type-options: nosniff
age: 493169
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50644
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 01:05:54 GMT

GET
H3 200 3ad4011464d54eda09795fa6bb0b6f91.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 27 KB
27 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/3ad4011464d54eda09795fa6bb0b6f91.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdfde464e5c9985940781de9e808bdcfe1aa79f6772971d9339e0bcf60479006

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 18:40:10 GMT
x-content-type-options: nosniff
age: 516313
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27656
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 18:40:10 GMT

GET
H3 200 bb6dac9b5b1f7f466cb2204b9a6f5204.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 22 KB
22 KB 23ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/bb6dac9b5b1f7f466cb2204b9a6f5204.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3694c2159c0f236e8b507b02df862cf19823755c229e78aaab1a53137cd9e29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:49:28 GMT
x-content-type-options: nosniff
age: 537355
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22870
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 12:49:28 GMT

GET
H3 200 6661b82895c02b1ed157c7a99b0edb7c.png
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 4 KB
4 KB 26ms
25ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/6661b82895c02b1ed157c7a99b0edb7c.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac8d5e168695a78d5d5e226e01902513f10e1ac4de8209ebe14ba79f41293193

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:59:22 GMT
x-content-type-options: nosniff
age: 464761
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3917
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 08:59:22 GMT

GET
H3 200 sofia_sans_700_normal.ttf
s0.2mdn.net/sadbundle/18385945075831902745/fonts/ Frame 59FC 156 KB
58 KB 11ms
10ms Font
font/ttf 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/fonts/sofia_sans_700_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6aa10417eec0d267853da9c5cd78fa2fd6be32c37fc26d47fef6e597b3079945

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 19:50:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 512070
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59336
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 19:50:53 GMT

GET
H3 200 argue_demo_400_normal.ttf
s0.2mdn.net/sadbundle/18385945075831902745/fonts/ Frame 59FC 14 KB
11 KB 10ms
10ms Font
font/ttf 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/fonts/argue_demo_400_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9879e0e0be145100e52ddf69e068bc0005504cc31b934d9bb0a19c2846237e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 09:08:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 464201
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10924
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 09:08:42 GMT

GET
H3 200 sofia_sans_500_normal.ttf
s0.2mdn.net/sadbundle/18385945075831902745/fonts/ Frame 59FC 156 KB
58 KB 12ms
12ms Font
font/ttf 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/fonts/sofia_sans_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6058cc22ed4d249e3599b835597b95b3e5644719964f726b1168922923993b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sat, 14 Dec 2024 08:37:29 GMT
date: Fri, 15 Dec 2023 08:37:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 206874
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59121
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 678A 0
0 44ms
44ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvVMe9Qkghqxc8cBbwI82QbmRpvIAioXzgQ_GyaShNj2OOyQ7K_iJr47o4q5SO79SuoqgTk-aPizNmvgcBDogWyKVFPloeXHMi-5uJbqAdInpd3reblkymI5OVEDaSvkJgUZLDxxo4LvFfjsfpH9XW-aLbIVo4LRFmKpg0&sai=AMfl-YQL6KFl3D58UU60p0mvmPEH5gR0zEb1u9ll-bQe-eKeXIqkx8BWlZyDNCl8Zk7bcmUZSnHnio8ktJroT_knGlZMAZPUJ0Ef-B3L5Q&sig=Cg0ArKJSzMl128Wi3_JiEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=147&vt=11&dtpt=104&dett=3&cstd=41&cisv=r20231207.99935&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20235982975/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 345fa3e525057f6daec2f4c35f386a17.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 32 KB
32 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/345fa3e525057f6daec2f4c35f386a17.jpg

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50be855daaaff92bba14002c98b849118f7308b0879d9858eed9b58070ace86a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Sun, 15 Dec 2024 14:02:02 GMT
date: Sat, 16 Dec 2023 14:02:02 GMT
x-content-type-options: nosniff
age: 101001
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32510
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 71bd228788a4cfd490b5e4a7b9f20dc9.png
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 49 KB
49 KB 9ms
8ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/71bd228788a4cfd490b5e4a7b9f20dc9.png

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c700170a869a0e7143e0235abc75d8d5d3c2c3a4285630e6d81703ed6a1f03c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 01:05:54 GMT
x-content-type-options: nosniff
age: 493169
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50644
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 01:05:54 GMT

GET
H3 200 3ad4011464d54eda09795fa6bb0b6f91.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 27 KB
27 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/3ad4011464d54eda09795fa6bb0b6f91.jpg

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdfde464e5c9985940781de9e808bdcfe1aa79f6772971d9339e0bcf60479006

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 18:40:10 GMT
x-content-type-options: nosniff
age: 516313
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27656
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 18:40:10 GMT

GET
H3 200 bb6dac9b5b1f7f466cb2204b9a6f5204.jpg
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 22 KB
22 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/bb6dac9b5b1f7f466cb2204b9a6f5204.jpg

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3694c2159c0f236e8b507b02df862cf19823755c229e78aaab1a53137cd9e29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 12:49:28 GMT
x-content-type-options: nosniff
age: 537355
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22870
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 10 Dec 2024 12:49:28 GMT

GET
H3 200 6661b82895c02b1ed157c7a99b0edb7c.png
s0.2mdn.net/sadbundle/18385945075831902745/media/ Frame 59FC 4 KB
4 KB 11ms
11ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18385945075831902745/media/6661b82895c02b1ed157c7a99b0edb7c.png

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac8d5e168695a78d5d5e226e01902513f10e1ac4de8209ebe14ba79f41293193

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18385945075831902745/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 08:59:22 GMT
x-content-type-options: nosniff
age: 464761
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3917
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:47:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Dec 2024 08:59:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EFE2 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BE2BOYjh_ZZXHOZzL9u8PvZiy-AEAAAAAOAHgBAI&bg=!2Nul25TNAAY3kmNgF5I7ADQBe5WfOFYDK-UH2FoKpAurPg3lQ47GWirkmA5AW2-iuA_lJdiozwdjvp9x8I1ZpE8m5h0MAgAAADFSAAAAAmgBB5kDUdxPM3a80J3bwRrNUFhczfUEdWf3hlGGPQZ3A4uEz471kISeOSRZ1gz2O68fGjlVYqBuhR69sDVSFJIlR-Caw2u_-Lryxap5Hyqzey6J7XjG0NRrUpRdwuCQltL8kzDSvFyWe05UVjtk7143W0BTgULOx7D7QTyXdQeISVLhhoVY9fKvxzWLI3pjUkwxDTsuKPVDX8BzLpq3LZ9JEmGhWVXrwv2sj-iod5pcOHyR5hB7_sO65qDjpXwPF-dx2VtnX577QozqTPYA_YcfCPQsko8Q-42EFS6-74zN9mW4Uyn7MU7bkTOZKkfEO0okJrZAXdzgBMw5Rte00ay9jvEP0UeP5Dw1B_TR3GPCnnuTk1gUTNHjqRYLnftcTQCBN-2nzgN5vS_Lrm5bgxIl5CubJNa7zdEe2Mb4omhdDvA9iDg3K5BoY8Lzx9TWXtwIU8sDDXE8KofD_C6584nG2zT7k0js2w5LB9h9L7WJDOXpl8O_pUTpehsV8Sr1qN2n21rBcgWSrjXXzcGv-e-XniGrNrK1-o7nqmd7IyE6AeW1ZpslRCiTBO4g-w-09AaSkV84sxP5kdLFIm7XD_WNtXTWeFYjt_oXhyIYnH90JR3Hr_W4WWBlvGyDjGlwsGOB8YqFjlVe-J7yYxXPFnHn40eX6xnrufahMZnki-rSYBQgdDJJW-2SAwl_56W7Cafno-DL_VwxjUku35M9m_nR8tQPFNMHxRuf-rMii96zwBMoLr6-niLXA4ev-ffT4RfT5bHoJ1vWrucV8OMlPL6ONWzXCE71cqYiltl_uGT2oc5gzTCmQiaXHoud_4Jg0bwvdHF40RiKnxiYMY8Rb0QNLI5cJDBtPhrIc54b6BLGxAfscVJsmle4qQCsMlSCpybAMHFUagpDl2zmk9RSsmYF1C3pfCVDHTnrffjLLOecDD3Ov9jOYrTmQJLjthMm8nXE7sWIQ-KGh7ELZH5IeDeFzW3rEfExOlysFi_sNiXOrm532ev8sgckikEwb05bPXNEsWtoNITheOCsLjKfJxIIv-IpK9v_dQmszswWwm2lVAZNGBKUoXismuuKqGj-109O-mzZwGfR_cZV7cufU_fkB6aRoyoo6EVv-JTsoqsCJMQ0rdy-tg

Requested by

Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BF69 52 KB
17 KB 45ms
9ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: 3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
URL: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 45233
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 17 Dec 2023 18:05:23 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 494, 271898
X-Served-By: cache-lga13626-LGA, cache-fra-etou8220117-FRA
X-Timer: S1702836323.231329,VS0,VE0

GET
DATA 200
OK truncated
/ Frame 678A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1881ff681eeaef608ae95d4b9eb4b20644856dd98fc07d4887c84b12bbd46287

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 678A 0
696 B 15ms
15ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLlD_BV5QcAAAMA1gAFAQji8PyrBhDN3PXazJmD5DcYlauQiN-4uvUaKjYJiT7odz8nkz8RpTZQ9O4kij8ZAAAAQOF6xD8hzjQGQlfHjj8plIJuL2mMlj8xAAABG7CEPzDjgvQIOMpBQOo_SAJQ_dCf4wFYmNVSYABokfdreLaHBoABAYoBA1VTRJIFBvRsBJgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gHDBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3RDbmxvVG4tUWtmdUgxVEx5N1RZU2g4aE5NOTlKYy1wZVBDNF9CSjZnbUF5Y2I5TjROaXVMenVBV19YM3ppbXMtUzBUZEN2UzVzLTNyR05mX1lSYUI2VG9vSWlxSUd1T2tyZXQtdUQxU2p6NWZXZ182YUdFQXNCTE83VnRZcDNkOVREM3NSQjVUQ0Rxb2M2VzdiOUF5djJwLXFUMzBvcGd2TlZ6T1hPOFE0d0hfN2JNY25uWXJBWTRDN2RYVjc2TVdYcHBuSXZod2ZieGhQRVBoOGJMb3RhdlkzaVFDLVdQMUdLODdacmpWMEQ2V2VaZ0Nhb1dSMDdlYi1pSjhGUjA3Z01wUGc1elZUd29vSU9OQ284bElnYXVZOXZ5eXVkeFhOQVRhWUwwOW0zdEVUQWVfUEhaRWlWZGxvd1JHTUxpZ2VEUXZFeEVuV1JLQ3RET3U2bFpIZkxONExjem15WUZmbzlRJTI1MjZzYWklMjUzREFNZmwtWVE2UE05QTFoNm1fU0dZc0dGMFI2OFJhM0tpcHhkSVhfM0ZFNnJQejlLTUZFMjFod1pfWG1Rb3hyMF9mRThtUHMzcGNBZ0lCSVpSSmVESEl0STE5LW9RN0NuNS1LOWRNRlBPa0twa0NKNUEwWlNDY2R1cHlXTDl6QUdPVndTWGhLZUlVMVN6YUlQMUY4dTUxMzFXVENRMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pEWDJfdFc0MHNCc0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTI1NUJnd19mYnNhZWlkJTI1MjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEAigJTdWYoJ2EnLCA1NjgzNzA3LCAwKTt1ZignaScsIDY1NTE5ODUsIDApO3VmKCdnJywgMTYzNTc4NzksIDApO3VmKCdyJywgNDc2NTcxNzczLCAwKTuSAo0EIW1GN3QwZ2pFbmJFWUVQM1FuLU1CR0FBZ21OVlNNQUE0QUVBQVNPb19VT09DOUFoWUFHQ3RCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCcWxiX2tsbU5sal9CQWFwV181SlpqWllfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiSHpqd1AxQWNkcXREeVlBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xHVWtFeE9qWTFPRFBnQTUxRmdBU3NoS0FIaUFURmhLQUhrQVFCbUFRQndRUUFBQUFBQUFBQUFNa0VBQUFBQUFBQUFBRFlCQUR4FaUoQUFBaUFXM002a0YBDAEBFDhELXhCUQEKCQEUd1FVME16AQIMUERQOAkoHFlCX0x3al9SLigACDJRVQkxwEFEd1AtQUZtaEh3QmZlejVnZjRCZnZ6MmdLQ0JnTlZVMFNJQmdTUUJnR1lCZ0NoQmcNNyxBQUFxQVlFc2dZa0MdgABFHQwARx0MAEkdDBh1QVlLZ1FnGahgdy4umgKZASE4QkM4d1FqRW5iRVlFUDNRbkERKEpqVlVpQUFLQUF4AXUNAUw2Q1VaU1FURTZOalU0TTBDZFJVaw0bEER3UDFFDQwMQUFBRhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERAERHcBnSzYAgDgAp_wP-oCFmih1fDJOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqAwDAA9gEyAMA2APF1PIB4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTgwLjI1NS4xMC4xOTmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA44MTcwI0ZSQTE6NjU4M9oEAggB4AQA8AT90J_jAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBZzUPPoFBAFuKJAGAJgGALgGAMEGBSIsAPA_0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB7aHBtIHDQkRKAEmCNoHBgFdvBgA4AcA6gcCCADwB71EiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=a07fb5de808680eefde330acdb90f5ee08e1ea9e&type=nv&nvt=5&jm=1140|1141|1003&px=0&py=0&bw=300&bh=250&sid=7320559611463412861&vd=ct~0|rr~0&sv=240&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=300&ph=254&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
an-x-request-uuid: fd519e58-f445-459c-87f1-6b1f669d5cf3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202312070101&jk=1125956065890868&bg=!AQKlAk3NAAY3kmNgF5I7ADQBe5WfOMAYDTa11JTv1Lvf0cCDmcM6KJ9kql9XfIQl8eu6OUCV-VNvKXeMNfTkPABNOWIKAgAAAEFSAAAAAmgBBwoAHe3XtBWP88UDhVtaJLfhC26JnilLt-s7WsFH-YHgmQLvpIyk1_1JZ9WptLNSBw_PburtxkkvWJDxCL9r3_jJCfWn699zK50MJStEdph5z0sBxasGqhCtSsy3fpLASNnrJFG8iSGChb7scLNaNmHs9-qJPYwl37Yvt54Wirkhs5iTX9-c7gxdN_qDPf-Ij_LSvqVMM-kY-HEccq-GU14-xZYUSsOPkql487bQV9H5QR56AUozNlOOtW2lU7vvDSMmkszmPKN3j9qSGd4M9yqt-1ivb_C-oKaeHGLe05EbAJ0AAAXQQo_AUAeL7hfWNgdIRZcKzcqSLb-M3ezspiIGaYOyJAk2jkqMl4U5WyeyW40lEi9ii_Dw-4zHNKXFqNK4VnWrHgLY1X1998zPduhn13bDTjDSWi5rBTmzQa_6pjruoE1_8Xug1RwC3sMbUZCNiOrIg_wz1apNDOmJP3BQfwtbI6bPAVXPXJX4gtM5vFgpTb1AlgR2103WDSrrPuQSTas_EKEb3I98grd1BHBZ4EK1DTSLCgpFjNa1IPgwhIe3KxQ9KnHeeGcoLi51XcNDRHTtuPiM55vBrycwRJ2k4FZ6ahy8gnW2WAWgI-vApSKdLQKC0eRA54oBvC6qAH82rEr2RpDud7EjwtzSSzL1uTBL5XJyTKCZbBi2P_c4BKS8XrrtiIB8frhAUjqqiqfrUnS3A7lHEdT4Q2Yky6M42v0mKvHALTuOvCHmB9sKTDGe_dSM98iGlxKJhjmqUE5KZo4rs7Cmiz976wdXqnU6kcF2ziUVam5g4-oXEMAfxhGZNB4uX_6ujoQeZNRubrfC4MdOkII7p3vByzZg85jxlXAhGqj4Z4olY8ZZxY3u9pOzA3zTpFchUYL-SHBxnjUbGjpst2-tR5Z741SQHBvW_ifRy_rzqUZwvL7H9oHxbgSaYeQpv7D_vh7PiQz2zWPas9TTBmjypIrqx-a3sGJcAnraU8ShkmIQJt5Vh_5V_Xpz130DySoyq7EoBeV4xfXLZKV6IEJkrt9nE9Qb6zrVng
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame BF69 0
595 B 7ms
6ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a104-122-24-29.deploy.static.akamaitechnologies.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
an-x-request-uuid: 580aff64-ebba-4af4-88f4-1a74b5340a55
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 log
hblg.media.net/ Frame 9E5C 35 B
191 B 12ms
12ms Image
image/gif 104.122.24.29
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=AfIFMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAIAAAAAAAAAxQ_AQAQGM3NmE2Y2EzMDA1MTkxYTQ1ZjQyMjJlN2RkODY0OTZmwrORigeWBwRERRp3aGVyZWdvZXMuY29tEjhDVTE4ODMxST5ic2Etem9uZV8xNjQxMjI4MDI2NTk1LTRfMTIzNDU2DDcyOHg5MApldV9iZQQyMwxQUkVCSUQSOFBSVzIzSEc1DkJJRF9BUEkAPmJzYS16b25lXzE2NDEyMjgwMjY1OTUtNF8xMjM0NTYCMDxydGItY29tbW9uLTVjODVmNWJjYzctdGttd20uQkVAUzAzMDAwODA3MTEwNjgwMDA3MjgwMDkwOTk5OTk5MDACMAAGATBnZW4tdmJsdF9wcmViaWRfdGVzdF8yXzFGMjAyMzEyMTcxMDQyX2dlbi12Ymx0X3ByZWJpZF90ZXN0XzImZ2VuLXZibHRfcHJlYmlkX2FsbHokTUVESUEuTkVUIEVYQ0hBTkdFAgJi&evttyp=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.122.24.29 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H2 200 st_1 Show response
choices.trustarc.com/jsi/ Frame 678A 6 KB
3 KB 102ms
101ms Script
text/javascript 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/jsi/st_1?aid=sojern02&pid=sojern01&cid=31003176&sz=300x250&c=te-66ac&rand=dec6

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=31003176&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5462d227ba7d0e07fe63429cc76715842c5e12f46304bb316095f105b5098882

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2266
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: text/javascript;charset=UTF-8
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: NM6_rAF6bA0WFF6rpXEClegN9N5Ue7GLaY0U6eO4qMU1m-JpycvHMA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 678A 39 KB
12 KB 28ms
28ms Script
text/javascript 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=31003176&js=st_2

Requested by

Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=31003176&js=st0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

48340981c593332428262b3b5d491924485bffa8120e912ec84f93605c78448d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' ; font-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' ; frame-ancestors 'self' ; connect-src 'self' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; media-src 'self' ; child-src 'self' ; worker-src 'self' ; manifest-src 'self' *;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 19:48:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
content-security-policy: default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop: AMS58-P3
cross-origin-embedder-policy: unsafe-none
age: 80234
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
x-xss-protection: 1; mode=block
referrer-policy: origin
server: nginx
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=31536000
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
permissions-policy: geolocation=(), microphone=(), payment=()
x-amz-cf-id: Ls_zMYh9ZFMzwUi9_MkhSWLcFB0fbaklERaQ5HRwqppkevUhkYCsKg==
expires: Sat, 16 Dec 2023 20:48:10 GMT

GET
H2 200 get Show response
choices.trustarc.com/ Frame 678A 19 KB
6 KB 16ms
15ms Script
text/javascript 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/get?name=pmw2.js
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=591248315&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-19.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 2e7b45ace7324f4eaf0c5e859c3ebbe3ac7fb2a8c2f922fee1e1f4096d5d0a12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 22:11:47 GMT
content-encoding: gzip
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P3
age: 417217
x-cache: Hit from cloudfront
pragma: public
last-modified: Tue, 21 Nov 2023 07:44:27 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: rWbYt_SWW0pvFBklJRCW4AjIYcmvnG01BTTE7dTmwj3hKSJS6AZqeA==
expires: Thu, 11 Jan 2024 22:11:47 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 678A 43 B
434 B 117ms
117ms Image
image/gif 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=dfde

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.50.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: AMS58-P3
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: R1zD5-laZBQcOzNGbd4RDZukISqKO2HICzmemlEpckTBDB9ZhsVYZg==
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 17 Dec 2023 18:05:23 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 16ms
15ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ed3dc50aa8e28ea856d113dfbd2bd12dbb09ceb4381f2bdf8dba7b14b2a00108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 07 Nov 2023 09:08:30 GMT
server: nginx
etag: W/"6549fe8e-17704"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 18:05:24 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9E5C 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst55MQxzYxXZf5DYAG095ruXcmj8ydTNLP03mdT7jDlHV5ol-X_I0I1HoZ35fkcTUOUfReg24BieOQcV0i13BdANpGVm5RIWlL2HjXHkasLwWhtCgCwkpQoDszJoK-jk6R7ZuKnXu7Z-5IUtatZpfogsw&sig=Cg0ArKJSzBksDVxiIAO4EAE&id=lidar2&mcvt=1000&p=440,436,534,1164&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20231213&bin=7&avms=nio&bs=1600,1200&mc=0.95&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702836322445&rpt=581&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bqi.php
lg3.media.net/ Frame E689 15 B
15 B 31ms
31ms Image
text/javascript 23.211.10.95
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?vgd_len=2222&lf=3&&vgd_hb_audit_1=8CU18831I&vgd_hb_audit_2=950152417&vgd_tsce=L350&vgd_l2type=scs_newfl&vgd_ydspr=1&vgd_bid=349008&vgd_cdv=1130&vgd_cage=4&vgd_rensize=728_90&vgd_ren_page_h=2226&vgde_bdata=QOfvzxjj~8xLjMjvf9~myJLEYv9.9i~e8QMQOvHuW~LkMNz7vu~ONfvu~QNOvG5~eM1Qzvf9u9uu~ejfLMQOvf9fAufuhuu~8xLjMGvhXHF.9A~xLjM7UNv9~Q7OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~j1Q7v~e8QMxLjMGv9.hF~8Evu7tTT1~kGGv9~e8QMxLjMjvA9~L88Ex1v9%2C9~J7vuF~LNvu~Y78Ov0a9999uf~LEQMQOvf9fAufuXuF~e8QMGvhXu.fu~xLjMGv9.uA~ejfLMxLjMGv9~ejfLMxLjMe8vu4ouF~xLjM7e8v9~xLjMjvf9~yN17vou~GGvuiF~eev9~jfLMGvu999~JLEYv9.9i~ejfLMxLjMUNv949~GYvu~1AEMGvu.9A%2Cuuu.9f~Q8OvHFiiOGXWXNFH999GHGh9GFWJuhOOJfWJ~QOvou~x8OvffOXZO%2FThthtH%3D%20%20Li~G7OvA9hiiiu9HXHuWFhuXAuXffuWFuXfiXuWFuHFhXAXFfu9WXFAhhHHFhih9uhiHH9HuHFh9F9WfFf9iFF9uAXFiuiWXFhuA9fWi9uFWAf~eBxvou~OfEMjvu9~AENkvu999~x8Yv9~eBMYJOv9.Fu~OYYMQ7Lyvw1LYmz5~OfEMGvu~myOfEMGv9.iF~exLjMGv9.fH~QQvuF99-uf99~NNvr4~x8Bvou~NJv9~LEQMGvuuu.9f~exLjMjvf9~%3DVvA9Ff~UGMxNvof~z7Qvu~UGMNNUQvof~N7vzxLJYGJLy~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~8QDJkv9~8exLjMGvH.uF~8Q8kv9~G8Ov9.9i~ONvh~ejfLMGvu.9A~8exLjMjvf9~NGOEv9.9Hh~QOvou~875EJM8OvA~QJjjJLM71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~QxEEj5M71yM8OvGQ1olmzJMuFHuffW9fFXiXoHMufAHXF~EmQvu~LJkMNz7vu~N1LL8JLVOv9~myG8Ov9.9i9~GkjLv9.999~O7NvJxMGJ~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QmGEv~w7Yjvu~ONx7vX9~OmyGv9ou~8GNvu~zQlvu~7yQvhfW-i9~GQGv9~GQEv9~7Y-vfWA&vgd_lbt=1000&gdpr=1&mspa=0&prid=8PRVCXX19&cid=8CUWMQE3H&crid=849523371&rrr=tzR-hLcl-L9HpPpS8JQBYlmc7rcOJo2T4yq724EUEvPRSasP3IP_d6VNUHHGJwRn&requrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&vi=1702836322765920313&ugd=4&cc=DE&sc=BY&bdrid=459&subBdr=196&vgd_kwrf=https%3A%2F%2Fwheregoes.com&startTime=1702836322664&l1ch=1&l1hcsd=l1!Ss1v0|8270&cref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20235982975%2F&mmm=uXosNfIDqEk=&buid=349008&sttm=1702836322666&upk=1702836323.13694&hvsid=00001702836322666013588915205270&acid=c76a6ca3005191a45f4222e7dd86496f&verid=3111299&infr=1&stime=1702836322490&tsrc=entity&vgd_l1rhst=contextual.media.net&vgd_l1rakh=1702836322164006407&vgd_sc=BY&vgd_ecrid=S0300080711068000728009099999900&vgd_uspa=0&vgd_isiolc=1&vgd_pgid=p11894410212t202312171805&vgd_pgids=4&vgd_end=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.211.10.95 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
date: Sun, 17 Dec 2023 18:05:24 GMT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sun, 17 Dec 2023 18:05:24 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame BC26 15 KB
6 KB 15ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fd8c1cf4274cae5e1e5a37133cc23b80392ef88c43b798d3748f43948dbb53f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:23 GMT
server: Kestrel
server-processing-duration-in-ticks: 962357
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 52ms
26ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 18 Dec 2023 18:05:24 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame BC26
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=3&topUrl=wheregoes.com&bundle=qUSa419xT1ViaXVMM0tDb0RiU1clMkI4THRnYVNFeXFMaTBKWlFKam1aNSUyQlo1U1gwUXpP...
https://mug.criteo.com/sid?cpp=tqIA9nxibmVFME9UY3R0a3BTd004QzRJRE8rQUM4RnR4S2VFQTZBK1hKNmNCTkp0TzB0NDB5V09PenZEZzYyVnFEUGJFR0ZDYU82OHBlWDRKZitrNCtqcHhTUHFTMTY2R3lBZVRFb3pRZzZXcWh2Vm1ObGhCRW9YQVpYLy...

428 B
652 B

13ms
13ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=tqIA9nxibmVFME9UY3R0a3BTd004QzRJRE8rQUM4RnR4S2VFQTZBK1hKNmNCTkp0TzB0NDB5V09PenZEZzYyVnFEUGJFR0ZDYU82OHBlWDRKZitrNCtqcHhTUHFTMTY2R3lBZVRFb3pRZzZXcWh2Vm1ObGhCRW9YQVpYLytpUlhqUElROUhScEZaS2psVlVTNGFFL2lOUVpzd2FRYWk1RFJNV1hjMURPTEZjenZIcnZBa2lXNU1RbkQvbmgyYkJZbjl6bUtBWHFBa0VTaitzbEgxSUFUNytGZHdBVjlndXRyOUFnVG4vZHpWS3pPV2pIbFRJelVYbzNJZFQ1MG9VRVJuNEhoUzVHNXhlZjBCdHhQQVZ5MkxOanZCcExuc1pkWisrYTFJZmtXOGt1SE5xbz18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ebe49fa448bd7d580694e7a042ac2036191b84d3240e807ce7c757229579eb56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 810004
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:23 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=tqIA9nxibmVFME9UY3R0a3BTd004QzRJRE8rQUM4RnR4S2VFQTZBK1hKNmNCTkp0TzB0NDB5V09PenZEZzYyVnFEUGJFR0ZDYU82OHBlWDRKZitrNCtqcHhTUHFTMTY2R3lBZVRFb3pRZzZXcWh2Vm1ObGhCRW9YQVpYLytpUlhqUElROUhScEZaS2psVlVTNGFFL2lOUVpzd2FRYWk1RFJNV1hjMURPTEZjenZIcnZBa2lXNU1RbkQvbmgyYkJZbjl6bUtBWHFBa0VTaitzbEgxSUFUNytGZHdBVjlndXRyOUFnVG4vZHpWS3pPV2pIbFRJelVYbzNJZFQ1MG9VRVJuNEhoUzVHNXhlZjBCdHhQQVZ5MkxOanZCcExuc1pkWisrYTFJZmtXOGt1SE5xbz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 320612
content-length: 0
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 678A 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstsrLYMMg_zO6yg3vHIOZhY6OObqBYgVcBpFSR9sqojzS_Xq7Vi6KJBgejiv6tDobphmpmuvJwU3n4b5Jx-lokaB8WKLcKR0oNnm5snjfH--FZLcqKfqDh13CKrbu9gVCmNJ57iJST_NSgaFf_pWfDIog&sig=Cg0ArKJSzNoYRhKfUU3zEAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702836322456&rpt=617&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 678A 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu9_KBr1A71dRAECaMn3Y0EnLJpG9IXazkFE-UQSqIWYbN5T7RpuVn-hiaie7oo67UVc_DhDbngg9BwDDU4aP0c-fRy5Ux-eXiRqSzP9L2ILn8eGXgRcx0zhdVE&sig=Cg0ArKJSzFEi9hoRYCxvEAE&id=lidar2&mcvt=1002&p=0,0,250,300&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=545847862&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702836322456&rpt=620&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 4799 287 B
662 B 14ms
14ms Image
image/png 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-19.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Nov 2023 13:19:27 GMT
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
last-modified: Thu, 26 Oct 2023 03:20:37 GMT
server: nginx
x-amz-cf-pop: AMS58-P3
age: 2436357
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: eWBBpSL2zRfUQejggI1Jnw6hrCiUKvc3yftntm2jL-Xf8VnM2MeClQ==
expires: Tue, 19 Dec 2023 13:19:27 GMT

POST
H2 200 vevent
fra1-ib.adnxs.com/ Frame 678A 0
695 B 25ms
24ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLlD_BV5QcAAAMA1gAFAQji8PyrBhDN3PXazJmD5DcYlauQiN-4uvUaKjYJiT7odz8nkz8RpTZQ9O4kij8ZAAAAQOF6xD8hzjQGQlfHjj8plIJuL2mMlj8xAAABG7CEPzDjgvQIOMpBQOo_SAJQ_dCf4wFYmNVSYABokfdreLaHBoABAYoBA1VTRJIFBvRsBJgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gHDBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3RDbmxvVG4tUWtmdUgxVEx5N1RZU2g4aE5NOTlKYy1wZVBDNF9CSjZnbUF5Y2I5TjROaXVMenVBV19YM3ppbXMtUzBUZEN2UzVzLTNyR05mX1lSYUI2VG9vSWlxSUd1T2tyZXQtdUQxU2p6NWZXZ182YUdFQXNCTE83VnRZcDNkOVREM3NSQjVUQ0Rxb2M2VzdiOUF5djJwLXFUMzBvcGd2TlZ6T1hPOFE0d0hfN2JNY25uWXJBWTRDN2RYVjc2TVdYcHBuSXZod2ZieGhQRVBoOGJMb3RhdlkzaVFDLVdQMUdLODdacmpWMEQ2V2VaZ0Nhb1dSMDdlYi1pSjhGUjA3Z01wUGc1elZUd29vSU9OQ284bElnYXVZOXZ5eXVkeFhOQVRhWUwwOW0zdEVUQWVfUEhaRWlWZGxvd1JHTUxpZ2VEUXZFeEVuV1JLQ3RET3U2bFpIZkxONExjem15WUZmbzlRJTI1MjZzYWklMjUzREFNZmwtWVE2UE05QTFoNm1fU0dZc0dGMFI2OFJhM0tpcHhkSVhfM0ZFNnJQejlLTUZFMjFod1pfWG1Rb3hyMF9mRThtUHMzcGNBZ0lCSVpSSmVESEl0STE5LW9RN0NuNS1LOWRNRlBPa0twa0NKNUEwWlNDY2R1cHlXTDl6QUdPVndTWGhLZUlVMVN6YUlQMUY4dTUxMzFXVENRMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pEWDJfdFc0MHNCc0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTI1NUJnd19mYnNhZWlkJTI1MjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEAigJTdWYoJ2EnLCA1NjgzNzA3LCAwKTt1ZignaScsIDY1NTE5ODUsIDApO3VmKCdnJywgMTYzNTc4NzksIDApO3VmKCdyJywgNDc2NTcxNzczLCAwKTuSAo0EIW1GN3QwZ2pFbmJFWUVQM1FuLU1CR0FBZ21OVlNNQUE0QUVBQVNPb19VT09DOUFoWUFHQ3RCV2dBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCcWxiX2tsbU5sal9CQWFwV181SlpqWllfeVFFQUFBQUFBQUR3UDlrQkFBQUFBQUFBOERfZ0FiSHpqd1AxQWNkcXREeVlBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xHVWtFeE9qWTFPRFBnQTUxRmdBU3NoS0FIaUFURmhLQUhrQVFCbUFRQndRUUFBQUFBQUFBQUFNa0VBQUFBQUFBQUFBRFlCQUR4FaUoQUFBaUFXM002a0YBDAEBFDhELXhCUQEKCQEUd1FVME16AQIMUERQOAkoHFlCX0x3al9SLigACDJRVQkxwEFEd1AtQUZtaEh3QmZlejVnZjRCZnZ6MmdLQ0JnTlZVMFNJQmdTUUJnR1lCZ0NoQmcNNyxBQUFxQVlFc2dZa0MdgABFHQwARx0MAEkdDBh1QVlLZ1FnGahgdy4umgKZASE4QkM4d1FqRW5iRVlFUDNRbkERKEpqVlVpQUFLQUF4AXUNAUw2Q1VaU1FURTZOalU0TTBDZFJVaw0bEER3UDFFDQwMQUFBRhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERAERHcBnSzYAgDgAp_wP-oCFmih1fDJOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqAwDAA9gEyAMA2APF1PIB4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTgwLjI1NS4xMC4xOTmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA44MTcwI0ZSQTE6NjU4M9oEAggB4AQA8AT90J_jAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBZzUPPoFBAFuKJAGAJgGALgGAMEGBSIsAPA_0AboKdoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB7aHBtIHDQkRKAEmCNoHBgFdvBgA4AcA6gcCCADwB71EiggCEACVCAAAgD-YCAHACADSCA4IgYKEiJCgwIABEAAYAA..&s=a07fb5de808680eefde330acdb90f5ee08e1ea9e&type=pv&jm=1140|1141|1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7320559611463412861&vd=ct~0|rr~5&sv=240&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
an-x-request-uuid: 21f51559-980f-489d-aa06-7470811c1923
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://3b850e5abe126181520f4e9265dee798.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 50AC 287 B
663 B 13ms
13ms Image
image/png 18.239.50.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-19.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Nov 2023 13:19:27 GMT
via: 1.1 ed6e39eea0e39e463514b9421b7a2806.cloudfront.net (CloudFront)
last-modified: Thu, 26 Oct 2023 03:20:37 GMT
server: nginx
x-amz-cf-pop: AMS58-P3
age: 2436357
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 287
x-amz-cf-id: TngYNzG6J4NjEK1c9CuXwsuAHX-y_HSrp5wztKP2EGtsPmB5tR5JwQ==
expires: Tue, 19 Dec 2023 13:19:27 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame BF69 0
595 B 6ms
6ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:24 GMT
an-x-request-uuid: 81629acf-4eba-4f9a-bd08-396b99639331
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 39FE 52 KB
17 KB 7ms
7ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 45235
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 17 Dec 2023 18:05:25 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 494, 271916
X-Served-By: cache-lga13626-LGA, cache-fra-etou8220117-FRA
X-Timer: S1702836325.348494,VS0,VE0

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame B747 9 KB
4 KB 68ms
11ms Document
text/html 18.66.248.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-14.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c20d54555b098aef8269b6fa89b316fa731aac67e6926c1203c27edf8cf9dbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 38656
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Sun, 17 Dec 2023 07:21:12 GMT
etag: W/"ea81456e0a6e1fca0e7a864b1d3121aa"
last-modified: Mon, 02 Oct 2023 23:54:30 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 cca0e030e1fac6fb27702d182fb6a74a.cloudfront.net (CloudFront)
x-amz-cf-id: NLDvY8mnHoWqSyKSER8fqMJiKUVnfZL4PTQEquINIVOHVcvIZlANhA==
x-amz-cf-pop: DUS51-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:58584356-ee8f-4de0-abcc-b50f847fba2c
x-amz-meta-codebuild-content-md5: d3f9c0952d74faa30fada14e06b377b0
x-amz-meta-codebuild-content-sha256: 8aa4841af9e8588faa6f0e126d94acab1f39eb0115dfa16eac2daccf149690d0
x-amz-server-side-encryption: AES256
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E9B6 281 B
555 B 54ms
8ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 18:05:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame E5DE 23 KB
8 KB 47ms
46ms Document
text/html 184.30.20.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2055%2C2030%2C3020%2C251%2C233%2C2027%2C236%2C237%2C359%2C459%2C70%2C97%2C55%2C77%2C3012%2C3011%2C182%2C262%2C461%2C244%2C201%2C246%2C4%2C203%2C10000%2C108%2C9%2C407%2C508&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.22 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c68d92e0f9f69977112f67f36f53f616b27ddbf5eaf9aa5ba6b607061de7aebe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8366
content-type: text/html; charset=UTF-8
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: Tue, 19 Dec 2023 18:05:25 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 204 /
onetag-sys.com/usync/ Frame 0609 0
0 8ms
8ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1702836321571

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1702836000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 39FE 0
595 B 7ms
7ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
an-x-request-uuid: ab38246a-d6bc-41fd-877d-77a65c385170
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E9B6 45 KB
13 KB 10ms
10ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 18:05:25 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=38816
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:52:21 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame A30A 3 KB
1 KB 116ms
30ms Document
text/html 52.209.47.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.47.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-47-186.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5f50709d8e2d7b4b0c554e1661fb300a9493a7ec84eb99b95c1e9b1eb6be5d13

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sun, 17 Dec 2023 18:05:25 GMT
etag: W/"0694ce97145aab1512185f6aafa80ab5d"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame BF6B 0
0 8ms
8ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 sync Show response
ssbsync.smartadserver.com/api/ Frame E16A 833 B
1 KB 120ms
13ms Document
text/html 81.17.55.122
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.17.55.122 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: d4f1eb2ef229e91021b03d9569d0d2c8fee72a5d8ac12919f596344818d7fa54

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 833
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 7FA9
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
852 B

24ms
23ms

Document
text/html

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b7d936f127ac1ac65520b4e066e73671b9dc3da4f43747d78cfd57da17ea028

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8371181a4a8d3633-FRA
content-encoding: br
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8UrmWAb%2FEnT%2FhdJnYFAqX7%2FBIzaSsi0gca42TStAdmOVbrPO43UJAns5ZG9n8o4ep2ylOYkAg88yxdGzP0EmF3OquSED5kHPLF5wiF2Qkvxhepl8MfMkUKpLhs%2BN8%2BPW%2FXrHT9rNMFSBcA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8371181a2a543633-FRA
content-length: 0
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cczYu1vatZy%2F3WSfdbS2eMpD6nwPd3KONhJz%2FFJinVu4gzZyx%2BzBmV5RiWwMdrDNCkjRt2a2rnYAruuvABhYyMp8hZFRZ8lurDtRHjrRejSg%2Fvz0Mkwml8MUqMID5H3GRxcPjj8d%2BZinNg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 5A5F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
555 B

13ms
12ms

Document
text/html

184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 18:05:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 17 Dec 2023 18:05:25 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame CEED 16 KB
6 KB 54ms
7ms Document
text/html 95.101.200.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.200.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-200-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=172216
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: Tue, 19 Dec 2023 17:55:41 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame F2EA 0
525 B 179ms
108ms Document
text/html 2600:9000:224a:7800:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:7800:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT
server: istio-envoy
via: 1.1 5bbaa27b453dc834289b91c14bbb4934.cloudfront.net (CloudFront)
x-amz-cf-id: bYTlpJ2AbdpNxpCdiAFr6Rp0L1kZsIT4KT46eYsizeLadoP_bYC0qg==
x-amz-cf-pop: DUS51-P1
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 42E6 0
134 B 53ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Sun, 17 Dec 2023 18:05:25 GMT
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame 066D 0
370 B 292ms
91ms Document
text/html 52.206.176.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.206.176.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-176-4.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-length: 0
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=1939619625897825685

0
344 B

33ms
33ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=1939619625897825685
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
an-x-request-uuid: fe5a2474-2420-42c3-b676-fc5c71dbfe6f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ads.servenobid.com/sync?pid=312&uid=1939619625897825685
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=H1l9rRZHw2hzeVUUTHChS25h

0
350 B

31ms
30ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=H1l9rRZHw2hzeVUUTHChS25h
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=H1l9rRZHw2hzeVUUTHChS25h
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame B747 0
277 B 22ms
20ms Image
text/plain 216.52.2.16
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.16 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 17 Dec 2023 18:05:25 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET

RX-a83b144a-ce99-4438-a0af-569e26fd15e5-003
sync.targeting.unrulymedia.com/csync/ Frame B747
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1702836325716
https://ad.turn.com/r/cs?pid=45&rndcb=2230010155
https://sync.1rx.io/usersync/turn/8902477296331474653?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-a83b144a-ce99-4438-a0af-569e26fd15e5-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-a83b144a-ce99-4438-a0af-569e26fd15e5-003

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5124322330193527748

0
344 B

29ms
29ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5124322330193527748
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5124322330193527748
Date: Sun, 17 Dec 2023 18:05:25 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 usa
sync.go.sonobi.com/ Frame B747 0
399 B 309ms
103ms Image
text/plain 2607:f350:3:2569:0:10:0:200d
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f350:3:2569:0:10:0:200d , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-92
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0

0
252 B

29ms
28ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=&us_privacy=1YN-&gdpr=0
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58559/ Frame B747 0
125 B 289ms
10ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58559/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=ua-9724962c-b969-35ab-837d-b38b199d0b14

0
359 B

29ms
29ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=ua-9724962c-b969-35ab-837d-b38b199d0b14
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=ua-9724962c-b969-35ab-837d-b38b199d0b14
pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58632/ Frame B747 0
15 B 289ms
11ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58632/occ

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 v1
match.sharethrough.com/universal/ Frame B747 0
35 B 50ms
8ms Image
text/plain 52.58.18.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.18.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-18-253.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame B747
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%3E
https://ads.servenobid.com/sync?pid=353&uid=0000EEA

0
336 B

29ms
28ms

Image
image/avif

52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Sun, 17 Dec 2023 18:05:25 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
location: https://ads.servenobid.com/sync?pid=353&uid=0000EEA
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Sun, 17 Dec 2023 18:05:25 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame E9B6 7 B
380 B 53ms
11ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 9db1556130a9e92b896eecae836f6a70
Expires: 0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame CEED 0
42 B 64ms
20ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=2314478&p=162412&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5A5F 45 KB
13 KB 25ms
25ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 18:05:25 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=38816
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:52:21 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 7FA9
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

125ms
124ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 533Z7TT5ZXMSVS7QNSZP
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5307H10JMR9VPR21KCMA
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 7FA9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZX84ZQb8ju3bTt5YCXBL8AAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECJrntQbmAuq0z200bqSlpk&google_cver=1

43 B
738 B

43ms
43ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECJrntQbmAuq0z200bqSlpk&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=89Kf%2F4Qffs0T8J6wXSxj%2B1Ie3%2BArI%2FT%2F2huva28O0nrIsYDlDTuHXj6rhzVnKJnwEH33ldNCb7ld9Ki0GtveENtg4SvAvDFbrpPO8wAP8LgakL%2FOPu0yvDj7qCZOGmhQzfBx%2FpAlkmD0zQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8371181ad9fd1c34-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECJrntQbmAuq0z200bqSlpk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 7FA9
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZX84ZQb8ju3bTt5YCXBL8AAA%263382&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZX84ZQb8ju3bTt5YCXBL8AAA%263382&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=14720cefca084cc3a6b5c67d2299b424
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-vslQqsoG_ZEEdM1z538XLhYwkdZYx8A2XYT_zw
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-vslQqsoG_ZEEdM1z538XLhYwkdZYx8A2XYT_zw

43 B
548 B

621ms
92ms

Image
image/gif

2600:1f18:ed:550f:1e05:f749:b7a:992d

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-vslQqsoG_ZEEdM1z538XLhYwkdZYx8A2XYT_zw

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:1e05:f749:b7a:992d -, , ASN (),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 18:05:26 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-vslQqsoG_ZEEdM1z538XLhYwkdZYx8A2XYT_zw
Date: Sun, 17 Dec 2023 18:05:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 8

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 7FA9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFT_QGsFEZJeWIi09FCqR3o&google_cver=1

43 B
768 B

30ms
30ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFT_QGsFEZJeWIi09FCqR3o&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ulCo6R9jwS452r8ND1R6iqGmxhTs3Roc3167p7joQbl%2FeKysCkQ%2FKWZLJhtL5zgMU%2BOlnThot48HiIw%2FSNso8okAqbDaBruo4LlRWokwXuofXhlAtHtJA9avwgdGul5bHyukgqlS851FZA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8371181ad9e01c34-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFT_QGsFEZJeWIi09FCqR3o&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum.casalemedia.com/ Frame 7FA9
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1702922725

43 B
330 B

40ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1702922725
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KNKktLusWepG5LyGk85u6Oa%2B%2Fw4SntltLFkWzneWRjQi3tLTJMCMsM0Rok%2FKMPC0MGcBAQnNfY41bCnHkV6eeyL%2FqzgZDDh3IPUu5KoLFFawY75LeY2USgxPVtPL1uDv%2Fs13kJQz"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8371181b6c163633-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1702922725
pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
content-length: 0
expires: 0

GET
H/1.1 200 user-registering
ads.stickyadstv.com/ Frame 7FA9 43 B
653 B 112ms
16ms Image
image/gif 2607:ae80:192:1::172
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=1025&userId=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2607:ae80:192:1::172 , United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1702836325574054-390

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 7FA9
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=68
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=HdRmrrutWZ5sztA1d4BNLlD_Csc

43 B
728 B

24ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=HdRmrrutWZ5sztA1d4BNLlD_Csc
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tcx6V0fVSFPWHedO2RabWC8dsOlV2uGw5pLeFdH49VCY5lIwxHVNy6vosqpNOLYo8gkFXr2RamUDzSJxkAe75nlaIObsuw22b52Bl162RiInimsE4pHV%2F8KTXTrgyA74SAQfiOa1KY6NCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8371181cec5a1c34-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=HdRmrrutWZ5sztA1d4BNLlD_Csc
Date: Sun, 17 Dec 2023 18:05:25 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H2 200 ix
ad4m.at/ad/sim/ Frame 7FA9 0
0 53ms
20ms Image
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad4m.at/ad/sim/ix
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 sync
ads.servenobid.com/ Frame 7FA9 0
357 B 30ms
30ms Image
image/avif 52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=ZX84ZQb8ju3bTt5YCXBL8AAADTYAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 5A5F 7 B
380 B 11ms
10ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 9db1556130a9e92b896eecae836f6a70
Expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=1939619625897825685

35 B
250 B

103ms
32ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=1939619625897825685
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
an-x-request-uuid: bb560808-f8e5-41c9-995a-8518c0891b50
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://usersync.gumgum.com/usersync?b=apn&i=1939619625897825685
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_c2433251-3adf-42f8-a238-45880a7a423e&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_c2433251-3adf-42f8-a238-45880a7a423e&gdpr=0&gdpr_consent=&us_privacy=1---
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=7ff3a1d5-3a9d-4293-be27-a9dd9fcdb3f6&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=1---
https://x.bidswitch.net/sync?dsp_id=283&user_id=7716aeb0-007e-422d-9e36-6baeae32db1a&expires=1&user_group=2&ssp=gumgum2&bsw_param=7ff3a1d5-3a9d-4293-be27-a9dd9fcdb3f6&gdpr=0&gdpr_consent=&gdpr_pd=
https://usersync.gumgum.com/usersync?b=bsw&i=7ff3a1d5-3a9d-4293-be27-a9dd9fcdb3f6&gdpr=0&gdpr_consent=&us_privacy=

35 B
250 B

30ms
30ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=7ff3a1d5-3a9d-4293-be27-a9dd9fcdb3f6&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: //usersync.gumgum.com/usersync?b=bsw&i=7ff3a1d5-3a9d-4293-be27-a9dd9fcdb3f6&gdpr=0&gdpr_consent=&us_privacy=
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=654bbfa9-b7ab-42a4-a012-a3afb4c252c9

35 B
250 B

32ms
32ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=654bbfa9-b7ab-42a4-a012-a3afb4c252c9
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Sun, 17 Dec 2023 18:05:26 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=654bbfa9-b7ab-42a4-a012-a3afb4c252c9
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-1dd466ae-bbad-599e-6cce-d03577804d2e$ip$80.255.10.199

35 B
250 B

31ms
31ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-1dd466ae-bbad-599e-6cce-d03577804d2e$ip$80.255.10.199
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-1dd466ae-bbad-599e-6cce-d03577804d2e$ip$80.255.10.199
Date: Sun, 17 Dec 2023 18:05:25 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame A30A 43 B
426 B 118ms
38ms Image
image/gif 2a05:d018:d29:3605:4323:fae9:2ff1:2aab
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:4323:fae9:2ff1:2aab Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=9e065044-465a-4014-ab93-a39ea38c2b37

35 B
250 B

33ms
33ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=9e065044-465a-4014-ab93-a39ea38c2b37
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=9e065044-465a-4014-ab93-a39ea38c2b37
Date: Sun, 17 Dec 2023 18:05:25 GMT
Connection: keep-alive
X-CI-RTID: 9c23f918-b317-4016-bc93-a3dac96298ed
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 200 142
match.deepintent.com/usersync/ Frame A30A 0
44 B 323ms
91ms Image
text/plain 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
content-length: 0
server: b

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_c2433251-3adf-42f8-a238-45880a7a423e&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=0&gdpr_consent=&puid=e_c2433251-3adf-42f8-a238-45880a7a423e&s=2&us_privacy=...
https://usersync.gumgum.com/usersync?b=zem&i=6PoYsWRZlVLCXhNp_BhP&gdpr=0&us_privacy=1---

35 B
250 B

32ms
32ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=6PoYsWRZlVLCXhNp_BhP&gdpr=0&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:26 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Content-Type: text/html; charset=utf-8
Location: https://usersync.gumgum.com/usersync?b=zem&i=6PoYsWRZlVLCXhNp_BhP&gdpr=0&us_privacy=1---
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame A30A
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&us_privacy=${us_privacy}&gpp=$&gpp_sid=$&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=gZiHMlD6ohGu&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355

35 B
208 B

48ms
34ms

Image
image/gif

52.209.47.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=gZiHMlD6ohGu&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 52.209.47.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-47-186.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=gZiHMlD6ohGu&ev=1&gpp_sid=$&gpp=$&us_privacy=${us_privacy}&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-db744d8c7-2fvgp
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame A30A
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=7838248069430377954

35 B
250 B

115ms
31ms

Image
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=7838248069430377954
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Sun, 17 Dec 2023 18:05:25 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=7838248069430377954
date: Sun, 17 Dec 2023 18:05:25 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame A30A 0
357 B 36ms
30ms Image
image/avif 52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_c2433251-3adf-42f8-a238-45880a7a423e
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 9FF6
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=adf&i=9120538998472302720&gdpr=0&gdpr_consent=

35 B
208 B

35ms
35ms

Document
image/gif

52.209.47.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=adf&i=9120538998472302720&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.47.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-47-186.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: -1
location: https://rtb.gumgum.com/usersync?b=adf&i=9120538998472302720&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame D74A 170 B
243 B 29ms
20ms Document
image/png 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jMjQzMzI1MS0zYWRmLTQyZjgtYTIzOC00NTg4MGE3YTQyM2U=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AAAF 16 KB
6 KB 13ms
8ms Document
text/html 95.101.200.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.200.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-200-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=172216
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Sun, 17 Dec 2023 18:05:25 GMT
expires: Tue, 19 Dec 2023 17:55:41 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame C4E0 70 B
149 B 104ms
32ms Document
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 70
content-type: image/gif
date: Sun, 17 Dec 2023 18:05:25 GMT
server: Kestrel

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 5E2B
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZX84ZsCo8XkAACEWzjkAAAAA

35 B
250 B

33ms
33ms

Document
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZX84ZsCo8XkAACEWzjkAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sun, 17 Dec 2023 18:05:26 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Sun, 17 Dec 2023 18:05:26 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZX84ZsCo8XkAACEWzjkAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: a-ad40004.dc2p.scaleout.jp
X-SO-IP: 80.255.10.199
X-SO-Key: ZX84ZsCo8XkAACEWzjkAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":true,"ipv4":"0.0.0.0","key":"ZX84ZsCo8XkAACEWzjkAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40004"}
X-SO-LB-Hostname: m-tgng21.dc4p.scaleout.jp
X-SO-Upstream-ID: a-ad40004

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F8B6
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=Mvh3EUpnMBwlREGxFbbC3ZaY0H36EWTaSZTxbI22qyI&pi=gumgum&tc=1

35 B
250 B

48ms
37ms

Document
image/gif

34.247.233.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=Mvh3EUpnMBwlREGxFbbC3ZaY0H36EWTaSZTxbI22qyI&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-233-198.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Sun, 17 Dec 2023 18:05:25 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Sun, 17 Dec 2023 18:05:25 GMT Sun, 17 Dec 2023 18:05:25 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=Mvh3EUpnMBwlREGxFbbC3ZaY0H36EWTaSZTxbI22qyI&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 46DF
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
555 B

9ms
9ms

Document
text/html

184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 17 Dec 2023 18:05:25 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sun, 17 Dec 2023 18:05:25 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 sync
ads.servenobid.com/ Frame E16A 0
344 B 31ms
29ms Image
image/avif 52.214.97.183
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=4465404475150564803&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.97.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-97-183.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

204

v1
match.sharethrough.com/sync/ Frame E16A
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4465404475150564803&gdpr=0&gdpr_consent=

0
34 B

7ms
7ms

Image
text/plain

52.58.18.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4465404475150564803&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 52.58.18.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-18-253.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4465404475150564803&gdpr=0&gdpr_consent=
pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame E16A
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1939619625897825685&gdpr=0&gdpr_consent=

43 B
408 B

97ms
13ms

Image
image/gif

89.149.192.201
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1939619625897825685&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 89.149.192.201 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Sun, 17 Dec 2023 18:05:25 GMT
an-x-request-uuid: b017ddf4-cbf8-470a-ae59-a22cee100aee
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1939619625897825685&gdpr=0&gdpr_consent=
x-proxy-origin: 80.255.10.199; 80.255.10.199; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 v1
match.sharethrough.com/universal/ Frame E16A 0
34 B 9ms
9ms Image
text/plain 52.58.18.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.18.253 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-18-253.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:05:25 GMT

GET
H2 204 /
s.ad.smaato.net/c/ Frame E16A 0
243 B 46ms
10ms Image
text/plain 2600:9000:243d:7c00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:7c00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 18:04:54 GMT
via: 1.1 ea3d06e94081b5e61e2cf220951142d0.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P4
age: 31
x-cache: Hit from cloudfront
cache-control: no-cache, must-revalidate
x-amz-cf-id: uHK8Ym15wTLKKosWzTuBlUYCME-NfqJBuSTeF_fKutqYCK2f5qAK8g==

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 46DF 45 KB
13 KB 9ms
8ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ef99872383d06605558112058dcaf932036b3685ed092edace07b1266e4d39fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sun, 17 Dec 2023 18:05:25 GMT
Content-Encoding: gzip
Last-Modified: Sun, 17 Dec 2023 04:52:08 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=38816
Connection: keep-alive
Content-Length: 13201
Expires: Mon, 18 Dec 2023 04:52:21 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 46DF 7 B
380 B 11ms
11ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 9db1556130a9e92b896eecae836f6a70
Expires: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 39FE 0
595 B 9ms
9ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS