www.clien.net Open in urlscan Pro
219.251.142.13 Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: a5c08477-8d29-472d-970a-bbbfa93c204f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAdQV87gNjBYdCyHka5eMbQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4084
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D

170 B
243 B

19ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: dd93fd22-d490-4c49-b25e-0bfd58a692f2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 52D1 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8291255257430&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 52D1 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8291255257430&version=m202309260101&ct=76&x=1&cor=14741003099834570000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 52D1 105 KB
41 KB 64ms
62ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DRu_N6jBW5XS3-e0LGTBSk3tiRvcghwYVqn1SDOSMpx0drXNs-2eIUtYa15rMPMV6O8miYGOZM9x-TeUzNMViJiY7kGwgQdH7mXfPrqY6-kZifblyzO_40hAhBTqkeHtEnePpE_h1oU0fK6_O5MiFwt1s4td08sRDb5K37rWjE-RxXwRk&dbm_d=AKAmf-Dd2sc_dJJz2CoONgbPp-dorUJaq0eP-BLBNX0T4itMHsk3jCZWxa8uMY2Lc4F14vhMB9gQ1OH39s_NiTRrfZk26iZ8shR8uE8RXl23gkZs9LIYryN_P-WLZPAZBWEDchzRIHVkQjj-xHjxo3cOZ8bhJpkTa9cAYrcG3YCPHuAkeK6ec0j7J1TF5q_1SgCnzAE7wvy8j2HdJikQcpH9FuPR9RJpSm3qnEq8mL6iaSXeRyCMFVJJP0Uz0lKlPhk9l3FkUYepUm7r-o8LhvMERgy4jT6MG1rJgITc9MXpJmXd-47nY3F-92iN9s-H-wkrH7gkJaIvlaisqVBFega559Xq6ebOBtNdID__eZjr7tHqHVZYQCAH55LEBYPqOuSfpF_74Te-qevRW0cBuSOLma3b37AeeY_NfqdmgOW3Tb8cVF6EhtQWaqibtfAiYSMnb_a64CV1iJH7JS3LIV5HJDU09udgaEVrQH30XPcpkd39lBcweCXTB51IUHsDF8MRYgfbAvCE269f2AaaxkUadx8LNuJg-Gop4ZM1Z7gf61mb2e3a70nQ3NqD0HUivbTVWK3tDMs9AfCBRAlPVbbUCD6bOG5owpCX0wQxF8u-r2ADn31DuxfvRCzza4RuUXBhDLoN5R3IYTideOkxSWD43-hZaXh0qFPMh2KugSEfJR7yRsXD3vSRcZh0uchOT2-RRuHvsEawrSndm4CFsUyckDsD6itB9AOKKcyl5TkmqmU6IsSEv-Ey3XA-qhyFoqG1A-oqt5KHGpjMqW-FtWIjRD03IqinC7H7iCu1BmVTcyif8MIAsDPdV0f3o7MiqjTkKctyC6rstwIdP-P-RbVyH5m5wVaM8iOjMSeybroEMntTGnktbBr5zSbVrUrMZ6fdmGOmJ2eFz_uxmf5hsPlM49i_5Nj_tSvWe_36478bj5IXVjbF4RQ-znKMHSCXWKu9dk6HBsV35bsLeJIun_9ygXxl_z7_pkKPd_Lq54giDXd6n8Zba_b8PU5BD1R5ocsk4nqGlgqjINmZT9s8aPXRRYUDMENMwEu2inaOgdDHVal2xbyCMMfwmXzGoUn-0mUMg03SPUOOtEa7xUmEITf-LiAnL4Tv2kOBZj8kJTkmAXykFjTGPX9ul_LJvFUf0H0EFrWPL7WOm9QR84fjDMefyRofS7QbgKLE4t4PuRDl87cN4VazTLvtiUS5A5UhpVwyFjuCEYNh0e7-yRnRq_chha3UlK4X-yhELxzTF6SYPGg0UWn0dL-na8ItAOSuCcZm8xTG-qyYzR4uzVwYddu5QM5ooH6t6ncIV3lRc6PKTTISVwg-aIzro8hTTu7bikNWTGdracedfAqODMnJMQEDPiyxwrF2oMKHAKxtGTt8F8fQoc9Q0Ty5dxVtiLsRcXYGcv1goxmj0aGPBy7wTmqYApTO9MukRsX3c8_BD4_w5hE_5C98Vv_7uwIAaxfu8DX_ojZ75R7C3yhT3loyb6q-muyPvtmqZp8dkrgBXMz5K0eWRyNN8VUYGRGbppBtoM9wmQfqFWE7yBTtV_PLk49tlXlZXY2d7x8fUGzhik2EeCYYzehqNy2sv1JxVEdoNLKRsh7dvSz9foXt2JoIJExm2MbeAVDirouJq7gSNN2i0aJdHA_2zlmEIhFCI3GDm_rJkVANntRPQyL0slkCBMyQfTTmSeezfMhquTA8W1RKBnPgnr0C3Twb6flIByMJ-FcqYTZ_Jd4VkAlqAvrQ1i-PV4_ht6jqAM9Z425poimsAGp72u4bFcUtFzx2I5ylUQZxzktaFlreJo8KDbzeyw4M_QrCzPsTf75-9rafXDsNav5ndKhp3_u_lK22HP0y2S3qKgrm6ipjLe_purIRnEOv8hwQT9UUV_piLWs1OxnOS34zJqurviXsII7dE6NRTSB789hVHiOknDKCvSPsTssHR9tKzqKmLpNOCYcJJcAoiLNbhOY6KSRs_QoiAbbRDfgtQrJWLRGc9X3OnhQTaAsgNWRLY851EN0cTXNg6xYecWl7GJ39vBAh-yRQMU2y5WGqqsLOxWgEJgCcJc93K01-W9ZRbzPG9EINnz8ap_Np8K4m_PtdEs829i9H14Cb0-mI37H7TFEAFrdvBJDTYAHkv71yqACJT2e7jvKYlXeAOYP7jydgu7SoCdTn8ZmBfjz373NtAR7Oj3HQjIcwg1kfyRLKBNm_hiDbQhuYrXoBpwbHFkV4kt0Nbp26vO4JACan1TzcdrW5PrBQeeELFW4P83dk24XeRjW8jQrj6hMZc5DXh9_pcq8Q_JC-UaHOKmdnWmeCfen3vraMqottC9_y0UeA9qcM8ak4TerpRYsgPfZL22iVlITffZ8ac_sAdzztoyv_n3gFbaJZBj_8wOvLfQDfaT3T-G8th5RRfGYHvSL5BSId4MKni6QaffPxgC9odyoNVBl0EZAty-MXJ0aMgNElaEEG1IviBAsoi_ZMearkzXJZtLOJ5CDD21gQe21ku0yKRmMOIo72vKVHAGvGKOzck2_OY-vnitvWX1IjDSTCC8VqmM3BQ2lIEFerFoStdojE7uDniAxRJal8_TBUKBIoX6wlG2hV43daqPYfD1KXTsArmaSjypF6cFzIYBMkzrRVh9XhXvzT7F_bmZw_ghXy70FNKbqCqjm_iYGCBxQVf2vXNwDyjHJtWmLJheh2dzrhcIMgeIjI6xxx16JH_su3eIfjSEPeee_jQUCqHNCkowVWB1-cFhVoq4A6esqwlWuHgo_3udez9bfwL8G5fV9PcazoL8Ty8504tKOt2ZFW_2Cb0Vxu7QYfNk2_gOowkaeReG0pFzFugw8tczpze3mEwOf7Culv9n6g8WGEeIGm4fC5htBbCCirlcUxrS8MlTLuqJyRJZXClC5OMYNZB215K5NF75mBtFLIC4kRFoGWTERAp5fUe-bVPBmlhRfNJVO66IgEVrzTE9Dug3NMccrPdpETTZCsjF57WcgoqB88AMl4mGigvcjpR7laMT0vxhwir6gkmZUTm5PH7U2e8jMpX4dBPRtNb7RggiMpGqjyRUVR3ycW4Z7XAT4Aw1tANCahtruVX5GhhvP6nPTENBDA3wlnojAkP_Y7AZwDxMxz98eepC7xvduVI2_SWHgyPqy9866LxMX0wl9Uh1yaHb0w--66GzGrIDy2bdqxbgo_mqyozwNs17-EaWGZhIzCJnA9OEaZ28xZikwzzCxWkqr9RfuNrVUrxAE8ZP9OoAdkX9Fnekxq-aBpVBCFqbjHjdQyUir5bQpoSf39a7TFP9g8ZWB61EiErYlCP2p6DNUTvfvH7_GK9Pr0iLhrI_nf2eSpRmSk6RjWmVmJ2h7f6e6_Fohvo-At53pPHiJ_VPzC8K5klMrIM6E2a1ewwXpeQEiTuxdPz08kUZQwpQDsJO_mo_l7yOiu-9vmsjsfZsemg8RDS9JOE2sVg9N5PVSZxNcTbS-nYYu9gHXBwRhEoJu3X5PTP5A_Ddg4_mdQ71Div9ircumFn4gqnUbILOW-kZGlsd-rITZWJq8HKMaejN2G31n8Hg&cid=CAQSOwDICaaNToLls9KrQWCoY2-nrXh6Wz9rfwgycl7737lFuS7twgVicG7D_NrD1S-FDtMIxSE6dEkjVpuUGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.clien.net%2Fservice%2F&ds=l&xdt=1&iif=1&cor=14741003099834570000&adk=1964084972&idt=36&cac=0&dtd=11

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82f1b38375e3db4d8bd36a7499e8ec77348dcf3b48cd679560c36fefaf28257d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41585
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0141 0
10 B 8ms
6ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?y-NN2Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1533729/75300605/ Frame 52D1 250 KB
75 KB 119ms
32ms Script
application/javascript 34.248.216.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1533729/75300605/skeleton.js?ias_dspID=64
Requested by: Host: www.clien.net
URL: https://www.clien.net/service/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.216.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-216-70.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4ae0cece70e736a8a88b5e78ba70debe6901f545cd3fbd4e0f559acf3ef7e575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 52D1 172 KB
61 KB 57ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Origin: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 07:14:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67535
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 07:14:36 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 52D1 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DRu_N6jBW5XS3-e0LGTBSk3tiRvcghwYVqn1SDOSMpx0drXNs-2eIUtYa15rMPMV6O8miYGOZM9x-TeUzNMViJiY7kGwgQdH7mXfPrqY6-kZifblyzO_40hAhBTqkeHtEnePpE_h1oU0fK6_O5MiFwt1s4td08sRDb5K37rWjE-RxXwRk&dbm_d=AKAmf-Dd2sc_dJJz2CoONgbPp-dorUJaq0eP-BLBNX0T4itMHsk3jCZWxa8uMY2Lc4F14vhMB9gQ1OH39s_NiTRrfZk26iZ8shR8uE8RXl23gkZs9LIYryN_P-WLZPAZBWEDchzRIHVkQjj-xHjxo3cOZ8bhJpkTa9cAYrcG3YCPHuAkeK6ec0j7J1TF5q_1SgCnzAE7wvy8j2HdJikQcpH9FuPR9RJpSm3qnEq8mL6iaSXeRyCMFVJJP0Uz0lKlPhk9l3FkUYepUm7r-o8LhvMERgy4jT6MG1rJgITc9MXpJmXd-47nY3F-92iN9s-H-wkrH7gkJaIvlaisqVBFega559Xq6ebOBtNdID__eZjr7tHqHVZYQCAH55LEBYPqOuSfpF_74Te-qevRW0cBuSOLma3b37AeeY_NfqdmgOW3Tb8cVF6EhtQWaqibtfAiYSMnb_a64CV1iJH7JS3LIV5HJDU09udgaEVrQH30XPcpkd39lBcweCXTB51IUHsDF8MRYgfbAvCE269f2AaaxkUadx8LNuJg-Gop4ZM1Z7gf61mb2e3a70nQ3NqD0HUivbTVWK3tDMs9AfCBRAlPVbbUCD6bOG5owpCX0wQxF8u-r2ADn31DuxfvRCzza4RuUXBhDLoN5R3IYTideOkxSWD43-hZaXh0qFPMh2KugSEfJR7yRsXD3vSRcZh0uchOT2-RRuHvsEawrSndm4CFsUyckDsD6itB9AOKKcyl5TkmqmU6IsSEv-Ey3XA-qhyFoqG1A-oqt5KHGpjMqW-FtWIjRD03IqinC7H7iCu1BmVTcyif8MIAsDPdV0f3o7MiqjTkKctyC6rstwIdP-P-RbVyH5m5wVaM8iOjMSeybroEMntTGnktbBr5zSbVrUrMZ6fdmGOmJ2eFz_uxmf5hsPlM49i_5Nj_tSvWe_36478bj5IXVjbF4RQ-znKMHSCXWKu9dk6HBsV35bsLeJIun_9ygXxl_z7_pkKPd_Lq54giDXd6n8Zba_b8PU5BD1R5ocsk4nqGlgqjINmZT9s8aPXRRYUDMENMwEu2inaOgdDHVal2xbyCMMfwmXzGoUn-0mUMg03SPUOOtEa7xUmEITf-LiAnL4Tv2kOBZj8kJTkmAXykFjTGPX9ul_LJvFUf0H0EFrWPL7WOm9QR84fjDMefyRofS7QbgKLE4t4PuRDl87cN4VazTLvtiUS5A5UhpVwyFjuCEYNh0e7-yRnRq_chha3UlK4X-yhELxzTF6SYPGg0UWn0dL-na8ItAOSuCcZm8xTG-qyYzR4uzVwYddu5QM5ooH6t6ncIV3lRc6PKTTISVwg-aIzro8hTTu7bikNWTGdracedfAqODMnJMQEDPiyxwrF2oMKHAKxtGTt8F8fQoc9Q0Ty5dxVtiLsRcXYGcv1goxmj0aGPBy7wTmqYApTO9MukRsX3c8_BD4_w5hE_5C98Vv_7uwIAaxfu8DX_ojZ75R7C3yhT3loyb6q-muyPvtmqZp8dkrgBXMz5K0eWRyNN8VUYGRGbppBtoM9wmQfqFWE7yBTtV_PLk49tlXlZXY2d7x8fUGzhik2EeCYYzehqNy2sv1JxVEdoNLKRsh7dvSz9foXt2JoIJExm2MbeAVDirouJq7gSNN2i0aJdHA_2zlmEIhFCI3GDm_rJkVANntRPQyL0slkCBMyQfTTmSeezfMhquTA8W1RKBnPgnr0C3Twb6flIByMJ-FcqYTZ_Jd4VkAlqAvrQ1i-PV4_ht6jqAM9Z425poimsAGp72u4bFcUtFzx2I5ylUQZxzktaFlreJo8KDbzeyw4M_QrCzPsTf75-9rafXDsNav5ndKhp3_u_lK22HP0y2S3qKgrm6ipjLe_purIRnEOv8hwQT9UUV_piLWs1OxnOS34zJqurviXsII7dE6NRTSB789hVHiOknDKCvSPsTssHR9tKzqKmLpNOCYcJJcAoiLNbhOY6KSRs_QoiAbbRDfgtQrJWLRGc9X3OnhQTaAsgNWRLY851EN0cTXNg6xYecWl7GJ39vBAh-yRQMU2y5WGqqsLOxWgEJgCcJc93K01-W9ZRbzPG9EINnz8ap_Np8K4m_PtdEs829i9H14Cb0-mI37H7TFEAFrdvBJDTYAHkv71yqACJT2e7jvKYlXeAOYP7jydgu7SoCdTn8ZmBfjz373NtAR7Oj3HQjIcwg1kfyRLKBNm_hiDbQhuYrXoBpwbHFkV4kt0Nbp26vO4JACan1TzcdrW5PrBQeeELFW4P83dk24XeRjW8jQrj6hMZc5DXh9_pcq8Q_JC-UaHOKmdnWmeCfen3vraMqottC9_y0UeA9qcM8ak4TerpRYsgPfZL22iVlITffZ8ac_sAdzztoyv_n3gFbaJZBj_8wOvLfQDfaT3T-G8th5RRfGYHvSL5BSId4MKni6QaffPxgC9odyoNVBl0EZAty-MXJ0aMgNElaEEG1IviBAsoi_ZMearkzXJZtLOJ5CDD21gQe21ku0yKRmMOIo72vKVHAGvGKOzck2_OY-vnitvWX1IjDSTCC8VqmM3BQ2lIEFerFoStdojE7uDniAxRJal8_TBUKBIoX6wlG2hV43daqPYfD1KXTsArmaSjypF6cFzIYBMkzrRVh9XhXvzT7F_bmZw_ghXy70FNKbqCqjm_iYGCBxQVf2vXNwDyjHJtWmLJheh2dzrhcIMgeIjI6xxx16JH_su3eIfjSEPeee_jQUCqHNCkowVWB1-cFhVoq4A6esqwlWuHgo_3udez9bfwL8G5fV9PcazoL8Ty8504tKOt2ZFW_2Cb0Vxu7QYfNk2_gOowkaeReG0pFzFugw8tczpze3mEwOf7Culv9n6g8WGEeIGm4fC5htBbCCirlcUxrS8MlTLuqJyRJZXClC5OMYNZB215K5NF75mBtFLIC4kRFoGWTERAp5fUe-bVPBmlhRfNJVO66IgEVrzTE9Dug3NMccrPdpETTZCsjF57WcgoqB88AMl4mGigvcjpR7laMT0vxhwir6gkmZUTm5PH7U2e8jMpX4dBPRtNb7RggiMpGqjyRUVR3ycW4Z7XAT4Aw1tANCahtruVX5GhhvP6nPTENBDA3wlnojAkP_Y7AZwDxMxz98eepC7xvduVI2_SWHgyPqy9866LxMX0wl9Uh1yaHb0w--66GzGrIDy2bdqxbgo_mqyozwNs17-EaWGZhIzCJnA9OEaZ28xZikwzzCxWkqr9RfuNrVUrxAE8ZP9OoAdkX9Fnekxq-aBpVBCFqbjHjdQyUir5bQpoSf39a7TFP9g8ZWB61EiErYlCP2p6DNUTvfvH7_GK9Pr0iLhrI_nf2eSpRmSk6RjWmVmJ2h7f6e6_Fohvo-At53pPHiJ_VPzC8K5klMrIM6E2a1ewwXpeQEiTuxdPz08kUZQwpQDsJO_mo_l7yOiu-9vmsjsfZsemg8RDS9JOE2sVg9N5PVSZxNcTbS-nYYu9gHXBwRhEoJu3X5PTP5A_Ddg4_mdQ71Div9ircumFn4gqnUbILOW-kZGlsd-rITZWJq8HKMaejN2G31n8Hg&cid=CAQSOwDICaaNToLls9KrQWCoY2-nrXh6Wz9rfwgycl7737lFuS7twgVicG7D_NrD1S-FDtMIxSE6dEkjVpuUGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.clien.net%2Fservice%2F&ds=l&xdt=1&iif=1&cor=14741003099834570000&adk=1964084972&idt=36&cac=0&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 23:33:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 23:33:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 52D1 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 03:27:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:27:08 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 52D1 41 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 18:02:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 374248
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Oct 2024 18:02:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CE44 1 KB
643 B 9ms
7ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59407
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 Oct 2023 09:30:04 GMT
etag: 48472445140208031
expires: Mon, 23 Oct 2023 09:30:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 52D1 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a768091007d2396b543bb0e4dd2bf23c9ed9f4e10808079dc91636e7fd784524

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2344 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310180101/pubads_impl.js?cb=31079032

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.clien.net/service/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 23 Oct 2023 02:00:10 GMT
expires: Tue, 22 Oct 2024 02:00:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5227 22 KB
8 KB 8ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 266256
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 20 Oct 2023 00:02:35 GMT
expires: Sat, 19 Oct 2024 00:02:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE44
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEC3VWFeNC07DiHZ9-xg15L4&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEC3VWFeNC07DiHZ9-xg15L4&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RnlrNWhNbXIxUVVLZUw1&google_gid=CAESEC3VWFeNC07DiHZ9-xg15L4&google_cver=1&google_push=AXcoOmSUbaoLBDtIfQjAfaEFA2xjd8VQsbBRgtKcB1ZSMlT...

170 B
188 B

22ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RnlrNWhNbXIxUVVLZUw1&google_gid=CAESEC3VWFeNC07DiHZ9-xg15L4&google_cver=1&google_push=AXcoOmSUbaoLBDtIfQjAfaEFA2xjd8VQsbBRgtKcB1ZSMlTIsC0ftv1VcMJkc52yysVvWNJrscdWoRHBw5MxCiUmszNpHeiUowpH

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 23 Oct 2023 02:00:10 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-038ad97d93033251e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RnlrNWhNbXIxUVVLZUw1&google_gid=CAESEC3VWFeNC07DiHZ9-xg15L4&google_cver=1&google_push=AXcoOmSUbaoLBDtIfQjAfaEFA2xjd8VQsbBRgtKcB1ZSMlTIsC0ftv1VcMJkc52yysVvWNJrscdWoRHBw5MxCiUmszNpHeiUowpH
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame CE44 43 B
363 B 80ms
11ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmT9cvKhXrViUNeYV8O4XlZc4w_SQ2kyOWoz6Ct3uJHr7Vo7gxiHANNvFVJ9yaAYYDnBin3vXOA_Bc1wfMPgeo6-pDckC4aDMQ&google_gid=CAESEDjJZUe3bJGCa-O2vNf2NkM&google_cver=1

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:10 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 174626
expires: Mon, 23 Oct 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE44
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS4EFDv2i6MMiOwkxYylNybxI0oNE2dJfDjl__-htoQDceodBFi-2q4FoDGl66SkJaYXTmYkHF4txR5GMvAWxYOHV6SXGli7w

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS4EFDv2i6MMiOwkxYylNybxI0oNE2dJfDjl__-htoQDceodBFi-2q4FoDGl66SkJaYXTmYkHF4txR5GMvAWxYOHV6SXGli7w
date: Mon, 23 Oct 2023 02:00:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE44
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGi_bqA463wsqvlcYNOhNsg&google_cver=1&google_push=AXcoOmSXHvtVz2vlfp1IPER66CNuQEpOqQvFVOcWY8fqhhm8ZjDtO-vyZ0GVrRszcHuVq-nqRRm...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE8yOTMwQU8tMTItMUU5WQ==&google_push=AXcoOmSXHvtVz2vlfp1IPER66CNuQEpOqQvFVOcWY8fqhhm8ZjDtO-vyZ0GVrRszcHuVq-nqRRmwsw7qIOTdqst3ANYztQ3k3shHLw

170 B
188 B

19ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE8yOTMwQU8tMTItMUU5WQ==&google_push=AXcoOmSXHvtVz2vlfp1IPER66CNuQEpOqQvFVOcWY8fqhhm8ZjDtO-vyZ0GVrRszcHuVq-nqRRmwsw7qIOTdqst3ANYztQ3k3shHLw

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE8yOTMwQU8tMTItMUU5WQ==&google_push=AXcoOmSXHvtVz2vlfp1IPER66CNuQEpOqQvFVOcWY8fqhhm8ZjDtO-vyZ0GVrRszcHuVq-nqRRmwsw7qIOTdqst3ANYztQ3k3shHLw
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 402fba8a82f093def2459220061c8d31
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE44
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECBzEwPFuSyZbGEbkFlStZQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECBzEwPFuSyZbGEbkFlStZQ&google_hm=ZTXTqwPCTIp9PyllLpUUugAAFA8AAAAB&google_nid=index&google_push=AXcoOmSM634by819ZJ2NibtI2DWXyR1TIvVQq...

170 B
188 B

26ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECBzEwPFuSyZbGEbkFlStZQ&google_hm=ZTXTqwPCTIp9PyllLpUUugAAFA8AAAAB&google_nid=index&google_push=AXcoOmSM634by819ZJ2NibtI2DWXyR1TIvVQqx0kiMZjupryw0zcDM-oYwVN_BDVUlz2lIMEERrVvPYjrjgYnX8BHpVzLjeTy-YD4Q

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hwnevNnFNykUi0K14tUhWPUWCjCc5Wa9iwZk2foJPVPd%2BrmcRlDilDutBo5FuRvYoH3jga8TTMnMlnBeRWHbbETrcXJY99Me3cnEc5F5UjTTVIeRNS2uC8CCFJCYiTeR9JhWbhGg3CBxqA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECBzEwPFuSyZbGEbkFlStZQ&google_hm=ZTXTqwPCTIp9PyllLpUUugAAFA8AAAAB&google_nid=index&google_push=AXcoOmSM634by819ZJ2NibtI2DWXyR1TIvVQqx0kiMZjupryw0zcDM-oYwVN_BDVUlz2lIMEERrVvPYjrjgYnX8BHpVzLjeTy-YD4Q
cache-control: no-cache
cf-ray: 81a6628e9c52bbdd-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame CE44 0
45 B 206ms
16ms Image
text/plain 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEGF3GXc8n3LbwN03QaBmVvY&google_cver=1&google_push=AXcoOmTCC9dh-uTXlnUg1X8WQB-iBmC9hRhNL_oB1cbdejhy5Et4_vTPLVfKtyNmuPUWABIwE8N_s643JURxZ_6eWlH1Hf0cSJM99Q
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CE44
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESELjUTTwZWyfGCDFBW5gyY8E&google_cver=1&google_push=AXcoOmRbDEkfDtH1b...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D&google_gid=CAESELjUTTwZWyfGCDFBW5gyY8E&google_cver=1&google_push=AXcoOmRbDEkfDtH1bRSh6164xPmEr0-_Z8...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D&google_gid=CAESELjUTTwZWyfGCDFBW5gyY8E&google_cver=1&google_push=AXcoOmRbDEkfDtH1bRSh6164xPmEr0-_Z815Ze4kDrn_fK-_UeYFNHodh9Q8xdirSoxeHZ9xvBlUi9lW9qgbBPwmqsFxM-2I6n9sT8o

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: 65d366e3-5545-49a0-af4b-64d9ba3a5425
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D&google_gid=CAESELjUTTwZWyfGCDFBW5gyY8E&google_cver=1&google_push=AXcoOmRbDEkfDtH1bRSh6164xPmEr0-_Z815Ze4kDrn_fK-_UeYFNHodh9Q8xdirSoxeHZ9xvBlUi9lW9qgbBPwmqsFxM-2I6n9sT8o
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CE44 0
12 B 15ms
15ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LHEYBJJYKg0LcRGjVW5qcWRDzAelN_AiWxyIPjJTpFeDbhMrrdjNKc_XPIqg0UCRnTeDhisw

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 2 KB
780 B 31ms
15ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d93b21254d7fb0ba747a31d73c6310376fb5311cf5d40655b7e6b546e89f6b4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 752
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 23 Oct 2023 02:00:11 GMT
expires: Tue, 22 Oct 2024 02:00:11 GMT
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 52D1 0
0 124ms
52ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvErFTpRMIwzLAyx-xKKrGRskJYkZgW6SNPrSTBic6Z2g-uxHazSVlXtzujK4oDM16LffcxWLGPXPK2rFp1bUOuVAgrVdFpkw0g1XT0vYJOIDc11d60kUp175SWi1zQY06st4EyfdaXqrTfxADMwinRLQtMRZzxnG2DIrcOVA0WJGlubAKb2cY5fuwtcRqW_Rjb6wp6URZ5P0OECIzePycbuazfcRWhYe1rWGBaL4aNGAHLynejG0gA_09Y1ptYIEDvk3jlnBhBC03ar6EaTJtsHJ_9rZHZ5h5iiDd8nHGRh9nTAKbFC0DAgZGUZYVxfh7BGx1q7IJrdQIQjZ2Sm1CykkzXSrzgYSIUVJOcW7H45mD8Cd2SiSqbrTiESz-RZLOSgATC7btmvAnDKvULKNAdk_1z_Q94stVKT9Q0zUBz-rq3pZWAszc5Dme9P-sC0y5w3zYB4T2XL8OfWe1zkHUmBSl7OQohMjlwweb4hN3brrr6dXSDTFZliMVYHB5TTim8B6wprfqMar7IePS4B3k_qAtL5L5fLZjKtsnbZWeDtZgGtuun6huiWIflYVoLH_N-DBNZiti6rPv5_iAOybdFJ2JAinpOjEO3HjZpvuPevwaUDjwrcanNpQmYxcE2H1Myq-1lXPf1Oe3Kc9hC4gnPXqhSyVOKLPALDrOP7fi2N2hHm9_oqicZ7hHzAM4kTJlP2sQJRvGasQ5PgYWforMQVV3l-sX0B1wQwpqL-MfsBKqQ68BKNqWxqrDuzhqi8ly1gyQugdAhUX8PSv0hy7NmiP6x2TXHs6jBuRMQqzkOb5S9ps4yOUZJGM4phNmGFxoBxJdwN1R13J77hJ2ttl6oozU0BF_nsSqWF1QF2DHdTsghLMCcbMXWVSDieo00iRshzmsbNADkiIxzsgchOTwmGsuuyW2z9cmOslULmD2T2PqFB0vjmlOV2rERVHxmE2xQXAiPynh___epMZ8S79oBuPmA4agvRsIORDHtpITeuR2eYruQtqboKtgHFdkUcY5OXr0NRx-bY6XW2PZ87toxbmZBolXx4E1ptrNpxkwXn_Yqu4NBBMunaBVtTUmZ0OM3te02_Gq1Ou1Zc7NTPxKf5p8hdkKzNfYYvVvgfPOri_7raeoWx1GtDoKr8PSslC3q_jGadGHFLldCilLazece8hU_tk684FWIshm_q8q4wvGNXrQ4Pmk2-zCqOp7SttzMmBMJStx8FY2Fm9tUy0RvNL8zy4Eqtn2FxlgzKRu2g-DevHojN1ljR1K5-8MH_xTMM4nXNyeRypEKDeqamPEBuZIjr5usLk9gYSO5aijtrkILW-nBVENpBCGiNfmzaOB1-uyl_OcMw-9zPrK1I8CsBXyda69o8BRiRRxQrje0&sai=AMfl-YQdyPNwouNQRfeKdI7wXgsqrn6KRuQ7RYMEutb3NVU3k7sRV0yacTEkHKA5xU_nNLOoWNV5ze1YrIUB-145ABeP-gKMGNprOgxRWMO9XBTrOsrDPo4xhR8oNzwduHkZ3DulBTii_lRUIl8q4D3rERFJgI7DDHf8thrqggklpRetT_7pTetT_B6XousHSud3uHJ3NCBAUtnckNuuUBw_fMWx3-lgsCRhCVp2r77HP8l9XoD4bFRTjERQ2uIJeolZotcGL_IXpcQk8ea9JxL-XJBEwiiz40w&sig=Cg0ArKJSzE4XKvxe0EMVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=134&cbvp=1&cstd=124&cisv=r20231011.32004&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B54C 624 B
242 B 23ms
22ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYqYLo4gEwAQ&v=APEucNUYmPDxNs1mMWbu3N4zQW4lpbOf8U1OX5sFp_dh2wqBj5xd8VCXtJw8M2j72C_0IwmK-BIfgL0FCwGiQtxr7QfWB1VKXMQKvo-ydIn6WFHCZmbhwpZrjkhk2mSlHrBgtx0FgEMdTP-DsG9Vtip8EIvY0Am_Ze75f88smex4RXdBVbGgJKE

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 23 Oct 2023 02:00:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2344 172 KB
60 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Origin: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 07:14:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67535
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 07:14:36 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231017/r20110914/elements/html/ Frame 2344 7 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231017/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 03:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:15:22 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231017/r20110914/ Frame 2344 23 KB
9 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231017/r20110914/abg_lite_fy2021.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45edbc85483b4cde24376ffc1a6b93969f8e51cd2e73547f84824c8f54fb79f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 03:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9137
x-xss-protection: 0
server: cafe
etag: 5200559654007170660
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 03:15:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2344 41 KB
14 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 23:31:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 354514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Oct 2024 23:31:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/ Frame 2344 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 18:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28270
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 18:09:01 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 91E0 1 KB
643 B 14ms
9ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59407
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 Oct 2023 09:30:04 GMT
etag: 48472445140208031
expires: Mon, 23 Oct 2023 09:30:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/ Frame 2344 20 KB
8 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f74f99e9fe1027d19c741e71e7a2adf40f49a011d50cb110e45a0511f624fb3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 00:02:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7057
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8427
x-xss-protection: 0
server: cafe
etag: 8504628880869859743
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Nov 2023 00:02:34 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2344 42 B
63 B 44ms
41ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CFVdS9YS-bfAYZje_FPU0BoSn71w9z6lFVJL7NKKH6rxaQ7rUrile5ok0Ooyf8n6zzhpTNa4E3wG6pK63EEe1N1pLaut8hEv54my83mzbpP1OkId4

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2344 0
0 18ms
14ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQCv59McYMKcp2imkdcKMMtqnFqIbBTH8-OebWJPOWJlJPG8sqIAwavKYDHdr1yKtdDHglnqNwVde6Q_S2g8hQ_7YAghg
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2344 187 KB
59 KB 21ms
16ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

100e1bd433b0fbe35e8d609395d4f9a1cbafbeddb64a30b6ac6fcc7888f9310a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60178
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697628223465749"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 7E81 120 KB
41 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 17:00:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32354
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 17:00:57 GMT

GET
H3 200 gsap_3.11.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7E81 69 KB
27 KB 23ms
20ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.11.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27635
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:03:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 14 KB
4 KB 13ms
11ms Script
application/x-javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a4618ae7ac060f9662888fa3eeb86dd805631ce6e68d2fd1f7f4335a459736a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 382419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4330
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:32 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B54C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6W-7sU6ktuNGqnJE73GaQ&google_cver=1

43 B
738 B

20ms
20ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6W-7sU6ktuNGqnJE73GaQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYqYLo4gEwAQ&v=APEucNUYmPDxNs1mMWbu3N4zQW4lpbOf8U1OX5sFp_dh2wqBj5xd8VCXtJw8M2j72C_0IwmK-BIfgL0FCwGiQtxr7QfWB1VKXMQKvo-ydIn6WFHCZmbhwpZrjkhk2mSlHrBgtx0FgEMdTP-DsG9Vtip8EIvY0Am_Ze75f88smex4RXdBVbGgJKE
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vNWAj5kgorqM9%2BgrdraDIySe9Y6LwbG8yB%2FDJF5gWKX68LIZRy319FxfzOXvsTizNf%2FBdd%2FJLTjkF8fM6aDWJUo9tXAAkCUx6Xb9vRpfRRxBX4XwDS7KzEIqU2ABRA27dCNwOXzuvZxgEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81a6628f2a023a79-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA6W-7sU6ktuNGqnJE73GaQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B54C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZTXTqwPCTIp9PyllLpUUugAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELmEYpBRG4g27M6kfzlqJD0&google_cver=1

43 B
733 B

22ms
22ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELmEYpBRG4g27M6kfzlqJD0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYqYLo4gEwAQ&v=APEucNUYmPDxNs1mMWbu3N4zQW4lpbOf8U1OX5sFp_dh2wqBj5xd8VCXtJw8M2j72C_0IwmK-BIfgL0FCwGiQtxr7QfWB1VKXMQKvo-ydIn6WFHCZmbhwpZrjkhk2mSlHrBgtx0FgEMdTP-DsG9Vtip8EIvY0Am_Ze75f88smex4RXdBVbGgJKE
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6hzQq1WTCM63N6gK3A31QLS79uSYVxMRvnhYHhGHoDqIbAE313FNpfK7zDyl6HR9PxIjy45usfdDBP3ik94%2Bu5hJklbOX5O3a66%2BJSIsEj2rnmcwotsoqYb5j5JceBeE%2B16%2BSjU8MnRhqA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81a6628f7a1f3a79-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELmEYpBRG4g27M6kfzlqJD0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame B54C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKn4yyUUGbbrVjQyUrzt7Dc&google_cver=1

43 B
841 B

13ms
13ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKn4yyUUGbbrVjQyUrzt7Dc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYqYLo4gEwAQ&v=APEucNUYmPDxNs1mMWbu3N4zQW4lpbOf8U1OX5sFp_dh2wqBj5xd8VCXtJw8M2j72C_0IwmK-BIfgL0FCwGiQtxr7QfWB1VKXMQKvo-ydIn6WFHCZmbhwpZrjkhk2mSlHrBgtx0FgEMdTP-DsG9Vtip8EIvY0Am_Ze75f88smex4RXdBVbGgJKE

Protocol

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: cc203ba7-41eb-4391-bcb3-751cba6394c0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKn4yyUUGbbrVjQyUrzt7Dc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B54C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: 37ac3782-b123-4b86-85b2-b395b817cbda
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODM0MTU3MTgxMDE2OTM0NzU0MA%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 gkc7GkOx0NjYAbDEAjG_3nA6cC9mq0x3jEC3r4qNpAU.js Show response
pagead2.googlesyndication.com/bg/ Frame 5227 37 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gkc7GkOx0NjYAbDEAjG_3nA6cC9mq0x3jEC3r4qNpAU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82473b1a43b1d0d8d801b0c40231bfde703a702f66ab4c778c40b7af8a8da405

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 18:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 460600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14604
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 18:03:31 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12943809228921786815/ Frame 0A93 1 KB
767 B 17ms
14ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68b34a28617137221b76b93546359bf577aea1d6b3aadbd65b40e8bbdae7dd0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 23 Oct 2023 02:00:11 GMT
expires: Tue, 22 Oct 2024 02:00:11 GMT
last-modified: Thu, 27 Apr 2023 13:46:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2344 0
0 51ms
51ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu7Yq8SIHqE-Khf4kVSNTbb-CgxFu_9PvBP6gYq01tXDhbLqodeE4kANfMM_8Lmg7pzp1PTC6EttqVwZBE-uDTrqWULzN-YBjnT-13n-47xMbm-dU2VAMKmrM6Cmjq63Hy3q4Jfq7OgWEJp0TM1HjJDBO_Fd_lA1pvfZczZuq0Ob880I3AH0KfFEhEiXLlPF3572A03CY1BzPA33x5pCjroqSyopHyr8xpMsIhWPJ57dJYB7CRtGLqKqjnEFl1YW6aXbR49m9v_VcG8ZmAQN8JGgTWSFFvQp0v-5QkacL1Yele5WEAZEaVVhDoHQ1z1e5fNEJcy1YeT14WwsNjkprmI69W5FEk4XUxwE5lwBXWopcYOA-DM10puUHREPBmDOFoqLDw3i-FD3sBuJohI19sCe4FLbHNWFzO-oaB7tCLrZAOJF3QvHCLLRRVRQ_AFUUCKbhyNZ7D8TIhf5XwkvgRgxVY_u27qPSHgDsCKEheXSs9wI3Uzuia7XNNpjcfrzKueXE9IwduyXVrPO6e48X7IXvVUfV-zBQcxK-SWbX6yY7naJNqczTowa__2z5e8_VRMtj0fxE5gevaSLoOFZkY8W839RUuDkHkeB9Q_7tUvCECFnL44wzHOyhp5elK7YpPrnyXMZlgwlFPF803eCx3-KyLPj1fGQsgOaJZ5_FAlMujqHeMHhnDJpQI53tuQg2li7PUmm94bKn7b8HHrjxOHTIzJNly8AyD00-S-tJ_G2FrkYPQIiCa_5_vLhXkn7P4zYxtV_m9LYfCvSLaivLhAxjXuXt8RhBDfXnChAlWADICJ8O1rWZXQEshjkF0hj0FqiDqJk1EF14C6BjuGAY9MlRMUXx7UyZggP6byCVVBEJNbLviWf2fa4P77jhAph7X4rFMFONtnX0Y-xTLwRyeViHem4DC4CIMlnldWEgs7D4pmT_4P67wd0gtC4nJwNbBTJk3kIiBTXXj7IbUSt8haBWRb15nbmwlIkqj47r1m3Cz_PIX-ITkKMu_i17SSVFd5Bo0rOOlC_mVo8g0uWBGRf-KBPI3e_6_FjvZ0UCtS1bfM77UMPdiSAKAgaut9BMrUC3h3OysOJDJiviBIKVLAgBNNCU2mpGF6KdjlmhSXN9arn7VwdPxeYqt9ZfZKtfJwarNMWve8BtlDkA4yHO-FmerMvscfI30Dkp3FuGVkgvxpRbeGQCerx4CCC7rWI68hxxoSdXCYKB9gCpZ55PNbKyLR1nehyIYyStN8ymbj-Xnz5p31KxK0lN_C_nLpCQ7k4ALNw_iFoPN4ERHCjLSVY0085VBrZ8hzBXalN3VhWWfkUuFIIdw0AKB6jA5cWOnccI9BLLfC28LfCV8QsNHeVJ9DKPRtMkUEn4_T&sai=AMfl-YTqcclCdMqfBEEi9dSkQ3CmXmapKFG9lOo3jLPbndGmXoM62AAdeaQPtwudcbHG83wqyuni9U6Q7ASFcH0Ev8VXYL2Uu-aDb-fCTA60rfsLeBCiZhxp9f5wkfV7oQmyA-cNs_jOkI04xe9tzNGP1RQXCNoP8LjyVgql3UChJfAAC-ktJlIWpX6oXjwcWkoSjRLkR_FNsekSzrA3QyJv_7mcOPmwtOVvmrbNfcI_M8txRtfwW29hgdyATMmCvEToX2JowNPyagHYw2lkBMg8zHf0dniPG1_BrSdRSWquornv4waIOsMNrOV15E75f9NgjtXhocFc308BSRKbTfV7DQUsK6aQ-Q5AJHQXgeEzWgeIUq_uDf-hVW0GGUUMa-AjwuaLKwfZEEfl9FW5gGkpB4yE53Vx&sig=Cg0ArKJSzI5Hf-kd8AcDEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=61&cbvp=1&cstd=51&cisv=r20231017.63107&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 2344 43 B
1 KB 127ms
22ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=180662177&extPm=361577817&gdpr_consent=&gdpr=

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Neukirchen-Vluyn, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Mon, 23 Oct 2023 02:00:10 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mo, 23 Okt 2023 02:00:11 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1119
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 52D1
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1533729/75300605/4.js?ias_dspID=64&adContainerId=brand_safety_q9M1ZdL0BujZx_APicG0sAw&cbFunctionName=goog_wrapCb_q9M1ZdL0BujZx_APicG0sAw&true_pb=&adsafe_pb=htt...
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_q9M1ZdL0BujZx_APicG0sAw&cbFunctionName=goog_wrapCb_q9M1ZdL0BujZx_APicG0sAw&true_pb=

1 KB
1 KB

6ms
6ms

Script
application/javascript

2600:9000:223f:2000:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_q9M1ZdL0BujZx_APicG0sAw&cbFunctionName=goog_wrapCb_q9M1ZdL0BujZx_APicG0sAw&true_pb=
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:2000:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 06:02:11 GMT
x-amz-version-id: R3AxWwopGHaaV3xj068LUxj.lgAg56jC
content-encoding: gzip
via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 503880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 08 Aug 2023 19:01:30 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: bmw_g-DQ1tscxxOk5G3OfzkgMahEnd3R-VQ4X_r5uwkuNdgn-2kv6A==

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: nginx
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_q9M1ZdL0BujZx_APicG0sAw&cbFunctionName=goog_wrapCb_q9M1ZdL0BujZx_APicG0sAw&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 0FE8 91 KB
23 KB 37ms
7ms Script
application/javascript 2600:9000:223f:2000:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:2000:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 2771461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: I2Yx0hq1oMnKHYYzWTeDeDhkQPfVtUxao6IYgZGBfrGZdH-tpX_edQ==

GET
H2 200 dpixel
cms.quantserve.com/ Frame 91E0 35 B
463 B 42ms
8ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEK8Nd8Z5Grn9UYObuD4Pu8Y&google_cver=1&google_push=AXcoOmR3hShS8csb57uy17I-q-SJzeCzJVzMpj6eNalBQBTBGQBVHyyA-QYkfLFLhn-wQU278P5KkHTBPqYjYEjJIRpxeFDOJ_tUwQ

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 91E0
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEFz098ZYZIkrpHGj_9G7KR0&google_cver=1&google_push=AXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_Ba...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFz098ZYZIkrpHGj_9G7KR0&google_cver=1&google_push=AXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_...

43 B
430 B

183ms
172ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFz098ZYZIkrpHGj_9G7KR0&google_cver=1&google_push=AXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_BaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_BaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 81a66290ee1b2c37-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 4657
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFz098ZYZIkrpHGj_9G7KR0&google_cver=1&google_push=AXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_BaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQPX04eQmdH4MvUhrmQpXOikZdLXhM7wz0L_Br3PfEkWEzM-1Y6jslFu2XHygibAOTfrz9Hj6BCD7P_ZHThQbYJ_rPs0R_BaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 81a6628fbd9e2c37-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91E0
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEN3p8Xevc7d3DZTIyx-_tHI&google_push=AXcoOmSbt3JWkVvnAyMY9Hh2kvPUWOqQXYHD1T0clQGPwB0wTFjWz89rSp...

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEN3p8Xevc7d3DZTIyx-_tHI&google_push=AXcoOmSbt3JWkVvnAyMY9Hh2kvPUWOqQXYHD1T0clQGPwB0wTFjWz89rSp9TqwrUvIeHKqgD9FEADSG77c0sATcBLE6wgJkyHcNmEQ

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220069-FRA
pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1698026411.481867,VS0,VE94
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEN3p8Xevc7d3DZTIyx-_tHI&google_push=AXcoOmSbt3JWkVvnAyMY9Hh2kvPUWOqQXYHD1T0clQGPwB0wTFjWz89rSp9TqwrUvIeHKqgD9FEADSG77c0sATcBLE6wgJkyHcNmEQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 91E0 70 B
149 B 102ms
31ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEMXVXA_l1QEvTvv6tpp3Y5g&google_cver=1&google_push=AXcoOmSOLDsxgK0-n3_qDuq5GkZ5ipH0_iBxlOVpbWXyHoddS99RlCO1EeLhidWmiN2gBkMOF2HWVXbVpasz1TeXMNV2TEqHXhF0zA
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 91E0 0
173 B 47ms
14ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEIg0rmCY8LakPwkUqNr-v88&google_cver=1&google_push=AXcoOmRgEo9ZVkDqwxsAyFvTuIKJb9WmvBIbCUVAnO9X2xIsunb995xlIkaMvtajEO3ett8wHk7iQOxn15294sz1G5iTSDqqWRsb
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 dds
rtb.openx.net/sync/ Frame 91E0 43 B
245 B 48ms
14ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEBeEn9wO7kKzeVaHw3B6YYY&google_cver=1&google_push=AXcoOmSHjF2IemB1R8avb38HvgatiEEtrrrHuLIfypnzs5QRSstnGXR6DgEK32NWRKaMltKWoU9n5MCSzeFrnoX7z7BL4OiDPqDSQw
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91E0
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

22ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmStqwgoMKB2F4I3Nc9fkmNiLwgZB7rYdLlet9tnliai5V6llT2uKa-NrLSfgxJ33N8XLdlXzz3y86cRYLgzlj5zL_3uUFChhw

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YmqmZyU1Qwee7A0riNr46A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmStqwgoMKB2F4I3Nc9fkmNiLwgZB7rYdLlet9tnliai5V6llT2uKa-NrLSfgxJ33N8XLdlXzz3y86cRYLgzlj5zL_3uUFChhw
date: Mon, 23 Oct 2023 02:00:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 91E0 0
12 B 15ms
14ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IGyUEEYlWh6rKEowIE1BWU4qmTj_vi-RwTyRX799JVv6la5HcJ3Qo9xdO7NF9uUZox7CoB

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 0A93 113 KB
38 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 0A93 118 KB
40 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 04:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76787
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 04:40:24 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 52D1 43 B
216 B 562ms
176ms Image
image/gif 2600:1f13:800:7782:b1dd:230f:9cbe:e84b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1533729&asId=6911ec0a-519d-a52c-6f47-717c6c3e4a8b&tv=%7Bc:rPEpGB,pingTime:-3,time:76,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:24%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:76,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B70~0%5D,as:%5B70~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTtfM8i+11%7C12%7C13%7C14%7C15*.1533729-75300605%7C151%7C152%7C153%7C154%7C161%7C162%7C163,idMap:15*,rmeas:1,rend:0,renddet:na,siq:25%7D&br=c
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:b1dd:230f:9cbe:e84b Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 52D1 43 B
215 B 558ms
177ms Image
image/gif 2600:1f13:800:7782:b1dd:230f:9cbe:e84b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1533729&asId=6911ec0a-519d-a52c-6f47-717c6c3e4a8b&tv=%7Bc:rPEpGE,pingTime:-6,time:78,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:78,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B72~0%5D,as:%5B72~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTtfM8i+11%7C12%7C13%7C14%7C15*.1533729-75300605%7C151%7C152%7C153%7C154%7C161%7C162%7C163,idMap:15*,rmeas:1,rend:0,renddet:na,siq:25%7D&tpiLookup=ao:www.clien.net*&br=c
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:b1dd:230f:9cbe:e84b Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: nginx
x-server-name: dt01.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
DATA 200
OK truncated
/ Frame 2344 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 279e969b586a62b4f4feb047e99cd63e122106c007db93bf9e9070a89690e315

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 1DBC 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 334522
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 05:04:49 GMT
expires: Fri, 18 Oct 2024 05:04:49 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7553 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310180101/pubads_impl.js?cb=31079032

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.clien.net/service/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 23 Oct 2023 02:00:10 GMT
expires: Tue, 22 Oct 2024 02:00:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 52D1 43 B
215 B 497ms
177ms Image
image/gif 2600:1f13:800:7782:b1dd:230f:9cbe:e84b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1533729&asId=6911ec0a-519d-a52c-6f47-717c6c3e4a8b&tv=%7Bc:rPEpHG,pingTime:-2,time:142,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:195,mdZ:375,beA:413,beZ:414,mfA:416,cmA:417,inA:417,inZ:421,prA:422,prZ:432,si:438,poA:439,poZ:462,cmZ:462,mfZ:462,loA:491,loZ:494,ltA:554,ltZ:554%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:24%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:142,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B136~0%5D,as:%5B136~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTtfM8i+11%7C12%7C13%7C14%7C15*.1533729-75300605%7C151%7C152%7C153%7C154%7C161%7C162%7C163,idMap:15*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:25,sinceFw:115,readyFired:true%7D&br=c
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:b1dd:230f:9cbe:e84b Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: nginx
x-server-name: dt22.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 52D1 0
0 45ms
45ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvErFTpRMIwzLAyx-xKKrGRskJYkZgW6SNPrSTBic6Z2g-uxHazSVlXtzujK4oDM16LffcxWLGPXPK2rFp1bUOuVAgrVdFpkw0g1XT0vYJOIDc11d60kUp175SWi1zQY06st4EyfdaXqrTfxADMwinRLQtMRZzxnG2DIrcOVA0WJGlubAKb2cY5fuwtcRqW_Rjb6wp6URZ5P0OECIzePycbuazfcRWhYe1rWGBaL4aNGAHLynejG0gA_09Y1ptYIEDvk3jlnBhBC03ar6EaTJtsHJ_9rZHZ5h5iiDd8nHGRh9nTAKbFC0DAgZGUZYVxfh7BGx1q7IJrdQIQjZ2Sm1CykkzXSrzgYSIUVJOcW7H45mD8Cd2SiSqbrTiESz-RZLOSgATC7btmvAnDKvULKNAdk_1z_Q94stVKT9Q0zUBz-rq3pZWAszc5Dme9P-sC0y5w3zYB4T2XL8OfWe1zkHUmBSl7OQohMjlwweb4hN3brrr6dXSDTFZliMVYHB5TTim8B6wprfqMar7IePS4B3k_qAtL5L5fLZjKtsnbZWeDtZgGtuun6huiWIflYVoLH_N-DBNZiti6rPv5_iAOybdFJ2JAinpOjEO3HjZpvuPevwaUDjwrcanNpQmYxcE2H1Myq-1lXPf1Oe3Kc9hC4gnPXqhSyVOKLPALDrOP7fi2N2hHm9_oqicZ7hHzAM4kTJlP2sQJRvGasQ5PgYWforMQVV3l-sX0B1wQwpqL-MfsBKqQ68BKNqWxqrDuzhqi8ly1gyQugdAhUX8PSv0hy7NmiP6x2TXHs6jBuRMQqzkOb5S9ps4yOUZJGM4phNmGFxoBxJdwN1R13J77hJ2ttl6oozU0BF_nsSqWF1QF2DHdTsghLMCcbMXWVSDieo00iRshzmsbNADkiIxzsgchOTwmGsuuyW2z9cmOslULmD2T2PqFB0vjmlOV2rERVHxmE2xQXAiPynh___epMZ8S79oBuPmA4agvRsIORDHtpITeuR2eYruQtqboKtgHFdkUcY5OXr0NRx-bY6XW2PZ87toxbmZBolXx4E1ptrNpxkwXn_Yqu4NBBMunaBVtTUmZ0OM3te02_Gq1Ou1Zc7NTPxKf5p8hdkKzNfYYvVvgfPOri_7raeoWx1GtDoKr8PSslC3q_jGadGHFLldCilLazece8hU_tk684FWIshm_q8q4wvGNXrQ4Pmk2-zCqOp7SttzMmBMJStx8FY2Fm9tUy0RvNL8zy4Eqtn2FxlgzKRu2g-DevHojN1ljR1K5-8MH_xTMM4nXNyeRypEKDeqamPEBuZIjr5usLk9gYSO5aijtrkILW-nBVENpBCGiNfmzaOB1-uyl_OcMw-9zPrK1I8CsBXyda69o8BRiRRxQrje0&sai=AMfl-YQdyPNwouNQRfeKdI7wXgsqrn6KRuQ7RYMEutb3NVU3k7sRV0yacTEkHKA5xU_nNLOoWNV5ze1YrIUB-145ABeP-gKMGNprOgxRWMO9XBTrOsrDPo4xhR8oNzwduHkZ3DulBTii_lRUIl8q4D3rERFJgI7DDHf8thrqggklpRetT_7pTetT_B6XousHSud3uHJ3NCBAUtnckNuuUBw_fMWx3-lgsCRhCVp2r77HP8l9XoD4bFRTjERQ2uIJeolZotcGL_IXpcQk8ea9JxL-XJBEwiiz40w&sig=Cg0ArKJSzE4XKvxe0EMVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=425&vt=11&dtpt=291&dett=3&cstd=124&cisv=r20231011.32004&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sdk.js Show response
adsdk.microsoft.com/native-to-display/ Frame 7553 89 KB
36 KB 125ms
12ms Script
application/javascript 2620:1ec:46::63
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://adsdk.microsoft.com/native-to-display/sdk.js
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:46::63 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e615f6f367dc60fdba6d1448d36ac3b9195d53b0547eecd900ec7ac5da35f87f

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Origin: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: br
last-modified: Tue, 10 Oct 2023 17:29:05 GMT
vary: Accept-Encoding
x-azure-ref: 20231023T020011Z-exz6v3ut115h99sgzwgv4e0hag000000009g000000008c2h
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 98ef5094-301e-0028-1e63-03a39c000000
cache-control: private, max-age=3600
x-cache: TCP_HIT
x-ms-version: 2009-09-19

GET
H2

200

c.gif
www.bing.com/aes/ Frame 7553
Redirect Chain

https://www.bing.com/api/v1/mediation/tracking?adUnit=391466&auId=5a5a5d7f-bd03-4ef6-8dda-f36fce205e3e&bidId=15000&bidderId=4&cmExpId=LV1&oAdUnit=391466&publisherId=162645330&rId=998aceeb-8a7b-4dcd...
https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=bacc3d1ccc1f4c62950eb0c1f6ffdf91&SNR=1&GV=2&med=10

0
243 B

34ms
34ms

Image
text/plain

2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=bacc3d1ccc1f4c62950eb0c1f6ffdf91&SNR=1&GV=2&med=10
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:10 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EE9DF8468A214CB4ACA2AA42619B057C Ref B: FRA31EDGE0717 Ref C: 2023-10-23T02:00:11Z
vary: Origin
x-cache: CONFIG_NOCACHE
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
cache-control: private,no-store
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
date: Mon, 23 Oct 2023 02:00:10 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F1EDE31068A040BCA176D06C525032C8 Ref B: FRA31EDGE0717 Ref C: 2023-10-23T02:00:11Z
vary: Origin
x-cache: CONFIG_NOCACHE
content-type: text/html; charset=utf-8
location: https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=bacc3d1ccc1f4c62950eb0c1f6ffdf91&SNR=1&GV=2&med=10
cache-control: no-cache, no-store, must-revalidate
content-length: 154
expires: 0

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/239/ Frame 7553 80 KB
28 KB 51ms
6ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/239/trk.js
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Expires: Wed, 10 Jul 2024 11:56:20 GMT
Date: Mon, 23 Oct 2023 02:00:11 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 8949833
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27646
X-Served-By: cache-lga21944-LGA, cache-fra-etou8220063-FRA
Last-Modified: Tue, 11 Jul 2023 11:56:12 GMT
Server: AkamaiNetStorage
X-Timer: S1698026412.682642,VS0,VE0
ETag: "615fd4ad24a409f4de5416b603f042c1:1689076572.555276"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 5, 990985

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/ Frame 7553 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/window_focus_fy2021.js

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 18:09:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28270
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Nov 2023 18:09:01 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/ Frame 7553 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231017/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f74f99e9fe1027d19c741e71e7a2adf40f49a011d50cb110e45a0511f624fb3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 00:02:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7057
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8427
x-xss-protection: 0
server: cafe
etag: 8504628880869859743
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 06 Nov 2023 00:02:34 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7553 0
0 15ms
14ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaROzEJds4RMfuexk0PuLOaSBItYpEmChOpFzPFAnIHYi6UI-yebHnbOEljR9DaI0vIJ80AzbUyedx-WCy9RAqlEI7_f3w
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 7553 24 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 06:34:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 242762
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 19 Oct 2024 06:34:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7553 187 KB
59 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

100e1bd433b0fbe35e8d609395d4f9a1cbafbeddb64a30b6ac6fcc7888f9310a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60178
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697628223465749"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2344 0
0 45ms
45ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu7Yq8SIHqE-Khf4kVSNTbb-CgxFu_9PvBP6gYq01tXDhbLqodeE4kANfMM_8Lmg7pzp1PTC6EttqVwZBE-uDTrqWULzN-YBjnT-13n-47xMbm-dU2VAMKmrM6Cmjq63Hy3q4Jfq7OgWEJp0TM1HjJDBO_Fd_lA1pvfZczZuq0Ob880I3AH0KfFEhEiXLlPF3572A03CY1BzPA33x5pCjroqSyopHyr8xpMsIhWPJ57dJYB7CRtGLqKqjnEFl1YW6aXbR49m9v_VcG8ZmAQN8JGgTWSFFvQp0v-5QkacL1Yele5WEAZEaVVhDoHQ1z1e5fNEJcy1YeT14WwsNjkprmI69W5FEk4XUxwE5lwBXWopcYOA-DM10puUHREPBmDOFoqLDw3i-FD3sBuJohI19sCe4FLbHNWFzO-oaB7tCLrZAOJF3QvHCLLRRVRQ_AFUUCKbhyNZ7D8TIhf5XwkvgRgxVY_u27qPSHgDsCKEheXSs9wI3Uzuia7XNNpjcfrzKueXE9IwduyXVrPO6e48X7IXvVUfV-zBQcxK-SWbX6yY7naJNqczTowa__2z5e8_VRMtj0fxE5gevaSLoOFZkY8W839RUuDkHkeB9Q_7tUvCECFnL44wzHOyhp5elK7YpPrnyXMZlgwlFPF803eCx3-KyLPj1fGQsgOaJZ5_FAlMujqHeMHhnDJpQI53tuQg2li7PUmm94bKn7b8HHrjxOHTIzJNly8AyD00-S-tJ_G2FrkYPQIiCa_5_vLhXkn7P4zYxtV_m9LYfCvSLaivLhAxjXuXt8RhBDfXnChAlWADICJ8O1rWZXQEshjkF0hj0FqiDqJk1EF14C6BjuGAY9MlRMUXx7UyZggP6byCVVBEJNbLviWf2fa4P77jhAph7X4rFMFONtnX0Y-xTLwRyeViHem4DC4CIMlnldWEgs7D4pmT_4P67wd0gtC4nJwNbBTJk3kIiBTXXj7IbUSt8haBWRb15nbmwlIkqj47r1m3Cz_PIX-ITkKMu_i17SSVFd5Bo0rOOlC_mVo8g0uWBGRf-KBPI3e_6_FjvZ0UCtS1bfM77UMPdiSAKAgaut9BMrUC3h3OysOJDJiviBIKVLAgBNNCU2mpGF6KdjlmhSXN9arn7VwdPxeYqt9ZfZKtfJwarNMWve8BtlDkA4yHO-FmerMvscfI30Dkp3FuGVkgvxpRbeGQCerx4CCC7rWI68hxxoSdXCYKB9gCpZ55PNbKyLR1nehyIYyStN8ymbj-Xnz5p31KxK0lN_C_nLpCQ7k4ALNw_iFoPN4ERHCjLSVY0085VBrZ8hzBXalN3VhWWfkUuFIIdw0AKB6jA5cWOnccI9BLLfC28LfCV8QsNHeVJ9DKPRtMkUEn4_T&sai=AMfl-YTqcclCdMqfBEEi9dSkQ3CmXmapKFG9lOo3jLPbndGmXoM62AAdeaQPtwudcbHG83wqyuni9U6Q7ASFcH0Ev8VXYL2Uu-aDb-fCTA60rfsLeBCiZhxp9f5wkfV7oQmyA-cNs_jOkI04xe9tzNGP1RQXCNoP8LjyVgql3UChJfAAC-ktJlIWpX6oXjwcWkoSjRLkR_FNsekSzrA3QyJv_7mcOPmwtOVvmrbNfcI_M8txRtfwW29hgdyATMmCvEToX2JowNPyagHYw2lkBMg8zHf0dniPG1_BrSdRSWquornv4waIOsMNrOV15E75f9NgjtXhocFc308BSRKbTfV7DQUsK6aQ-Q5AJHQXgeEzWgeIUq_uDf-hVW0GGUUMa-AjwuaLKwfZEEfl9FW5gGkpB4yE53Vx&sig=Cg0ArKJSzI5Hf-kd8AcDEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=344&vt=11&dtpt=283&dett=3&cstd=51&cisv=r20231017.63107&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.clien.net
URL: https://www.clien.net/service/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 7E81 7 KB
6 KB 22ms
21ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

91d11bf1833d2607f46787dab5c548737a1867488e9f252fa1a65acef3b7afc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5678
x-xss-protection: 0

GET
H3 200 gkc7GkOx0NjYAbDEAjG_3nA6cC9mq0x3jEC3r4qNpAU.js Show response
pagead2.googlesyndication.com/bg/ Frame 1DBC 37 KB
14 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gkc7GkOx0NjYAbDEAjG_3nA6cC9mq0x3jEC3r4qNpAU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82473b1a43b1d0d8d801b0c40231bfde703a702f66ab4c778c40b7af8a8da405

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 18:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 460600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14604
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 18:03:31 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 3 KB
964 B 11ms
11ms Stylesheet
text/css 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0fe0a4de30a9ca6fe30247b407e06e71e10863fc8511348dd364e6356abeb2cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 382405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 935
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:46 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 46ms
43ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310180101&jk=3655641391744338&bg=!0tGl0Z7NAAbDUgby41I7ADQBe5WfOFRDQ05zbfXfyEjgnnVqZuv_KDYQ2XKwrm9whB138oZEAWiiu4WDEyZyi7D1wdzNAgAAAHFSAAAABGgBBwoAgwHQcte7ISWHog1yIF954lTF8ILq10LXNFE0YzNWgRcLt1aL6MjmysBP0yYuetL4E_O7XjhBXkWfXT0xECzi3UC8EgiLwdvIO9SBX-O09HONH7Cq1B4qlwROGpkpmXOLHGuAi9m6bl1CczsdhYgxBeeHOqKkd_kbnSDCldm5Mmy4RRx1mQK62mM1xrgfG4ESekspcs1eJiy463VyJxKQ-gbIBKj3WWm7px-73zisMsUuiQGJ3viyKDX5ppTgoJ6hK1IWZ-wyOfuZwAQ3-7G3DTN-SJ36xppjtbBRgZXZpusLCPgQkYJvzyFvdynEkAGjIDjMzVuOHqd7hHLsHvZ3_xT188tHEwjwwLe4nK8en_HX4COgpRJ4Ahh38tuNct0MXC6TG0ebZjfiJo6JCbGkWdK_HCGT5k0sLcUd6VowJ7TGnuyGkvkKU6vbzSrq-iMEeo0zHMrTSSOTEHxbtOUAY1VwsSsqrfx7ehwK_R4wxSjfUB3TkmR3_PFUJyKk-15B8A-8NgzjHzo1zvHQbE3Mtyui3az8ClTo_8q9mlk_dlNADVf6PEXrcycKThJKfBl2VZieVepaydhhjLE5ISIOgBZWd4kH2VihvQXmCL6CRiOKibTHKfUkfUJMsA4JFKacdW8_l1LBrZ-UPqsSXEEFz7-G0LiO3Izd0GmVtfOwNcGqRJsw9YkeCw9VDYpQ0vcnfvNxfjF03_9I_iQbl0qSX8Tj4KJqJXkpAVOc-JBsTZDJW5EUBWh_3uQCCw6817-5HejlWAItDNikpIZtKQxhR4hqbmBArctfbBWENOgNabz9URkBf8PLk8I5j3sYaRT0HvNB_EJQf_EvdhN2U94CVvd2ZcVVWX88CKyApZgHHjAxcmSePiwUI-VZaQ-cSoBMH4kPdQhCGI8podS0uBxhSBmuQsc2BMq_2WHoBYZKeU9eRqWoI4WZlghlAeSKOMCzXKx-TeL_G7-qw7pPlCk7LWzokXBmK7yiYbVe3_gzOx6sWpnKH2AxfxBuNU77sFzPncnXNqVu_RHIZdu4i-YlYLBnCuwLHXOS5kwkjlQ1-zu9t22DPo5ycOZEaqu3WbSqvcymwHGoG1e4qfxnN25Pm6M
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.clien.net/service/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

GET
H3 200 main.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 0A93 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:48:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 731
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1100
x-xss-protection: 0
last-modified: Fri, 05 May 2023 10:07:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:03:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 0A93 8 KB
6 KB 21ms
21ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fe8e2b222e2f225d71107775e3e8cb2c03a0542dbe420d233195f47fdb900e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5918
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 7E81 17 KB
6 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 5 KB
5 KB 7ms
6ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7a670239843e8c404a2c032bb7a9184436f712ecbe80a847164c187b188a6c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4981
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 cta_1.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 1 KB
1 KB 7ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/cta_1.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c88cf30ae17d78200a53262eb938803f2804f41dfee3ac2c96364db1ce98c53d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1037
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 cta_2.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 1 KB
1 KB 8ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/cta_2.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6923811752ab2606a6a6da3c8e1653dd1c84823eaef1bd6d4360e44cb31c5b71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1037
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 0A93 17 KB
6 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 23 Oct 2023 02:00:11 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 87 KB
87 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/bg.jpg

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3670deef6dfb77138cca9efd3a87c55bc157fe4874234993d36eb23a6e84afb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 17:48:51 GMT
x-content-type-options: nosniff
age: 288680
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89009
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Oct 2024 17:48:51 GMT

GET
H3 200 copy_1.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 3 KB
3 KB 10ms
10ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/copy_1.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2da1d4353ce0711e258bf7e3adfd7344615915c29bdafc30f951ed9bb1c026f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3240
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 copy_2.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 2 KB
2 KB 11ms
10ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/copy_2.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98a0c858efc7209652c1b6f5b22b80421fc6e2be11066edd68a7f4630396f29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2364
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 copy_3.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 5 KB
5 KB 11ms
11ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/copy_3.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89978892b874e84c91f11e60d66d7533739bd51fd097875d0c5f74a4d2d550e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5389
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 terms_legals.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 11 KB
11 KB 12ms
11ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/terms_legals.png

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31c7c97360cd9d069fff4323ab676d5603ec148d1bf7d5d45646a92f27c7949b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11669
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 160x600_de-de_performance.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 0A93 77 KB
18 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e18cea66471edc5320998d672b959d6be4dc3137b0953f4eef7fde86f8a5956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:48:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 687
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18841
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 07:28:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:03:44 GMT

GET
H3 200 cta_1.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 1 KB
1 KB 7ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/cta_1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c88cf30ae17d78200a53262eb938803f2804f41dfee3ac2c96364db1ce98c53d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1037
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 cta_2.png
s0.2mdn.net/sadbundle/2725098245878711576/ Frame 7E81 1 KB
1 KB 8ms
8ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2725098245878711576/cta_2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2725098245878711576/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6923811752ab2606a6a6da3c8e1653dd1c84823eaef1bd6d4360e44cb31c5b71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2725098245878711576/index.html?e=69&leftOffset=0&topOffset=0&c=ASyfu2lHjO&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:46:39 GMT
x-content-type-options: nosniff
age: 382412
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1037
x-xss-protection: 0
last-modified: Fri, 08 Sep 2023 15:29:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Oct 2024 15:46:39 GMT

GET
H3 200 kdR3Uc-Lch-XuU6BJZRbuWDa0aJJ9it8wzNxgvcOl3M.js Show response
pagead2.googlesyndication.com/bg/ Frame A60E 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kdR3Uc-Lch-XuU6BJZRbuWDa0aJJ9it8wzNxgvcOl3M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91d47751cf8b721f97b94e8125945bb960dad1a249f62b7cc3337182f70e9773

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 18:05:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14703
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 21 Oct 2024 18:05:50 GMT

GET
H2 200 th
www.bing.com/ Frame 7553 20 KB
21 KB 11ms
10ms Image
image/jpeg 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bing.com/th?id=OADD2.10239328756918_1PFQEYS103NB2Z7X2&pid=21.2&c=3&w=379&h=198&qlt=90
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ab12d29c7e803e1ec698b5d1d11935e74f2d61478c28de8ff4de353836e4d286

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:11 GMT
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7B464AC3DA3D4671A07B3A2E533034DA Ref B: FRA31EDGE0717 Ref C: 2023-10-23T02:00:11Z
access-control-allow-methods: GET, POST, OPTIONS
x-cache: TCP_HIT
access-control-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
content-type: image/jpeg
cache-control: public, max-age=2592000
timing-allow-origin: *
access-control-allow-headers: *
content-length: 20626

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 52D1 43 B
215 B 177ms
176ms Image
image/gif 2600:1f13:800:7782:b1dd:230f:9cbe:e84b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1533729&asId=6911ec0a-519d-a52c-6f47-717c6c3e4a8b&tv=%7Bc:rPEpMV,time:467,type:e,im:%7Bpci:%7Btdr:194%7D,imprf:%7Bttecl:497,ecd:122,tsecr:131%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:467,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:24,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B461~0%5D,as:%5B461~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTtfM8i+11%7C12%7C13%7C14%7C15*.1533729-75300605%7C151%7C152%7C153%7C154%7C161%7C162%7C163,idMap:15*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:25,sis:279%7D&br=c
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:b1dd:230f:9cbe:e84b Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
server: nginx
x-server-name: dt23.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 kdR3Uc-Lch-XuU6BJZRbuWDa0aJJ9it8wzNxgvcOl3M.js Show response
pagead2.googlesyndication.com/bg/ Frame 2AEB 37 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kdR3Uc-Lch-XuU6BJZRbuWDa0aJJ9it8wzNxgvcOl3M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91d47751cf8b721f97b94e8125945bb960dad1a249f62b7cc3337182f70e9773

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sun, 22 Oct 2023 18:05:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14703
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 21 Oct 2024 18:05:50 GMT

GET
H2 200 rd_log Show response
ams3-ib.adnxs.com/ Frame 7553 0
647 B 46ms
34ms Script
text/html 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.clien.net%2Fservice&e=wqT_3QKDBOgDAgAAAwDWAAUBCKun16kGEO7Ix7Lopf6qUBgAKjYJAAAAYWiRzT8RmpnZU1OuzD8ZAAAAAClcCUAhmg0SACkRJNAxAAAAwMzM3D8wuuW3Azi1AUC1XkjjA1C6iYq2AVj9vT1gAGjcAXjx9QWAAQGKAQNVU0SSAQEG8E-YAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBDjI1NjgtY2xpZW4ubmV02ALwBuACwrox6gIdaHR0cHM6Ly93d3cuY2xpZQUh8GEvc2VydmljZYADAIgDAZADAJgDCaADAaoDAMAD2ATIAwDYA7msOOADAOgDAPgDA4AEAJIEBC91YXCYBACoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAfAEugHXVIgFAZgFAKAFhemf-sbw_MVqwAUAyQUhJBgAAPA_0gUJIUIFAXDYBQHgBQHwBfnaS_oFBAgAEACQBgCYBgC4BgDBBgUiMADwP9AGwo0E2gYWChAJEhkBAYtg4AYB8gYCCACABwGIBwCgBwHIB_H1BdIHDRVlASYI2gcGAV6kGADgBwDqBwIIAPAHh-MCiggCEACVCAAAgD-YCAHACPAG0ggGCAAQABgA&s=e4c62e8bb8cd9bffe8ac7d3f8b3c7f9eadb4d0a9&bdref=https%3A%2F%2Fwww.clien.net%2Fservice%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.clien.net%2Fservice%2F,https%3A%2F%2F2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:11 GMT
an-x-request-uuid: a0035625-ca20-4ae3-a250-7cde6d3c36a8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 star_alliance.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 0A93 6 KB
2 KB 8ms
7ms Fetch
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/star_alliance.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

563d8b655debf02dc76ee9cad7e2114692c770d009bfc9ed1f9153eb384593d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:50:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 596
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2334
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 11:06:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:05:15 GMT

GET
H3 200 lh_logotype_single.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 0A93 5 KB
2 KB 9ms
8ms Fetch
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_logotype_single.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7502e785bdc8f7184cab7e278053c49be4458393085eb2fbddabf35b895c310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:50:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 606
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2151
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:05:05 GMT

GET
H3 200 lh_crane.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 0A93 2 KB
1 KB 10ms
9ms Fetch
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_crane.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d2067d4b9b5b9d3003ffa4dc17b44616dc00a543f59eea17df555e959f20b53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:09:53 GMT

GET
H3 200 NH_D_NA_Los-Angeles-Palms-Indian_160x600.jpg
s0.2mdn.net/creatives/assets/4703548/ Frame 0A93 49 KB
49 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4703548/NH_D_NA_Los-Angeles-Palms-Indian_160x600.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aacabf18ca50818c4598de6f5a05e4c32a0c89a1e3ee39ced2b5fe758c9acaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:50:54 GMT
x-content-type-options: nosniff
age: 557
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49691
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 09:07:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:05:54 GMT

GET
H3 200 LufthansaHeadWeb-Bold.woff2
s0.2mdn.net/creatives/assets/4714589/ Frame 0A93 50 KB
50 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4714589/LufthansaHeadWeb-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a43c20863b324fe2bec355b5ebdc6566861742f92018f12be1b38fa2c8b7767

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=J2pfsPO2Ed&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 01:46:56 GMT
x-content-type-options: nosniff
age: 795
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51548
x-xss-protection: 0
last-modified: Fri, 18 Nov 2022 11:46:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 23 Oct 2023 02:01:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5227 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2u16q9M1ZdL0BujZx_APicG0sAwAAAAAOAHgBAI&bg=!IyClIG_NAAY5nEQaGZw7ADQBe5WfOF4NhKLJDDY_Ijz-kijHFx62mmVTgqAFI2taVpAhQIhJaixq1GwS_2LAVYRcCz7cAgAAATxSAAAAA2gBB5kDEuYRdlPli1Xh6_xkZxZrOexKIoieW-R77Mh6u_CqxfMCaCs0oclb7J10EsvkTD92X35pO-17lbrGtOrLDWDzvAz4InouFxmiN0wjcwbExw6BNL-NaUxSdD-nTHrCtNAHZPLGMFIOQkMerib2N88HsZieJJdjn2Ub19P4ILzbIOsBP5RSRnEsa5dqy-EC-yM-FnlY0rrTCX9UAYiBQth3G5R6v01MTQMAbAZtUDHcd-Ww3ZU1KLwdolgbUNjexuVcRfEhw5oUgGvd6w2PF-GvGC7L7tzNI6SnpfAtlXzbpnpfY4ITpzrLVY2p6ohfm_q_TI3czUJMbKEzbkXTm1_weDJifOMLs_DZSJ4jSvXhdXZh8cmKviLHQ6PTTsoK-QS8i91cSXFImP1nyGvGqrPR8ly86JJ3S4aX6IRZT-mxhCunDsS7r4WERKkRyw8oR6SnPkoZ9my6LwPDvBHccRtzaygVTWOUy7dXtsV6pdl-NvG_cBm4g4lhJqVQelb42rNN4duE47YCGPcq34GPby2OJK0P_mheqJs0e3me4uQ4ulyL9MkIo6X1g51smprYkw6VJMqmftiykNnfUJYjLhGcVB7BGgG6utAk9T1h3hY4QIJs8nTha2U-Wv7YgERZb9nz3BEI898rTMGG7zIFgqZEpNLKClyYNboqq1Z8jFOcUT4ajbJtsQHJn5rxTQuZbvHHsuNsnJsaty6Ufg-rTJhV11LfM6tB4_0PFpOmw2pGKRTDXYBz7caTxG6t5r2JIKdaIeJ4F8kuFvYdWR_N05dxK60A4NqUKRfPn9Rbpv50sQz31AHWKekc_0ii2dEcqCXnMVi-PAHd1iN3DtEo2Dr2OsQ82KiAQAFios9Mviv_pG7ceWvJiYfVmFV3jauXNO6O4WkbjrU9MEiUfOgKcfHPVYzOJHwA_QF1Rfpfe1T5Q9xcRWjIiD7PQMGrekanTakKYkailyVLkP2x9MEh_cHMQzjag3lUa42dbVb9D_b1IqFtXDTRZVH9KocxEhVICqNPmw4tRNR9EXP8tFoI2UhmbYOB4Q

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F66E 42 B
64 B 51ms
50ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss6ORvprOuonhy-7K93DbODtpdMiJdNNIO6vXUswgNfNLG4XOCNK95aGgvxLl1L2zNYaVadTDn39XLaO5CnowMbJG5yyGk7eXTgE4yw-4RjK8lsRLAzYIXtXVINoQkBVFAYB7uaRO7Uhx-m&sai=AMfl-YTvf-NLY_rt84gDY4erjzwWuNczWqT9Q4z9d9DqWyKDeAB9RCyWj3uV7PJotbWefkrG_nxkIUdITYSPEdkknq2n-JxHqbgcQqTnsRBrkUaa0iEwCWMOu0HcCjZX&sig=Cg0ArKJSzL4NiUAoSkIxEAE&cid=CAQSPADICaaNJiltVttNhzy4up2y6IpakkHW3W7ZCFLrAKTi7B8mFWiu2EY9-i6MZrYmNUmW7UyIY-i5aCR59BgB&id=ampim&o=358,184&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1067&mtos=0,0,1067,1067,1067&tos=0,0,1067,0,0&tfs=145&tls=1212&g=100&h=100&tt=1212&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.clien.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 52D1 43 B
215 B 178ms
177ms Image
image/gif 2600:1f13:800:7782:b1dd:230f:9cbe:e84b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1533729&asId=6911ec0a-519d-a52c-6f47-717c6c3e4a8b&tv=%7Bc:rPEpQn,pingTime:-10,time:681,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE4LjAuNTk5My44OCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1698026412067%7C%7C5b76b76686413d9d22ba4d26650b5478%7C%7Cafe098ab9930c31009b81b3a08e6b29a%7C%7Cef2bbaac215a6d13f5ed22f800fd1f29%7C%7C1107eec792024c3ca236da7f2ce98191%7C%7C71429c6f1d0efafd1851453d780f1632%7C%7Cf3e0cdd84a0e19d0405aeb8647b96004%7C%7C8172150c4913956c9975dc3adddc6334%7C%7C1663701684%7D
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7782:b1dd:230f:9cbe:e84b Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
server: nginx
x-server-name: dt10.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CAF7 1 KB
643 B 8ms
6ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59408
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 Oct 2023 09:30:04 GMT
etag: 48472445140208031
expires: Mon, 23 Oct 2023 09:30:04 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7553 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed5fb3d99d2cf669bb8bf34f2962bf42004cde0b34c8667983bff21b67aa0331

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 vevent
ams3-ib.adnxs.com/ Frame 7553 0
698 B 13ms
13ms Ping
text/html 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.clien.net%2Fservice&e=wqT_3QKhB-ihAwAAAwDWAAUBCKun16kGEO7Ix7Lopf6qUBgAKjYJAAAAYWiRzT8RmpnZU1OuzD8ZAAAAAClcCUAhmg0SACkRJNAxAAAAwMzM3D8wuuW3Azi1AUC1XkjjA1C6iYq2AVj9vT1gAGjcAXjx9QWAAQGKAQNVU0SSAQEG8E-YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBDjI1NjgtY2xpZW4ubmV02ALwBuACwrox6gIdaHR0cHM6Ly93d3cuY2xpZQUheC9zZXJ2aWNlgAMAiAMBkAMAmAMJoAMBqgOaAwqwAmgdM_CGYmluZy5jb20vYXBpL3YxL21lZGlhdGlvbi90cmFja2luZz9hZFVuaXQ9MzkxNDY2JmF1SWQ9OTk4YWNlZWItOGE3Yi00ZGNkLWExMTgtYjMzNjBlYzJmOTRlJmJpZElkPTE1MDAwJmJpZGRlcklkPTQmY21FeHBJZD1MVjEmb0FkVW5pdD0zCVxUcHVibGlzaGVySWQ9MTYyNjQ1MzMwJgEOADmOcQC4cnR5cGU9bnVybCZ0YWdJZD03MjA1NTYyJnRyYWZmaWNHcm91cD1rbmFxZV8zYyYNFghTdWIJGfDtZXJmcmVpciZhaWQ9JHtBVUNUSU9OX0lEfRIFMTIwODUaEzU3ODg4MDY4NzQyNzE5NjYzMTgiCTM4MTg0NjcxNCoEYmluZzo4VTJWaGNtTm9RV1FqT0RRek1Ua3pOREF5TmpjME1qVWpNak16TmpFeE9EWXhNakUwTlRBd09RPT3AA9gEyAMA2AO5rDjgAwDoAwD4AwOABACSBAQvdWFwmAQAqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBAHwBLqJirYBiAUBmAUAoAWF6Z_6xvD8xWrABQDJBQAAAAAAAPA_0gUJCUHLAQFw2AUB4AUB8AX52kv6BQQIABAAkAYAmAYAuAYAwQYBIQExJNAGwo0E2gYWChAJEhkBcBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH8fUF0gcNYUIFAQEmCNoHBgFesBgA4AcA6gcCCADwB4fjAooIAhAAlQgAAIA_mAgBwAjwBtIICQj___8_EAIYAA..&s=9c1056e68b3c9328ca9bb43b049594871759e244&type=nv&nvt=5&jm=1140|1141|1003&px=0&py=0&bw=478&bh=250&sid=6682549511299870704&vd=ct~0|rr~0&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=7205562&sw=1600&sh=1200&pw=970&ph=250&ww=970&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
an-x-request-uuid: c1a74035-fe78-4beb-a90a-0d605c379e2f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7553 0
0 54ms
54ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CSpTFq9M1ZaKnCumB9u8P-KOQyALS4Nfgbo-ktpOTCsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MDI4OTYxNDAxNDU2OTg3yAEJ4AIAqAMByAMCqgTxAU_Q_O1xZeUhWuVq6wmXgv2ruXfBGmgL0DSBEyCGPL0nVhCjLCAPPBOcVy1_nFnEcR1WF00QoxOkQhxqaXqGdxiaynTdV59jlKb94ZV_EdfZ0dITRo4M-x9JBrvkW923dEBLJR6m4cQOd4a1NghF_IRikuDY8loC27rqGLs2U-J7LCwsWJVFMlz9JCJ5g-Xc5-L9faEVdSmRc6bKyHLQwC7Srfw_Ko7f4Xcn3oFULlbnwyYwQ8oPK3A-zfa723MKEMNF5ItRq88y2exrxnawnNiWQxZbXhIYvlIecdBWRx3UlASJwMt7_AxUaQHrCuVMDw3gBAGABsDSn4bIuLH48QGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTqACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODAyODk2MTQwMTQ1Njk4NxiuzRA&sigh=c6vPG2FAC_g&uach_m=[UACH]&cid=CAQSOwDICaaNgxuYISVaGdQUzj_7jMEBmlXPmrR1Y3_3DrAmdryGr2Zh2X9UTc7Yx2drsUT6FVjzA_NWkJ0JGAE&cbvp=2&vis=1
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

GET
H2 200 it
ams3-ib.adnxs.com/ Frame 7553 0
648 B 14ms
13ms Image
text/html 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams3-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.clien.net%2Fservice&e=wqT_3QKhB-ihAwAAAwDWAAUBCKun16kGEO7Ix7Lopf6qUBgAKjYJAAAAYWiRzT8RmpnZU1OuzD8ZAAAAAClcCUAhmg0SACkRJNAxAAAAwMzM3D8wuuW3Azi1AUC1XkjjA1C6iYq2AVj9vT1gAGjcAXjx9QWAAQGKAQNVU0SSAQEG8E-YAcoHoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAPoBDjI1NjgtY2xpZW4ubmV02ALwBuACwrox6gIdaHR0cHM6Ly93d3cuY2xpZQUheC9zZXJ2aWNlgAMAiAMBkAMAmAMJoAMBqgOaAwqwAmgdM_CGYmluZy5jb20vYXBpL3YxL21lZGlhdGlvbi90cmFja2luZz9hZFVuaXQ9MzkxNDY2JmF1SWQ9OTk4YWNlZWItOGE3Yi00ZGNkLWExMTgtYjMzNjBlYzJmOTRlJmJpZElkPTE1MDAwJmJpZGRlcklkPTQmY21FeHBJZD1MVjEmb0FkVW5pdD0zCVxUcHVibGlzaGVySWQ9MTYyNjQ1MzMwJgEOADmOcQC4cnR5cGU9bnVybCZ0YWdJZD03MjA1NTYyJnRyYWZmaWNHcm91cD1rbmFxZV8zYyYNFghTdWIJGfDtZXJmcmVpciZhaWQ9JHtBVUNUSU9OX0lEfRIFMTIwODUaEzU3ODg4MDY4NzQyNzE5NjYzMTgiCTM4MTg0NjcxNCoEYmluZzo4VTJWaGNtTm9RV1FqT0RRek1Ua3pOREF5TmpjME1qVWpNak16TmpFeE9EWXhNakUwTlRBd09RPT3AA9gEyAMA2AO5rDjgAwDoAwD4AwOABACSBAQvdWFwmAQAqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBAHwBLqJirYBiAUBmAUAoAWF6Z_6xvD8xWrABQDJBQAAAAAAAPA_0gUJCUHLAQFw2AUB4AUB8AX52kv6BQQIABAAkAYAmAYAuAYAwQYBIQExJNAGwo0E2gYWChAJEhkBcBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH8fUF0gcNYUIFAQEmCNoHBgFesBgA4AcA6gcCCADwB4fjAooIAhAAlQgAAIA_mAgBwAjwBtIICQj___8_EAIYAA..&s=9c1056e68b3c9328ca9bb43b049594871759e244&pp=ZTXTqwACk6IH_YDpAAQR-JdYCqXrM7hARfll-A&ppt=1&pubclick=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCHgoKq9M1ZaKnCumB9u8P-KOQyALS4Nfgbo-ktpOTCsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MDI4OTYxNDAxNDU2OTg3yAEJ4AIAqAMByAMCqgT0AU_Q_O1xZeUhWuVq6wmXgv2ruXfBGmgL0DSBEyCGPL0nVhCjLCAPPBOcVy1_nFnEcR1WF00QoxOkQhxqaXqGdxiaynTdV59jlKb94ZV_EdfZ0dITRo4M-x9JBrvkW923dEBLJR6m4cQOd4a1NghF_IRikuDY8loC27rqGLs2U-J7LCwsWJVFMlz9JCJ5g-Xc5-L9faEVdSmRc6bKyHLQwC7Srfw_Ko7f4Xcn3oFULlbnwyYwQ8oPK3A-zfa723MKEMNF5ItRq88y2exrhHSRDhoyuXvPpGatIAuax9R1TZnduhxQYk0ieLDUQy3zymSuYpnxr6fgBAGABsDSn4bIuLH48QGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_10qfMqxwwaaMa4-sZKXyZAbKLkUg%26client%3Dca-pub-8028961401456987%26adurl%3D&cbvp=2

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
an-x-request-uuid: d56cb429-abaf-4e43-90ee-a8d645477ce3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.133; 138.199.38.133; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAF7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlRYVHF3QVp5NlVWckFBTg==&google_gid=CAESENv2RCj1fO-y4BoG1MpPrk0&google_cver=1&google_push=AXcoOmS8WdMWhPh59Db4hUKAeBgEU0uMT1...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlRYVHF3QVp5NlVWckFBTg==&google_gid=CAESENv2RCj1fO-y4BoG1MpPrk0&google_cver=1&google_push=AXcoOmS8WdMWhPh59Db4hUKAeBgEU0uMT11HTKbVnNQ8UMivmya01ly19iOnYJhlY8rPLRvDwoKZPS2J1HAF2bhgXs_i_NoOaK3m

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220069-FRA
pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1698026412.227176,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlRYVHF3QVp5NlVWckFBTg==&google_gid=CAESENv2RCj1fO-y4BoG1MpPrk0&google_cver=1&google_push=AXcoOmS8WdMWhPh59Db4hUKAeBgEU0uMT11HTKbVnNQ8UMivmya01ly19iOnYJhlY8rPLRvDwoKZPS2J1HAF2bhgXs_i_NoOaK3m
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAF7
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEP67PCXETo4CG8YTsfdyfMk&google_cver=1&google_push=AXcoOmQ1i92ZYwR7HWGE8t8waiK5Gc8d7xYLOPyoOZkEc_k2Iku8Khqn10BfYTlWVB1WPfAytzSvcLei8smlTpBI3EkUwqb...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEP67PCXETo4CG8YTsfdyfMk&google_cver=1&google_push=AXcoOmQ1i92ZYwR7HWGE8t8waiK5Gc8d7xYLOPyoOZkEc_k2Iku8Khqn10BfYTlWVB1WPfAytzSvcLei8smlTpBI3EkUw...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ1i92ZYwR7HWGE8t8waiK5Gc8d7xYLOPyoOZkEc_k2Iku8Khqn10BfYTlWVB1WPfAytzSvcLei8smlTpBI3EkUwqboEx4

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ1i92ZYwR7HWGE8t8waiK5Gc8d7xYLOPyoOZkEc_k2Iku8Khqn10BfYTlWVB1WPfAytzSvcLei8smlTpBI3EkUwqboEx4

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ1i92ZYwR7HWGE8t8waiK5Gc8d7xYLOPyoOZkEc_k2Iku8Khqn10BfYTlWVB1WPfAytzSvcLei8smlTpBI3EkUwqboEx4
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 dds
rtb.openx.net/sync/ Frame CAF7 43 B
94 B 17ms
15ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEAxxi7inNttkpT39MuHzNoc&google_cver=1&google_push=AXcoOmTcM3U-EUsDoZq8xiZ2hzXyJYtYej2qzLaPGUz4aguaSZ7FHlX_82-ZO5vPMae2n4qEoqBfEQZdeQJlKIYeU95zpXoCm_0
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame CAF7 0
237 B 88ms
33ms Image
text/plain 2600:9000:211e:200:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEFdgUvdyReHu3e0VWUybhCc&google_cver=1&google_push=AXcoOmTCOaMYivI8CeemWICf3HdZfUN9i8aIXT8jXj1EUYfywoonmneXRXlifD5xmYSzcWrUmi1KTpkGhZ_DSdeemGACRRyrnnOd
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:200:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:12 GMT
cache-control: no-cache, must-revalidate
via: 1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: 5uV3NT_FnmKJWumQNDcDe-ssNPpns8F1TYAYXhE8Wzjzv2RvhLhqvw==
x-cache: Miss from cloudfront

GET
H2

200

report
sync.teads.tv/um/ Frame CAF7
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEBMOdIJhwE2X...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmQk5mjYqmIXx1ObmQnMILcwFkVrZ4CiaDNqJoQC3zBiR-UmI5eZfkjN4mb7bdvyWspVw4gso5xgtdrGImW43vKgN9PRcgWwSQ
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

33ms
33ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

expires: Mon, 23 Oct 2023 02:00:12 GMT
pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame CAF7 43 B
146 B 205ms
6ms Image
image/gif 3.127.91.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEKcJaK-mNvyn8FTMDW1jxns&google_cver=1&google_push=AXcoOmT7CM_pPgrdN1PtH6nJuUQw6ZCTXLewJntKauxu-e4EQPSHPikizm1fHf8Gw6mcrPfjfA1Jyt_R8_fLQ6eDShzff9PrP9Pd
Requested by: Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.91.113 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-91-113.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 02:00:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CAF7
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=19ca8b2d-6ffa-4473-8efc-d84581d61125&google_cver=1&google_gid=CAESEA9yHxlq7QnWFNPWcdM38q0&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=19ca8b2d-6ffa-4473-8efc-d84581d61125&google_cver=1&google_gid=CAESEA9yHxlq7QnWFNPWcdM38q0&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmR2oRhhKjNJuvtDMTL_XJafDGI0-YeqL1CF52UpaZEGeIW8tgL3v_Z-jhaAsM-wrJhTC6UtlwcW3GV39IPBTQNqmk2KSawo1w&gdpr=${GDPR}

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Oct 2023 02:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=19ca8b2d-6ffa-4473-8efc-d84581d61125&google_cver=1&google_gid=CAESEA9yHxlq7QnWFNPWcdM38q0&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmR2oRhhKjNJuvtDMTL_XJafDGI0-YeqL1CF52UpaZEGeIW8tgL3v_Z-jhaAsM-wrJhTC6UtlwcW3GV39IPBTQNqmk2KSawo1w&gdpr=${GDPR}
date: Mon, 23 Oct 2023 02:00:12 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CAF7 0
12 B 17ms
16ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IctVK-THV9f2dTD7iLdHX_wsgqVXYmPzeGcconSq4MfOusLEppaq4v8EDTKrFVyzc0ak4trJLF

Requested by

Host: 2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com
URL: https://2dd81c140f41c3c2c23b8398cf68eddb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS