x.gd Open in urlscan Pro
104.21.46.170 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://x.gd/fvMWJ
Effective URL:
https://x.gd/view/unsafe/fvMWJ
Submission: On October 10 via manual (October 10th 2023, 12:40:45 pm UTC) from US — Scanned from DE

Summary HTTP 96 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 24 IPs in 4 countries across 16 domains to perform 96 HTTP transactions. The main IP is 104.21.46.170, located in and belongs to CLOUDFLARENET, US. The main domain is x.gd.
TLS certificate: Issued by GTS CA 1P5 on September 19th 2023. Valid for: 3 months.

This is the only time x.gd was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 22	104.21.46.170 104.21.46.170	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::282	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
19	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3036::6815:1123	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
1 2	52.30.24.178 52.30.24.178	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
3 4	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
2 4	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	37.252.171.149 37.252.171.149	29990 (ASN-APPNEX) (ASN-APPNEX)
1	64.233.184.156 64.233.184.156	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223f:ca00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2600:1f18:1ac... 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b	14618 (AMAZON-AES) (AMAZON-AES)
6	2a00:1450:400... 2a00:1450:4001:828::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
96	24

22 104.21.46.170 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

x.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v2.x.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::6815:1123 (United States)

ASN13335 (CLOUDFLARENET, US)

v01.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.24.178 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-24-178.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.212.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.27.193 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.171.149 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.184.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wa-in-f156.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:ca00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 tpc.googlesyndication.com — Cisco Umbrella Rank: 157	414 KB
22	x.gd 2 redirects x.gd v2.x.gd	452 KB
13	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 cm.g.doubleclick.net — Cisco Umbrella Rank: 255 bid.g.doubleclick.net — Cisco Umbrella Rank: 1020 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 443	113 KB
10	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 1153 static.adsafeprotected.com — Cisco Umbrella Rank: 720 dt.adsafeprotected.com — Cisco Umbrella Rank: 658	106 KB
6	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 344	253 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 716	2 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42 region1.google-analytics.com — Cisco Umbrella Rank: 2250	21 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 261	2 KB
3	gstatic.com www.gstatic.com	17 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 223	118 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	1 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1200	598 B
1	v01.net v01.net	433 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	90 KB
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1649	492 B
96	16

	Domain	Requested by
21	x.gd	2 redirects x.gd
19	pagead2.googlesyndication.com	x.gd pagead2.googlesyndication.com tpc.googlesyndication.com fw.adsafeprotected.com googleads.g.doubleclick.net www.googletagservices.com
13	tpc.googlesyndication.com	googleads.g.doubleclick.net x.gd tpc.googlesyndication.com pagead2.googlesyndication.com
7	dt.adsafeprotected.com	googleads.g.doubleclick.net
6	s0.2mdn.net	x.gd s0.2mdn.net googleads.g.doubleclick.net
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com x.gd
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	www.gstatic.com	googleads.g.doubleclick.net
2	googleads4.g.doubleclick.net	x.gd
2	www.googletagservices.com	x.gd googleads.g.doubleclick.net
2	fw.adsafeprotected.com	1 redirects x.gd
2	fonts.googleapis.com	googleads.g.doubleclick.net
2	region1.google-analytics.com	www.googletagmanager.com
2	www.google-analytics.com	x.gd www.google-analytics.com
1	www.google.com	tpc.googlesyndication.com
1	static.adsafeprotected.com	googleads.g.doubleclick.net
1	bid.g.doubleclick.net	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	v2.x.gd	x.gd
1	v01.net	x.gd
1	www.googletagmanager.com	x.gd
1	polyfill.io	x.gd
96	24

This site contains links to these domains. Also see Links.

Domain
chrome.google.com

Subject Issuer	Validity	Valid
x.gd GTS CA 1P5	`2023-09-19` - `2023-12-18`	3 months	crt.sh
polyfill.io Certainly Intermediate R1	`2023-10-03` - `2023-11-02`	a month	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
v01.net GTS CA 1P5	`2023-08-13` - `2023-11-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh

This page contains 15 frames:

Primary Page: https://x.gd/view/unsafe/fvMWJ
Frame ID: 2C994A6A85BD77FA60667AD2ED1EF28C
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/zrt_lookup.html
Frame ID: CF5E06A0E8B6D10DA438DD3D15270BC5
Requests: 1 HTTP requests in this frame

Frame: https://x.gd/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
Frame ID: 222459FE2B782BBB2AC94EB616C63666
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2737572314184878&output=html&adk=1812271804&adf=3025194257&lmt=1696825283&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x1080_l%7C500x1080_r&format=0x0&url=https%3A%2F%2Fx.gd%2Fview%2Funsafe%2FfvMWJ&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696941639434&bpp=4&bdt=2138&idt=249&shv=r20231004&mjsv=m202310020101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2565904527962&frm=20&pv=2&ga_vid=178216782.1696941640&ga_sid=1696941640&ga_hid=625649420&ga_fc=0&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31078598%2C42532403%2C44795921%2C44804782%2C44805099%2C44803793%2C44804179&oid=2&pvsid=3776492909807032&tmod=1452941800&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=272
Frame ID: F59320F17E53D04A1700A89B7A372859
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Frame ID: FD4DFA32EB2703F0C03A0E6A5647E289
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Frame ID: 6A9997C0FAA67854941306ACFF3F0048
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiriqrpATAB&v=APEucNXxd-B7QMNGL2PrmXyP644bXgGP7dCvm1B6cq_P-ibNvKjYpxY5gwvz0LYEukj3dsF8wYjjEJdqTW6Oo-rXWZxXWiVTg1HlNgUdQwAgiKPBCtRN5Q0U7uxKe4w3bFYlsd58_ICc86MQCU-NOlh_okY04ov47vQt__vP-H-1sQwPYSw3Fh4
Frame ID: C5EA5F94664A9AE136BB2CB9C6805A34
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 3066DF9D7EBBB097CE41CD686850D0AF
Requests: 27 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Noto%20Sans%20JP%3A400%2C500&text=%E3%82%8B%E9%96%89%E3%81%98
Frame ID: 900D4DB8A35A00233CDB7C51A7134CB9
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js
Frame ID: 44DE570BA3C3F78D30E64C57D0DC9015
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 73904ACC41961F708ADA64F54C703E73
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 21DF4EDFB60345CE1948EC0F9E5554C6
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250
Frame ID: B641171EADF71F80C4ECFA82C36059A9
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 428878D485A33FC70675DEFCA0D2C4D0
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EE57652038261C9FE672B46A01095343
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Warning | URL Shortener X.gd

Page URL History Show full URLs

https://x.gd/fvMWJ HTTP 301
https://x.gd/view/unsafe/fvMWJ Page URL

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/_nuxt/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Page Statistics

96
Requests

94 %
HTTPS

70 %
IPv6

16
Domains

24
Subdomains

24
IPs

4
Countries

1728 kB
Transfer

4419 kB
Size

15
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://chrome.google.com/webstore/detail/fidojahpeagaflnjjbpkpcajhcbghooh
Title: Chrome Extention

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://x.gd/fvMWJ HTTP 301
https://x.gd/view/unsafe/fvMWJ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

https://x.gd/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://x.gd/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

Request Chain 53

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1

Request Chain 54

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSVGSBrIm8YjrGRWpisVIgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1

Request Chain 55

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEKwY3rX7wstBPSP6RggABHU&google_cver=1

Request Chain 56

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3OTkzODc3Njk4Mjg0MjI0Mg%3D%3D

Request Chain 63

https://fw.adsafeprotected.com/rfw/bgd/1474271/71242846/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-2737572314184878&ias_chanId=1&ias_placementId=20122942208&bidurl=https://x.gd/view/unsafe/fvMWJ&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iiEG4mu_x4BOG4AK4tRRo7&adsafe_url=https%3A%2F%2Fx.gd&adsafe_type=g&adsafe_url=https%3A%2F%2Fx.gd%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231004%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231004%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271801%26client%3Dca-pub-2737572314184878%26fa%3D1%26ifi%3D3%26uci%3Da!3%26xpc%3DO0B0DfjBzL%26p%3Dhttps%253A%2F%2Fx.gd&adsafe_type=be&adsafe_jsinfo=,id:f7ac32aa-5150-5ec6-f2de-b65ae1839a5e,c:qEePjx,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-797d947f74-gcn7t,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:22,oid:388db870-676a-11ee-b329-12cf707ffa5b,v:19.8.439,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=

96 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request fvMWJ Show response
x.gd/view/unsafe/
Redirect Chain

https://x.gd/fvMWJ
https://x.gd/view/unsafe/fvMWJ

6 KB
2 KB

284ms
284ms

Document
text/html

104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e12b805d2a18703922add16c904fb182e55e0d1ebdf9348bd4d0204fed7f7584

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 813eeecf5d21381b-FRA
content-encoding: br
content-type: text/html
date: Tue, 10 Oct 2023 12:40:37 GMT
last-modified: Mon, 09 Oct 2023 06:21:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZmQS%2FM6VH%2Bd1GMZy6zMIEgYRPXfiGs9b47%2FFvXzaRCAJcds4rIGt1k%2FFxMIslTxMeMXtaXvT%2FwDXftzZVQfxcAHADRjVfzwQP4hL3YMz%2BksFYUFbkIcR"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, max-age=0, no-cache
cf-cache-status: DYNAMIC
cf-ray: 813eeecb5fba381b-FRA
content-type: text/html; charset=UTF-8
date: Tue, 10 Oct 2023 12:40:37 GMT
location: /view/unsafe/fvMWJ
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SHecrxToKR85WXVTNcFONv3ZfJbkXAWVB35e1E32FnFIUdPcQZvHSEM%2B71IrbVZ6w4OK8JndsDlp8k7iL%2FyOq2mbGPd7M1Hxmn9ORIDBaYZriPgWgpSJ"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
492 B 83ms
35ms Script
text/javascript 2a04:4e42:400::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?features=URLSearchParams,Object.fromEntries,Object.keys,Object.values

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: origin-when-cross-origin
date: Tue, 10 Oct 2023 12:40:37 GMT
age: 0
detected-user-agent: Chrome/117.0.5938
vary: User-Agent, Accept-Encoding
normalized-user-agent: chrome/117.0.0
content-type: text/javascript; charset=UTF-8
server-timing: MISS-CLUSTER, fastly;desc="Edge time";dur=29
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 113

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 266 KB
90 KB 65ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-K53RX1V2LY

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cddd430daf998a276a353cd4843121656471f245a4b3980e39898cef714074b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91382
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 10 Oct 2023 12:40:37 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
51 KB 134ms
79ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2737572314184878

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e92bb644cf1b22aeb26864f8f977c46fee244a8280e1aa87c39cf51a8095c619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Origin: https://x.gd
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51612
x-xss-protection: 0
server: cafe
etag: 10891050953773903960
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:37 GMT

GET
H3 200 94c6c9a.js Show response
x.gd/_nuxt/ 2 KB
2 KB 541ms
540ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/94c6c9a.js
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71620f57a772c04244170561127e0a11e3d25ad5006cd8c9d952e1b2b1668681

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:37 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 14 Mar 2023 01:51:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd308-9dc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jqHUbKwlUOHsPhDnI2Vyt6VXhbF8I9UQSBYW46V03yjoYiZeszd%2FPaRFeW4cpSeOq5J%2BJKwjWYLq9357j9dMBIhkBgaXYt%2F3TfigbbE2RqxEdsP2WxB0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeed12a6b3a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 64c8103.js Show response
x.gd/_nuxt/ 191 KB
66 KB 1282ms
1281ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/64c8103.js
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39488b5646fd7a7ba52a4e1a67c4655730f91b93c6681524e4c581090fabb716

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:38 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-2fb77"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c3DqMGcz34OBYfnzRkfRMC8kK3Zzk9Vf%2BBKNA7jiczo5bImbU5uCy2lyq6y0Q4gsjgBi3KMUg0%2FCq2EnMt7pR%2FiPnY%2FgrXaZY1X5mqpkZyuyj5QPh0SS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeed12a6c3a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 55d6948.js Show response
x.gd/_nuxt/ 122 KB
32 KB 1327ms
1326ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/55d6948.js
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9d63d94d11e65be863b3a754ace1b9f2fa71e5e874d7b0ad2ca3e9a831cf3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:38 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-1e87c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6hEH%2BUasGkfyXeFMqe%2FU3YQkYuZTriQp6z3YXMmmaF8wn%2F%2BNAH5a46fu7QC0S9o1KqGzFnxzp13Jg0knbqVpM433CzGGtFdxJEVCWaPC9M13%2BKLjFSd0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeed12a6e3a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 9e54e08.js Show response
x.gd/_nuxt/ 736 KB
279 KB 1834ms
1833ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/9e54e08.js
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4bb740ceed140679c16224a106c01352f017684bbbee10376340fcaa8578371b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-b7fe8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QucVc2J6K%2BD1n7kijfrTsUOw62dE3zrAMjCHequ%2BbhNzVld9JLMuy45x2bcKePLKnV9sbGbc8pQgs%2FxmUgJG%2BpT8d6NUFFbWt8YIDCuRhf%2FbYsVEf6rp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeed12a703a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
v01.net/ 0
433 B 583ms
537ms Script
text/html 2606:4700:3036::6815:1123
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v01.net/
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:1123 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:37 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FGPVe4ciacPNwy8lGz0IBEzSDxDgK%2FqNyaaR%2BHq6dTyrTngTO2Pd0kHj%2BtWxxFuXitGRPqZXczSYSboOz7mgV9flRQKMLkI4z5OPEgQTpiDzeC0EUBponbpNnnbHX3XDHPi6v0bM"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 813eeed16872913d-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
v2.x.gd/ 0
277 B 578ms
538ms Script
text/html 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.x.gd/
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:37 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TONv4LUV0b1a1w%2FlEW4DoJj%2B5uDR2ZV6zs3YujU7ZBJpepqPc1Y%2BpDol5JEezB0Gt%2FA9V0VT4H23J%2BlEVGlCwlZxrQgWBkqDXJ5d8JKAeJrzwSblV6elv3A7"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 813eeed16fe3381b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 fa287f6.js Show response
x.gd/_nuxt/ 17 KB
5 KB 523ms
523ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/fa287f6.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fea062bbd2df097caaefd466405b7184f36f347a785806fd52da9e420d3f4069

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-4291"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BN9QtETQzI2yrT9qw%2Fzwc%2BBVCgq6DRsS%2BWA6PODXzOVROMSFkPF1O36KXi1hxjVHvxn8csA6rrXQs52ygqyci7SiJXqpmvG0s0CzkETKr8LB2dEQLV%2Bg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeede4cf43a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310020101/ 389 KB
132 KB 113ms
82ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2737572314184878&plah=x.gd

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2737572314184878

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57fe5d68d345e4df7c6f2c97a5882e08cd679f311261860f045f454abc068d8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135179
x-xss-protection: 0
server: cafe
etag: 11265960849313086022
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:39 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/ Frame CF5E 10 KB
5 KB 60ms
13ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2737572314184878

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 79930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 09 Oct 2023 14:28:29 GMT
etag: 2603938475786422795
expires: Mon, 23 Oct 2023 14:28:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

main.js Show response
x.gd/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/ Frame 2224
Redirect Chain

https://x.gd/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://x.gd/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

7 KB
4 KB

15ms
15ms

Script
application/javascript

104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://x.gd/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Server

104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

892f40e3c7296cbecb37b1af01f727850abe65a6fac3b9d2b7dcede431a1d089

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KnCuzzbT872u9mKZaEx3iZ4Amd%2BG3hdWJ%2FdCxZjzA8OZgVIqroe%2FEI6zyC3yyFYNIhwDWGcExCDfaqOeixIu4NfZwLqoBMasdD%2BgMOEgPF5%2BZg%2FxgiTu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 813eeedeedc13a61-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 10 Oct 2023 12:40:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LHTb1jwJ9D5tqkMBRY0LsuCp9OSxGxYHBhfdJ3CU7JTtd%2Fdxrksz6iAO1qMYRbdo2umIpa7FRvs2KYf76QNa7URvmtWeDEYZUxtt87kok1QSs%2B4ML%2BkR"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
cache-control: max-age=300, public
cf-ray: 813eeedead7a3a61-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 813eeecf5d21381b Show response
x.gd/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2224 0
525 B 36ms
35ms XHR
text/plain 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/cdn-cgi/challenge-platform/h/g/jsd/r/813eeecf5d21381b
Requested by: Host: x.gd
URL: https://x.gd/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BPO59d9VZQXIzRO%2BRvfl47AlgWmbxfawQ2NfP2NBVYHW7JcfvkPOhUyoAbCc1v2w982cg2co%2BpIRna4eBTBwIlMO0PoVEK%2FR1H7308PxaUWbaO%2FPx%2BuQ"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 813eeedfdf223a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 375 B
598 B 58ms
22ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=x.gd&callback=_gfp_s_&client=ca-pub-2737572314184878

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2737572314184878&plah=x.gd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79012285b56d1fd455abf8f5bf09d3e8820f41d8233094b527a4781da1e6443d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F593 226 KB
61 KB 755ms
754ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2737572314184878&output=html&adk=1812271804&adf=3025194257&lmt=1696825283&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x1080_l%7C500x1080_r&format=0x0&url=https%3A%2F%2Fx.gd%2Fview%2Funsafe%2FfvMWJ&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696941639434&bpp=4&bdt=2138&idt=249&shv=r20231004&mjsv=m202310020101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2565904527962&frm=20&pv=2&ga_vid=178216782.1696941640&ga_sid=1696941640&ga_hid=625649420&ga_fc=0&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759926%2C44759837%2C44759875%2C31078598%2C42532403%2C44795921%2C44804782%2C44805099%2C44803793%2C44804179&oid=2&pvsid=3776492909807032&tmod=1452941800&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=272

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4b09660a66cd340dc87828ed48f054b5d777483622d59cbe5c6c95ac8d71b12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 62064
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 12:40:40 GMT
expires: Tue, 10 Oct 2023 12:40:40 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 51ms
14ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: x.gd
URL: https://x.gd/_nuxt/55d6948.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 10 Oct 2023 11:51:33 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2946
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 10 Oct 2023 13:51:33 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
237 B 49ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-K53RX1V2LY&gtm=45je3a40&_p=625649420&cid=178216782.1696941640&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEAE&_s=1&sid=1696941639&sct=1&seg=0&dl=https%3A%2F%2Fx.gd%2Fview%2Funsafe%2FfvMWJ&dt=URL%E7%9F%AD%E7%B8%AE%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9%20X.gd&en=scroll&_fv=1&_ss=1&epn.percent_scrolled=90
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K53RX1V2LY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:39 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://x.gd
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 logo.svg
x.gd/img/icon/ 2 KB
1 KB 523ms
522ms Image
image/svg+xml 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.gd/img/icon/logo.svg
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 336951503a0ffc84310fb5345be5eaa6f9d8a2bdfad0dae493cf3abce96b425f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd317-67c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r4SOS9TX37IIwrwXmuqwVkV5ymLHkPOdVqdOjVn7nYDhdpj51UGu7jes8DQEC1Xnojd4RbyiFYc9i5hSH6t8ZUo4FB2vEWu4jXNZsbM4OJ17t9jnsgG%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 813eeee21a263a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 settings.svg
x.gd/img/icon/ 587 B
786 B 527ms
526ms Image
image/svg+xml 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.gd/img/icon/settings.svg
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a9ff32d85258ef227ddc9a6763db635f084caaaaded2d4b28bb98ea0b1253c9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd30a-24b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EDgjla3mMZFfwZDw5QZ%2FL8wttUGKOCMg%2BI7LhAC0sx9wfQcQAaTa0fyTNy9nedXTfdVFPzi%2BMyqcAwpA1OeNDo0pX3JdD2EqANW4wU8WnBE7o0OKHrEI"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 813eeee21a293a61-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 auth Show response
x.gd/api/V1/ 1 KB
1 KB 564ms
564ms XHR
application/json 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/api/V1/auth
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/64c8103.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f88b997c25f00d059f449ab79d245018b3287f01a9c07f560ee59f4c1650a79a

Request headers

Accept: application/json, text/plain, */*
Referer: https://x.gd/view/unsafe/fvMWJ
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UpBF9ivwud2qwg8Bx2YKWp1TYejsaptXwmSwPiojl9uHDIid%2FXtk4E63epcinl9gOcmWxNmbNs1oqS2VFUN7R8gvLhqHytt4RuJ9Kkstbs2oIjgFtLxJ"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
cache-control: no-store, max-age=0, no-cache, no-cache
xacas: ShySlPzSVQ2mlPzqlK0LENkiFQySIQ5WVQ0SVP5W2OnL2P2WYA3GoP5AIBzWVAoP2AkqlKbLag
cf-ray: 813eeee22a373a61-FRA
alt-svc: h3=":443"; ma=86400

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
200 B 22ms
21ms XHR
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=625649420&t=pageview&_s=1&dl=https%3A%2F%2Fx.gd%2Fview%2Funsafe%2FfvMWJ&dp=%2Fview%2Funsafe%2FfvMWJ&ul=en-us&de=UTF-8&dt=Warning%20%7C%20URL%20Shortener%20X.gd&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABEAAAACAAI~&jid=1103868381&gjid=1392138675&cid=178216782.1696941640&tid=UA-154998386-2&_gid=1142234889.1696941640&_r=1&_slc=1&z=199846573

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://x.gd/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://x.gd
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 25c63ba.js Show response
x.gd/_nuxt/ 55 KB
18 KB 525ms
524ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/25c63ba.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19c834f891914a5f888e3f9bd06ac2e2accf49ca378d78772af9b23799deba41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 14 Mar 2023 01:51:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd308-da7d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VmpcfDBtYq60PGYHytPAcWQfMU4xD5Pfy54ZQG13sM7vVZqSPNpAFhrF8tSJ9E0T5Eglnq4WgJRy%2Fa2sBpK5HOOWdS10%2BsogtaeTy17iEdWeSXUOvJaH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee26a7e3a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 9494043.js Show response
x.gd/_nuxt/ 31 KB
8 KB 549ms
548ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/9494043.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cef9bae76758ab5dfc858064f86ef7c7cc896c74ba6a266b2e97f191e49fe89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-7cdb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PdTm2q2m4b09%2Bx3PRa15fVlkZL7KU%2BrlKRKXg0cJQ179KKrx036oQkbfZ8WHE5SCSN7HggrTbYNKppJlbLWL50Y%2BklEMqLVAzneM49FVofe25AyMeWKG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee26a803a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 687533c.js Show response
x.gd/_nuxt/ 27 KB
8 KB 778ms
778ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/687533c.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01be5c3fa76587c1689c66f7e9bb394fc372741e0c4c7e8f397de4a548a4b9f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-6c94"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Ru3sR1dUz%2FMgOD5uZqWs3dpkQ9O9FaTf5uI3D4YxtuupKLwLD8%2BTD%2BGppW%2B%2BMyur7gTl4Gt7r8n0jLe23W%2BGxPEacKGf9Iayq4a4H3yV0s7G4o3jVRe"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee27a923a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 62ea14b.js Show response
x.gd/_nuxt/ 29 KB
9 KB 775ms
774ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/62ea14b.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f78315c8a89ee0cf5a8ec5b5e43afe3900ada5057e0881e97495c5c71608be42

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd308-7394"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yr0TXqfzc8Llu7SKmj%2FJSDvRqvCqfw1DWUmS7YlCZKjF358xq4N3OsllFyQHKAnbxHKMdhFcJhG8%2Bk7Ok%2BzxEIsWUHvhEEteYo1ZSzNa7Z2G57fpS63D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee27a933a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 579192b.js Show response
x.gd/_nuxt/ 13 KB
4 KB 522ms
522ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/579192b.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f025961b53d26682cd1ebc7a8e1225bbaf2517826bd0703c0d50c2f7356581a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 14 Mar 2023 01:51:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd308-338c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lbixqrbseAlxTpdjQJuvkN2ZBeIKZgHOZQYiJp%2FCCJL4syw4izUVu%2FrVReXwQKKpGs2kQ9ty6j0bSlNC%2BVs8qsXyumexPye18HqdxRcXcdyRNcSSMoDj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee27a943a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 85abf17.js Show response
x.gd/_nuxt/ 27 KB
6 KB 784ms
784ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/85abf17.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75cdd2b07cc10b264cec6ee65e857a721afa6e0fbd5d1f7a1bd4f67bf16d5c65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd314-6ce1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RM3tKvIkiZIva%2FOELgilvtnkaQHXtdgk8UG%2FNHMS2xjkRGbvXX9GiXFORDuyGA21gzbBKa%2F72YWHXOdtnd2jW7GO7XtcWQeZpSON1ySoyLIQzxuQBVG2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee27a953a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 7fe1b1e.js Show response
x.gd/_nuxt/ 18 KB
5 KB 786ms
786ms Script
application/javascript 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/_nuxt/7fe1b1e.js
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/94c6c9a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb91a256d2278323b0d197ffdb7c8e2ce3d1538ae6af22e8014341e1490af2a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/view/unsafe/fvMWJ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 14 Mar 2023 01:51:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"640fd308-47fa"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ifx%2FaKpeW0b9ZyhZmU6eeQoXu3x8H9qaMC6TItrJTo7M6kHJXfq%2BEYAjW9YS%2BJH8MiiWHB4dCYGKS8vMv5eM%2B7cH24CJ6PUkmRtJAUXlqIUudi%2FHvkN4"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 813eeee27a963a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310020101/ 153 KB
52 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310020101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d994f746285f65e7bf7720c4a13207ed20b5aba2281c40cc72646a629f0f32a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53325
x-xss-protection: 0
server: cafe
etag: 9046981465903408936
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/ Frame FD4D 10 KB
4 KB 14ms
13ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 78401
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 09 Oct 2023 14:53:59 GMT
etag: 2603938475786422795
expires: Mon, 23 Oct 2023 14:53:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/ Frame 6A99 10 KB
4 KB 14ms
13ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 78401
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 09 Oct 2023 14:53:59 GMT
etag: 2603938475786422795
expires: Mon, 23 Oct 2023 14:53:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 info Show response
x.gd/api/V1/ 164 B
548 B 315ms
315ms XHR
application/json 104.21.46.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://x.gd/api/V1/info
Requested by: Host: x.gd
URL: https://x.gd/_nuxt/64c8103.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.46.170 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f2cf005dedcb9975f17e93dd5b354f1279921dd3f85a66da1e3aa591eb5642f

Request headers

Accept: application/json, text/plain, */*
Referer: https://x.gd/view/unsafe/fvMWJ
xacas: {"s":"ccfa51df96a7ae67be3e95449598d088","t":1696941640}
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cJRydEYDgj3OxcFPQgw4JX7o8t9U7l9BK272h9ug8uYO9D2sxcfEIU%2BDtNMOxI1OyJ%2FAkoyD6xey0bSw7by4aUh1ZUL6e0mY3QvAevySZ5Rgxbllzubw"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
cache-control: no-store, max-age=0, no-cache, no-cache
cf-ray: 813eeee5de9a3a61-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ Frame FD4D 4 KB
1 KB 62ms
24ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 11:12:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame FD4D 205 B
651 B 49ms
13ms Image
image/png 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 18:51:21 GMT
x-content-type-options: nosniff
age: 496159
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 03 Oct 2024 18:51:21 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame FD4D 604 B
695 B 49ms
14ms Image
image/png 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 07:47:39 GMT
x-content-type-options: nosniff
age: 17581
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 09 Oct 2024 07:47:39 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame FD4D 15 KB
7 KB 63ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:55:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81939
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6551
x-xss-protection: 0
server: cafe
etag: 6101707970674548951
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:55:01 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame FD4D 20 KB
8 KB 66ms
16ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:52:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8566
x-xss-protection: 0
server: cafe
etag: 11420928434021954480
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:52:29 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C5EA 624 B
246 B 55ms
53ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiriqrpATAB&v=APEucNXxd-B7QMNGL2PrmXyP644bXgGP7dCvm1B6cq_P-ibNvKjYpxY5gwvz0LYEukj3dsF8wYjjEJdqTW6Oo-rXWZxXWiVTg1HlNgUdQwAgiKPBCtRN5Q0U7uxKe4w3bFYlsd58_ICc86MQCU-NOlh_okY04ov47vQt__vP-H-1sQwPYSw3Fh4

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 12:40:40 GMT
expires: Tue, 10 Oct 2023 12:40:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3066 89 KB
31 KB 95ms
95ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1474271/71242846/xbbe/creative/ Frame 3066 257 KB
78 KB 183ms
35ms Script
application/javascript 52.30.24.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1474271/71242846/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-2737572314184878&ias_chanId=1&ias_placementId=20122942208&bidurl=https://x.gd/view/unsafe/fvMWJ&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iiEG4mu_x4BOG4AK4tRRo7
Requested by: Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.24.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-24-178.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3c847609f754f8ef61726942bc7ebd8eab9334f79bab20ce2bece9c73150d6f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 3066 3 KB
1 KB 61ms
26ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:13:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1649
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 Oct 2023 12:13:11 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 3066 20 KB
8 KB 50ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:33:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3066 187 KB
59 KB 72ms
32ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3066 42 B
63 B 50ms
49ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BjiLjKE7Gh_s4SmCMWhojOWiqlPPLaAPFs6dz5hRat9WZ5QZRpSyNqRTf3I0kGWQRZRLJarSGvx8HUg4FwXJE9DxWSHmQb0RBSP-N689asOlGnmy4

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3066 0
20 B 49ms
49ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=47316990526281102&x=1&ct=76

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 900D 462 B
336 B 24ms
23ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto%20Sans%20JP%3A400%2C500&text=%E3%82%8B%E9%96%89%E3%81%98

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d68792895f86c25ba4927823a2bbc062460c49c85d30003fd4795c26becdc51b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 12:40:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 900D 2 KB
973 B 14ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:38:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82946
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:38:14 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 900D 23 KB
9 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:36:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83033
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:36:47 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 900D 3 KB
1 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:13:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1649
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 Oct 2023 12:13:11 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 900D 20 KB
8 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:33:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 900D 187 KB
59 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 10 Oct 2023 12:40:40 GMT

GET
H2 200 f20a2b7dfb9062a0a08db52babdaa11c.js Show response
www.gstatic.com/mysidia/ Frame 900D 37 KB
16 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f20a2b7dfb9062a0a08db52babdaa11c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:17:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 440602
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15586
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 Jan 2024 10:17:18 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame C5EA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1

43 B
342 B

23ms
23ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiriqrpATAB&v=APEucNXxd-B7QMNGL2PrmXyP644bXgGP7dCvm1B6cq_P-ibNvKjYpxY5gwvz0LYEukj3dsF8wYjjEJdqTW6Oo-rXWZxXWiVTg1HlNgUdQwAgiKPBCtRN5Q0U7uxKe4w3bFYlsd58_ICc86MQCU-NOlh_okY04ov47vQt__vP-H-1sQwPYSw3Fh4
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rcpCZmRS2zCyWPYjKMa2WodoTfSQxPngKnkSgUeX%2Br%2FKyVyZ%2F7KTlmLPaA7qQdTgFKb1gxUmUAN%2F64x5bIekeECdvVVdR9AdERQ%2BDEpN94LAlQRVfs61PJIb6oACyzv098ObkFFx89TU%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 813eeee71dd61ac7-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C5EA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSVGSBrIm8YjrGRWpisVIgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1

43 B
766 B

27ms
26ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiriqrpATAB&v=APEucNXxd-B7QMNGL2PrmXyP644bXgGP7dCvm1B6cq_P-ibNvKjYpxY5gwvz0LYEukj3dsF8wYjjEJdqTW6Oo-rXWZxXWiVTg1HlNgUdQwAgiKPBCtRN5Q0U7uxKe4w3bFYlsd58_ICc86MQCU-NOlh_okY04ov47vQt__vP-H-1sQwPYSw3Fh4
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wpjaiAdo1C8jcZi12ChTuiVHfaUMaAt2Q7B5LPpPQnt8v0W0XYFdY7Am%2Bv5r4LPPsqIwjgA0OEH3pmGZRKU7OZoV5QK3vzMrPARem71jXgexwLE7x15QjrfizHbL%2B4He80Csx4Fhf2N5Hg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 813eeee7890918df-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJec-G5FPCFVcuws_K4HC8A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C5EA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKwY3rX7wstBPSP6RggABHU&google_cver=1

43 B
845 B

7ms
7ms

Image
image/gif

37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKwY3rX7wstBPSP6RggABHU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiriqrpATAB&v=APEucNXxd-B7QMNGL2PrmXyP644bXgGP7dCvm1B6cq_P-ibNvKjYpxY5gwvz0LYEukj3dsF8wYjjEJdqTW6Oo-rXWZxXWiVTg1HlNgUdQwAgiKPBCtRN5Q0U7uxKe4w3bFYlsd58_ICc86MQCU-NOlh_okY04ov47vQt__vP-H-1sQwPYSw3Fh4

Protocol

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
an-x-request-uuid: c3fc3387-b414-4de6-a717-53d71c7f133b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.130; 178.162.209.130; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKwY3rX7wstBPSP6RggABHU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C5EA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3OTkzODc3Njk4Mjg0MjI0Mg%3D%3D

170 B
243 B

24ms
23ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3OTkzODc3Njk4Mjg0MjI0Mg%3D%3D

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
an-x-request-uuid: 9ba73f14-23ff-4936-bd43-00607beb9191
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODg3OTkzODc3Njk4Mjg0MjI0Mg%3D%3D
x-proxy-origin: 178.162.209.130; 178.162.209.130; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3066 0
20 B 48ms
47ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9612986470241&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3066 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9612986470241&version=m202309260101&ct=76&x=1&cor=47316990526281100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3066 16 KB
12 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CwBPp30cTT29uEbiKPA6HQcyxKMgt1b88DgrX5OtuSf6VGx2XTyialDjTgRgsS8B3IAfU61Lv9KdHkyJo8DTt2Q1lPcT3fS_tI51ylZLd3OQ5s4GEVXPaWC0EadJJCuldkqAAjKInP1-5K6MOuJ97xdVk8Bd0D6pNVsXz9JXOjCUqD2gY&cry=1&dbm_d=AKAmf-BhXHWzD8Y9vDVb5dPlQd2vnA5EtNO3F_C_hPSY0vYQGg63xWBg1xLNmC9cVzNj3pP50iq-7ozZVsMMRUusScrDRA2a8yKH5945ppd2YCKFFOuMwQbbl1fPz2s3-8DerXIhsBsZL1jVtf5LlSZqQ4vF6FcjvV538ihAtrg_zeG_HqUMZF_CenK3fszp2RmJlXXIljjvsDybq9P0x-U4aS5c5VLVR7Y1pBthhpb6RVtwNXZIZ8v5nMk5EA2FZov4mhkR9_vcvZr4cT22DE6uDiRJ1L0LMNZDQuhqelP5eH3yJTH3Fc31xi9FZdC0hZle1nmVh1bMIkeW-IjMpxLvudv3buMOp-gx4WRNS4pL842z56j5LKdRYQrirh7ZjfkoMsBRwBs9HaSawJaVhpZ6wI36kFGC_rRbAH6V5hjMt2tHCrvyXti2-7BgyZfTsbwvvRuUZV0HlU3UxOvgrClmkpiDa2MDN69ADQx5sFtI1oRu5cIH_W4VD5eRyAdGUhCcsJndTcLZkUI3AQqG3MhXM1tZl4wZPXcbrF6T82iIFBeLJ_D2LlR_W87U6kXpV8oR1gv4sxvtS4lySaUOsaolwKFFLlxbq9YoTwgcF5A3vLZMeZaHJ3IXvbzzeJO5H_jckeLrxhHl7HDdYJ4AapBJtTRLudHZrhuvgFgO2A9XKl3wXRX-HDyCdoLeVLe-VqAj_3wQop61mvAVa-jr7rt9uQFodL9sWfeIJa0mWvbS6r3w6XTWaBMCXx6owFtRlDPUfsy7fJ1wEhRfvGKJofpGvs2K-blFXL-TPo2hoL7oShTLTVOfIkpq2G8oPqRoyctHg7OHRjZYeRKg8FaIjnqJr-UCzBUQimjEihTIbvjf7Qx218KVHJazlml2TI-hxD0fnt347EoNl7ICxI2cj2FvNiCTsUN99n5cpzXlSn2yXJlHw4yRXxGjhfOnSvxUBsmCTu_P30pxZmDxTtFOxnR_AeYXqrqRDIahMECQUccAQ_He04Ja6HxdAjep-TKBHvupy4g3SSuivMYmgaUdOBAOhFav1FwgnVLLZVzxE5Ru7jAyXpAOM2KAgvOYYwhSyGy30WuWN4OkU7qoLTf8h6BoWRxA_xrStuF2ywgECaDF2iJ8u47KlVNG_160jfIwzzEMPxk7-c-XHUIppU-fvuQzFMx_ynZkUELjcvcHbswj-3SWDUkZL8pWl6LNiuoPgJlwwfbgXl1n2J4tmaLogkyjyFmLFW8tCgoDfOTLshOKN9-lgtHutLDuFvDEZj3gScLdFksK7ddMxj2JRH69oxaqQz9Xs8fw92qu6FboSdl9FxRhjerPPbtqOt0Pip8ytGuIcfgw4xMWUL9QOWE0u0PI4caVr5FpXdAJd-dGhifiYIRk0PUfSJt5qWCg7I6xjKYJir-v3U4DD4321RnB-pH9dOu-2y4UdO8NJKR9xu3HP_Iuasw9YvhrcRQQSxENAK-jX9FS07o6PjsivLbmhbM01FPhClEFmff9BHbHFtLePYK2QuXJxRg6nNLa7El-ABk_png5pgm9DNpKn9szNlabu-BXcG_2gNOUIYS7qv2GgU6F97_B4Hwrro7eDhsLaSC1sr_eFTdxAAOc3dmiQbVt5KjBcM_oVK3cBY2OUjR9xGhSjecfN__S1dwYwxXwtmYlQ723kn6U_MWsor8mdwTpHF7ZG3WG3tV3Lhx4CI6HJ927M8jnnUh-fCqmFD1VPpphQ35hZkxN-9EHp6-4HORiEt1vKq1HhBe0wFHmKfKkjt1DGeXE-XzbDUzFBJEpuKYzNfWYlYAyKFf1wOPrb8TnNfT032X4PF2G2VwRnlN2wWvgXoCJ2y2Kip2WQ70u_28-QdS2WIp7yzXjxrDCUsdXJAtjP6kUFhXQHZtjrznwGBhcHbWNUkb_GXDQHib7S1OIjc_5x3NvWssMRI3Ma-ilek22pU2mkQD3e5F6tkdxbEZMW_J3_R1FahDni4n3qDSKP0LcVElldHKBndYnR02aOt0MZWuOpLmatbSEPrkC0jTlp-lNqoZG1gbgz_L401s_vRIrxroImNO2Vzjl-fWDlQXVIwygdZf61qYgLGVgN9CSNy_390xvcW7gFdsRcJhf8SskvnAhpbUoruUHJmI2FnRqdqKtKCJL4nr_UNOfNhi062XdHEXqpwMYHDPlZ2X_kdhdv8VXy1b_mJX9u9O4doNxHEFAeBYhVFV5cZHcR1tTzoms3Z0xEVMtTMH2dErxVe5XjEf4ARxYqmt5our0Jv-vKwzx8OWY-4BOj59lKv2X_zA4TaLytEOyho98IjB9og3HgEtUroef_wrrRlImV-N0-TcXogowbc4OFW7VXZX-ksbesRj6Jc8sLk3HcgaAv7x5XCDsZzsK5Tpc5LO7GnCHDPQ0cNLwIxExo3IhRkGw8aElRPT4I4SW6fgulUvhvOSBR0YXRAUL0nvR9c3wnNUK2Zhsmd3Benrmg4pWywpIceK-2RGdSnEgKW0732_aCEQ_h2cvuFNMQoe20PC9mZzahreph-BnKGet2hO7HFBLljLjLMg8chd2GOcGataLFnZxU3MUWhiqVg-vDkXcO8CJ-ma_iTt07h6hnt5HAAKNaP_LmG26emGmP7lU6aYfduZBnmViNBmLB6XkDR6_pi5Mq1oFEEuFTqY4_rEjbXSP0zRTQUrcT2BdO2wCzvyzmSiSOudb-nClfP40CW1CQcBsPOWXxI-rcDhWuV3O9Qf6JWEDHDUfH7YuMb_XQv1pOhcllogHy2XHWJ-sDIQUVAjco4ThZ-aykGN8RvW8ugQT-76fK8t7yxf9TNz1Q2n3LxC-VYRurj8Y03Kd6XSJswk8_Ni0uRKxcFHSyzqrQGeJpHArE4ykMz5_7CgUklRHEHUHSkspwKOw_QEBZ10pQJfGv2cKPTrAYJROzn_-hOc-4vD85t6PV5bBbStsoAy8s6lZ9DMsd9cepLHQPw1bMEtrxr-EcA&cid=CAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fx.gd%2F&ds=l&xdt=1&iif=1&cor=47316990526281100&adk=1761367587&idt=101&cac=0&dtd=12

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

871a7b8bcb97cdd205338833653c0370a8211208faea841eb9b305eda7140b69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12269
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 44DE 38 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:37:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 450205
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:37:15 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3066 41 KB
13 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CwBPp30cTT29uEbiKPA6HQcyxKMgt1b88DgrX5OtuSf6VGx2XTyialDjTgRgsS8B3IAfU61Lv9KdHkyJo8DTt2Q1lPcT3fS_tI51ylZLd3OQ5s4GEVXPaWC0EadJJCuldkqAAjKInP1-5K6MOuJ97xdVk8Bd0D6pNVsXz9JXOjCUqD2gY&cry=1&dbm_d=AKAmf-BhXHWzD8Y9vDVb5dPlQd2vnA5EtNO3F_C_hPSY0vYQGg63xWBg1xLNmC9cVzNj3pP50iq-7ozZVsMMRUusScrDRA2a8yKH5945ppd2YCKFFOuMwQbbl1fPz2s3-8DerXIhsBsZL1jVtf5LlSZqQ4vF6FcjvV538ihAtrg_zeG_HqUMZF_CenK3fszp2RmJlXXIljjvsDybq9P0x-U4aS5c5VLVR7Y1pBthhpb6RVtwNXZIZ8v5nMk5EA2FZov4mhkR9_vcvZr4cT22DE6uDiRJ1L0LMNZDQuhqelP5eH3yJTH3Fc31xi9FZdC0hZle1nmVh1bMIkeW-IjMpxLvudv3buMOp-gx4WRNS4pL842z56j5LKdRYQrirh7ZjfkoMsBRwBs9HaSawJaVhpZ6wI36kFGC_rRbAH6V5hjMt2tHCrvyXti2-7BgyZfTsbwvvRuUZV0HlU3UxOvgrClmkpiDa2MDN69ADQx5sFtI1oRu5cIH_W4VD5eRyAdGUhCcsJndTcLZkUI3AQqG3MhXM1tZl4wZPXcbrF6T82iIFBeLJ_D2LlR_W87U6kXpV8oR1gv4sxvtS4lySaUOsaolwKFFLlxbq9YoTwgcF5A3vLZMeZaHJ3IXvbzzeJO5H_jckeLrxhHl7HDdYJ4AapBJtTRLudHZrhuvgFgO2A9XKl3wXRX-HDyCdoLeVLe-VqAj_3wQop61mvAVa-jr7rt9uQFodL9sWfeIJa0mWvbS6r3w6XTWaBMCXx6owFtRlDPUfsy7fJ1wEhRfvGKJofpGvs2K-blFXL-TPo2hoL7oShTLTVOfIkpq2G8oPqRoyctHg7OHRjZYeRKg8FaIjnqJr-UCzBUQimjEihTIbvjf7Qx218KVHJazlml2TI-hxD0fnt347EoNl7ICxI2cj2FvNiCTsUN99n5cpzXlSn2yXJlHw4yRXxGjhfOnSvxUBsmCTu_P30pxZmDxTtFOxnR_AeYXqrqRDIahMECQUccAQ_He04Ja6HxdAjep-TKBHvupy4g3SSuivMYmgaUdOBAOhFav1FwgnVLLZVzxE5Ru7jAyXpAOM2KAgvOYYwhSyGy30WuWN4OkU7qoLTf8h6BoWRxA_xrStuF2ywgECaDF2iJ8u47KlVNG_160jfIwzzEMPxk7-c-XHUIppU-fvuQzFMx_ynZkUELjcvcHbswj-3SWDUkZL8pWl6LNiuoPgJlwwfbgXl1n2J4tmaLogkyjyFmLFW8tCgoDfOTLshOKN9-lgtHutLDuFvDEZj3gScLdFksK7ddMxj2JRH69oxaqQz9Xs8fw92qu6FboSdl9FxRhjerPPbtqOt0Pip8ytGuIcfgw4xMWUL9QOWE0u0PI4caVr5FpXdAJd-dGhifiYIRk0PUfSJt5qWCg7I6xjKYJir-v3U4DD4321RnB-pH9dOu-2y4UdO8NJKR9xu3HP_Iuasw9YvhrcRQQSxENAK-jX9FS07o6PjsivLbmhbM01FPhClEFmff9BHbHFtLePYK2QuXJxRg6nNLa7El-ABk_png5pgm9DNpKn9szNlabu-BXcG_2gNOUIYS7qv2GgU6F97_B4Hwrro7eDhsLaSC1sr_eFTdxAAOc3dmiQbVt5KjBcM_oVK3cBY2OUjR9xGhSjecfN__S1dwYwxXwtmYlQ723kn6U_MWsor8mdwTpHF7ZG3WG3tV3Lhx4CI6HJ927M8jnnUh-fCqmFD1VPpphQ35hZkxN-9EHp6-4HORiEt1vKq1HhBe0wFHmKfKkjt1DGeXE-XzbDUzFBJEpuKYzNfWYlYAyKFf1wOPrb8TnNfT032X4PF2G2VwRnlN2wWvgXoCJ2y2Kip2WQ70u_28-QdS2WIp7yzXjxrDCUsdXJAtjP6kUFhXQHZtjrznwGBhcHbWNUkb_GXDQHib7S1OIjc_5x3NvWssMRI3Ma-ilek22pU2mkQD3e5F6tkdxbEZMW_J3_R1FahDni4n3qDSKP0LcVElldHKBndYnR02aOt0MZWuOpLmatbSEPrkC0jTlp-lNqoZG1gbgz_L401s_vRIrxroImNO2Vzjl-fWDlQXVIwygdZf61qYgLGVgN9CSNy_390xvcW7gFdsRcJhf8SskvnAhpbUoruUHJmI2FnRqdqKtKCJL4nr_UNOfNhi062XdHEXqpwMYHDPlZ2X_kdhdv8VXy1b_mJX9u9O4doNxHEFAeBYhVFV5cZHcR1tTzoms3Z0xEVMtTMH2dErxVe5XjEf4ARxYqmt5our0Jv-vKwzx8OWY-4BOj59lKv2X_zA4TaLytEOyho98IjB9og3HgEtUroef_wrrRlImV-N0-TcXogowbc4OFW7VXZX-ksbesRj6Jc8sLk3HcgaAv7x5XCDsZzsK5Tpc5LO7GnCHDPQ0cNLwIxExo3IhRkGw8aElRPT4I4SW6fgulUvhvOSBR0YXRAUL0nvR9c3wnNUK2Zhsmd3Benrmg4pWywpIceK-2RGdSnEgKW0732_aCEQ_h2cvuFNMQoe20PC9mZzahreph-BnKGet2hO7HFBLljLjLMg8chd2GOcGataLFnZxU3MUWhiqVg-vDkXcO8CJ-ma_iTt07h6hnt5HAAKNaP_LmG26emGmP7lU6aYfduZBnmViNBmLB6XkDR6_pi5Mq1oFEEuFTqY4_rEjbXSP0zRTQUrcT2BdO2wCzvyzmSiSOudb-nClfP40CW1CQcBsPOWXxI-rcDhWuV3O9Qf6JWEDHDUfH7YuMb_XQv1pOhcllogHy2XHWJ-sDIQUVAjco4ThZ-aykGN8RvW8ugQT-76fK8t7yxf9TNz1Q2n3LxC-VYRurj8Y03Kd6XSJswk8_Ni0uRKxcFHSyzqrQGeJpHArE4ykMz5_7CgUklRHEHUHSkspwKOw_QEBZ10pQJfGv2cKPTrAYJROzn_-hOc-4vD85t6PV5bBbStsoAy8s6lZ9DMsd9cepLHQPw1bMEtrxr-EcA&cid=CAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fx.gd%2F&ds=l&xdt=1&iif=1&cor=47316990526281100&adk=1761367587&idt=101&cac=0&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 06:58:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 366136
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 06:58:24 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7390 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 427868
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 13:49:32 GMT
expires: Fri, 04 Oct 2024 13:49:32 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 3066
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1474271/71242846/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1Pm...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvB...

72 KB
25 KB

100ms
48ms

Script
text/javascript

64.233.184.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

64.233.184.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wa-in-f156.1e100.net

Software

cafe /

Resource Hash

868dfd97cac2c7206fafc3d400032fdaef5f11f45c503cb2685147c5b7a3b50d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25191
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:40 GMT
server: nginx
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 21DF 91 KB
23 KB 34ms
8ms Script
application/javascript 2600:9000:223f:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 1686690
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: dhrMBmnMQQ4S-EgPMb_4v8YPBYwxVBd-pfaMsJno9hhyPUmupYqCzQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 309ms
101ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePk4,pingTime:-3,time:55,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:55,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B49~0%5D,as:%5B48~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,rmeas:1,rend:0,renddet:IMG.us,siq:23%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 307ms
101ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePk5,pingTime:-6,time:56,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:56,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B50~0%5D,as:%5B49~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,rmeas:1,rend:0,renddet:IMG.us,siq:23%7D&tpiLookup=ao:x.gd*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
216 B 294ms
100ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePkj,pingTime:-2,time:70,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:263,beZ:264,mfA:266,cmA:268,inA:268,inZ:272,prA:272,prZ:280,si:285,poA:286,poZ:308,cmZ:308,mfZ:308,loA:319,loZ:322,ltA:333,ltZ:333%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:70,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B64~0%5D,as:%5B63~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:23,sinceFw:47,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js Show response
pagead2.googlesyndication.com/bg/ Frame 7390 38 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/bK4GZl0mtHPwIamiN73ahbbApyVSn2vIx_eFPB1ZZt0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:37:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 450205
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:37:15 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 3066 111 KB
39 KB 59ms
15ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 07:03:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20237
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Oct 2023 07:03:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame 3066 11 KB
4 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1474271/71242846/xbbe/creative/adj?p=APEucNWxn_NXSrgvSrEZsSV2yBhcEkfyTocwmEbvrd9uPNkQjMeaSkc&d=CokBAKAmf-C1cKuyR6g8FiI5HDgOcocjZwwYN3ZRQIJct223elf_fkb9xMiz1PmQY-GFEgR8H1JGSeXZ_LzKD4pvBftebuRu_vpEcq6J_E7ms-947S2vdMmDU5mNLdwtOsaF1R6J-rUkS3kze7PDS2TiVMzn5rLKp3IM5dIq6JVM1KKX9_Jyyfpa0qASyRQAoCZ_4IV4Oj71-n0oVOpBOah9pRrMF1BmBGnoxOv_B0ll9Ly_rKNjqX-LnXIn9YyhTHSFtOYGKMcUicXWeRsFdGDXo3e3TcHriZtqx-MrkajvArbIKhILctToYwiLhGQEMvibfP9llvIGsDrS6MeJUWd4iE_qBqk8OBEJbE2zJPo-tb5rUkg2v2T4AmpERji03nP5Nx3jJN2EvCIeo4i3KtZ2-iWW6DacZVEyFpe2YJUSDr6G48zwV8nNzNPWoxYZTzJQwB8BIjErFBoJCvB892dShoYNGoZE3b7pe2__OIERjrXILlwSqu0kp4_-Fg_GCTT_AWh7pIgOeTrVcj9vjhPo2H9K7g30h5t4NHkP5q8lMfkMsUz4awK6pTSNZ_hXIBzebzrvM2NNgoz57RJt-Dm1MmW-U7lF4lKUJOtlVVZqA8XMHOTNouUspZVQAGYZx4pG6-DVBkDasiq5UND65LhFUw_UbmH79wAqAmWIQUCu-E6FRTpTdAnlh8883V-RVJTdat9S_U10p3rg2V7bSc45CE7UqoRbw93C8FR3MTZNPoHGJHf3fD62Yladq7jqnhGFvYNqIVI4NXmKWfPSiyRzLI4pabsZuXgmGwaqLaSDVx66BgktjiS7FakOrCUk0UzbmYeUS7zcDQceA7IY8gldP8_QOPyMK4iG7Ncde_YGPsnvNp5IUsb-Htjyzr4cIDEWHXaxT6jg9_7_-wiOVkBCTkRbz27xq1nabvrFJTeVKWL_1Qv_Fz2rAUly6BWHCAfv4jm1s9CLNQOwxxt-EnXy2gjsQSFsNBVLGTG_XUglJwzV-dmJrvHby89nGGY5i6EiYdqTLYyQw51fFtwrK3tVgRabkC3OMbYepzFGmoghFoflu8Sn0JG9gvYVedD5Z1ZFmRHwSfczbji7gU2IZ72DKWqSNLAJP5lVJc5wB88_zyNG_-iSeC7-P6NDhVAkwl2Qlz2ixQti1JJCiK60_63mFrXYjj8qsH5Pl48z-Yq4DopQV_P7IWSjKpwJ6rS_LzBTbCkBCjyr8NiLXLc1nL807fUO3-YShSl4cGYZ0QjgvsS2G6ze2KQLtTFmNtotQvq7HQdiCA4iMhfnzCwTCFhNNNs1f_ITrKL83AP_EwUGjL2Qmp0Is_L2u-xUgZTvULuHPMvRLovnPnrNPRr8raz8EXp6lL7eAKOnBO5REyS5zkbhF7DJPCIwitHwwv_J7CGE5f1pyLtgTCMihH5AFEeee1LpLL7eOOngVbISiY53W1xEKTO0A_jWhZTiSl7ljtNY658Slo8IudgKgl--7U93y4nwSxX1Ttw7RdRqCk8qDESh3cN-o3G-h8ut7iLNFN4z3a1oqKwLMyOe3VMnsJSEDs9HTk_T2-i1mhKoE58B7bWb9qNWgvYijMzKFXA-QiSbcW5kcWbp-4dMdOQ_5uv-dvEgiArnACbejanvcuNIOgO3MBFQnE36Mnssr8waNQnZGMbEU6Vr0zrK6mmOs82TEqAKFgN-cWbadce8FdyEO3EGesN5Aj5pS-yFlfPM1ZcWr_r209Bpkx77_dHyslmgsqnPxyci5feVrPCmUH6lZIcZC6F0NNQIYTgNxYmb9Tq4w-kS7wWhc1y7M-ulFyvRWWGiFvhWDf4gJvXN2INcuDzg6qTph4uC_89GcMbXNwLG_YqUQHpVfOqLMyvAX-rwTP6aI5h7BFvyLCpCUBaH7t3dz-xEu4F4Ipa1KV37bABVCgqvnOBzs18CMlqycCBaCEGff50zWQpWfkdfCdVwaPiTkXF4CKsdCinAiRiUFfAmBzruKw0auoZp2q-7VXD20v585kAWu6qUAEXAYBUvlrqNaM3vRAROvq4N952zEpTdELOKqLUXzfqxwxJkWhj0nbiSChgJUtZ5Oe98-XYMRXs9_1TGIgL-psUuSDjOmTfxfx9fC4x8Rf2lqKI87RdniFT379NeDLKqGJzqdq_MzeZ6ENxFiSF19P8xFHeUoEzBeaCkOVZ7jXrt4iWTpZ6hPJEjJPZTGurvN8S5wcQ4aQ5ZMhKqzQmt3Re--0_SLdbz58kP7tFcc3LzAtBBg7y7knZTerGzHgwmDbO8WTSWsJYYjUhXYrOFVBR5Y5gZKcv82jEUo3vLw3ERy78txO7yY8XVVJC4h07_XeZ1dalYCqE20oz6uTdV5a2ytauOC1-WAQmsZCohFkfA2FiePLAeuBnjngWW67GbCjk19YJbacm6cOCScouhHsVlP_jLyGh4U1mRVvnol_C3BmMejc8A_pF9Hxz-UdTm8Kj0qg-HNbtWOu-EHE6-kqSJLAlKqWNhKJjJXdEZ6KATGT2rTETFLsppv6HUOEeRN9ufg_FfyyvxFZEPc6QHepiRGgULRrMyXV3DQS6xhAgx25s1yZPAuRBhXVHa2ba7OBVdKCGyUfOE9RZF_ojd3O2T_dV9K5Mwa85o5pX5OyIAsYOalJSHsY6EN9YSCVYldtZmSRxWqCiPam1Y6XJ0E68orTEB_AU1vy1HAycNirpefUzfExQPta4OBhxpfA-1UvJUxL_WNyFnZwRV51c3X4dELiXpLt7rVNOn4HdJyiuGcu2x0MeRQ3QkHA-_tvb90gQbL3y2NMNmFcn0dxXpq3F8b--mxfolisHHlpH7wFB-Bkb5hY2fTHGNa3AWW4EDIsOKjp0-ogceWa7Zh_fjFWzMZaGfAEKSTHD07r_EC3FJCCLta884r647Cib3seJxBcdhbPuO9quwKZOGdsK3pGHQ8mNqopZMcfT1BRphTpg1zTf6rJ0WBDt6fyRORaWL3S-pAfaZ0JVlfYhrWfw_PIfxuXJboy1GLws1--l8D-E4-eSIr_ev_pbmgdd1vEP3e4hWpjm5h_6Cp9uRgFEnEd5DDN44nCj_wV45CS4WahmNLCD7CBXgPFWbZDCgKgrq0ehQnt6rKqY98qTaGZIlcVwMbEpWAGtc7_UR72Irm59C1UD1P4kGqoRSrstwZDcID3OjrjnXohZtEiIZPw76PU39Sq1HT-vQcAmWIRWsf9_5ycvVR7bNB2TfwioybSZGdGsBRgu1iQCwfzB2R2slyH3P2KdjSlYRuvxDL2YqFPVw_n4E9bHLeLkVWgJ5vdq1CmJ4QKuYchRLxEqNPLN4DLQJW-N8Tz0p4zf6_UVBQJSN0hd5qyb-JIppXxbVcuVq9Mo1sCvOSHewTvNllR5o-OMEMDseKMs0LQ1GTL4dAmDwfwB2g11kxBYseoqmNMZ1L6UQQ3h0u6ceTERDckZ-9AHUqsnQA19a2-46TpaRHwswYXTgYO5mkomQxYAaVdriGvqCZv1Odqynv6VjhKuvOfkA_cr5762rPP5Nm-kN9xMKhRUrF4cM5AkoGWt-0uaSUQVdhf60fQo0eH8tEfJs0GTXMMs07l9B6MBf1dwdr_bK1NIZhzIfuZmad6tbiWePeDYqL7mmlVoVqh4R6ihUxiEIF5HBzgwuOjAYwWQP5Sekg2ogmg6cgYKHR1lN_KYIdhheMKxQ7RkWIqkYpRpRCAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgBYAE&bundleId=&ias_dspID=3&ias_campId=1012200182&ias_pubId=pub-2737572314184878&ias_chanId=1&ias_placementId=20122942208&bidurl=https://x.gd/view/unsafe/fvMWJ&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iiEG4mu_x4BOG4AK4tRRo7&adsafe_url=https%3A%2F%2Fx.gd&adsafe_type=g&adsafe_url=https%3A%2F%2Fx.gd%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231004%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231004%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271801%26client%3Dca-pub-2737572314184878%26fa%3D1%26ifi%3D3%26uci%3Da!3%26xpc%3DO0B0DfjBzL%26p%3Dhttps%253A%2F%2Fx.gd&adsafe_type=be&adsafe_jsinfo=,id:f7ac32aa-5150-5ec6-f2de-b65ae1839a5e,c:qEePjx,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-797d947f74-gcn7t,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:22,oid:388db870-676a-11ee-b329-12cf707ffa5b,v:19.8.439,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:43:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82610
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:43:51 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 3066 30 KB
11 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fcc2c45e5c8be67198b1d2c38bef90e3373e59b91be75e915711bfa7c10d22a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81801
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11602
x-xss-protection: 0
server: cafe
etag: 2362517075893974484
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Oct 2023 13:57:20 GMT

GET
DATA 200
OK truncated
/ Frame 3066 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb55c65f6747f9b69496d73e248401c87e43827f6a70b55b4603073a7da7d5b7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7390 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3xCnSEYlZcKHMOT2x_AP7Za-uAUAAAAAOAHgBAI&bg=!5eal5qnNAAYMG8UMLBs7ADQBe5WfOFOuavg-VYxknE2l1HiOlnwdO1ShXzcHDxqaDfAqkKLKAB83vbvtGdcNA8jMLIcFAgAAADxSAAAAB2gBBwoAezHdUYsI79V07crNzjSJQRRkBAtp8R7NvQGFQ3J1rUMqHLXERIMOIMfWGhCq0Qkap5QXO_iwE_p1h8YGl4qr5KtOHNi4ljQDSCD78JW9qvlnEVpzbOMi1y5LraaahFWTBwUErThCUQAeTWaUuiCN7PUG0K3UbiTNLOoO9JkC9nVVDI3bTFieqqtOugBLGJrDSI6M1teUsD5gCi3kFqYubvmHhce3woJ7dozMXQa5RzxSlNZ6Rv23m3RGOo9hgmUGx666TCCYwOI7f1Sr3BmfwozGT7wVNEF-TbleG8SragJVEOsUhRNmNQV-etqYkru0W88Du9yFTBnq4pzIF9_N4FcMDM6_n79o-yayYSfv135QXzuBk_gB_5Tu6a8KPmuefR0lXntWS6_Awgvebbwy7iBE9u_44HQH-gzSIwjhzsVUvrxpUNwtM1Hz_xdGquJIASjAAc-Pnkg_9cAYxc3VrCoqnwQzwqc3os7ESkoG1JoJLzWJWPUyT2u4ZrqxZjopf69JyRfwhnMjFxkYjcx_ZxXtbTeX0PrAsjp7Nrq359a8SO6SzjOWzVlHDeHUzOBOIUxztmjIbFsTf-PzKndTIP_wuq9Ga2iR_2DoMxarvqKzMPOtctzQQDB9MweTUlCtzPYNBivzl749SG0kc3d_xOR6lbALzhq0nlpT_Pbaoc20D0gr-eKRW0gBEON23r78A0mq8upbmV3lnhy8EBnV20y1pxX0f-sHlvx7aLwTCVCqpQL-H5jYvrurwsmT8zkrLaFhgzwwuWoHTrkd42MPethZQj_VsMJo4zoeqlGUd-irdTIOd-zA6chcpRXbKxHn9nPiddaHdndm_SB_PuylyCWwnYOe2TmCVABPZF8jnklWNIPtqf5vjFm3O7p3HDxW_XhIF7DvxSKMe6cHhvDEdL_7wd5NMmdW1YWP0x_oSQ7x-vYs5AqbQSBiZrDqS8Yv9LZvD2YaNtSYQMZopDQ2xUQIKi1CbIDvtNmf-g-OQtCIPhLiYkfEpnjIahPU303jfnZoubwZsX_PvHv6GJFOwmjF886pHx9v-1aH7iAvuhy7fp1vQLNc-6Q8_CrCTfHLqYbjpIChZlm0dO8vgmEJ4RCMLZVofPRskmT6CHdIItFThqs_kCoPYIFtPrTWnT9XB2B4C-nNiK8KlMUz03aEOK5b2scB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/ Frame B641 253 KB
163 KB 54ms
25ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d76d4eb560f3f07393988e9f8f8425791f26d0438483c222ff53c73b9900be4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 111119
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 166451
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 09 Oct 2023 05:48:42 GMT
expires: Tue, 08 Oct 2024 05:48:42 GMT
last-modified: Fri, 05 May 2023 12:38:54 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3066 0
0 134ms
61ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsutjYRCx7vI0sRFVF9hLFkxuLShEJT6V2oxSsWWzdWnif8oRSassJ_KXeJ2o_ojupcYutGVDLFqJ8m6By_Y2MQCPfEuwFc8dtcZ0lNBXxTcxDyOyrtn4ZsemESAqiwq7xv2qXjVb1m2hjBY8ve_ZJU7LYZWE0zSWRr3mnUqKpJsAMn9ijhCnwwo1N9kvlfbtCsmAdacjw&sai=AMfl-YQCiBsvr1ms9i0Zzs9snB8cdFhX_ayV9501HzDZL8SUNLwbCEPVwGNp0R1yoTNSpftxyFe2ldc8hxs_yn-reN9OGXtv8rFMR-S8-jCf4jxi-FvP1rCZdUi7JBRwQfXIa8UvFXFIYpFeYP4A1d2MKxECzg&sig=Cg0ArKJSzPyAx06t-aZaEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=85&cbvp=1&cstd=82&cisv=r20231004.72412&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 101ms
101ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePpg,pingTime:-10,time:377,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE3LjAuNTkzOC4xNDkgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1696941641273%7C%7C2e3760da5429a883a5f125fcd0f3ac93%7C%7C8e5269e98501ac65ff2ab303e742fcb1%7C%7C009559888a633838fd1283c0e25a1f6b%7C%7Cb25ae5470c0685572c18e147cd51087b%7C%7Cc77844f2ab8083101331e0dcb1896064%7C%7C00361a2480cde62487209997929f3c64%7C%7Cff8ebe8a7d859023b6a7fa13d0e5ed1d%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
DATA 200
OK truncated
/ Frame B641 73 KB
73 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24366c51064fc57cb419cc93db561f43bf3461affb1d04deb4d552a7e2ba4956

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame B641 71 KB
71 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dfe1f9ce8410e9cd1eb921153319aa98dd53d12a6e4fb0efca81ab345bda814

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3066 0
0 61ms
61ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsutjYRCx7vI0sRFVF9hLFkxuLShEJT6V2oxSsWWzdWnif8oRSassJ_KXeJ2o_ojupcYutGVDLFqJ8m6By_Y2MQCPfEuwFc8dtcZ0lNBXxTcxDyOyrtn4ZsemESAqiwq7xv2qXjVb1m2hjBY8ve_ZJU7LYZWE0zSWRr3mnUqKpJsAMn9ijhCnwwo1N9kvlfbtCsmAdacjw&sai=AMfl-YQCiBsvr1ms9i0Zzs9snB8cdFhX_ayV9501HzDZL8SUNLwbCEPVwGNp0R1yoTNSpftxyFe2ldc8hxs_yn-reN9OGXtv8rFMR-S8-jCf4jxi-FvP1rCZdUi7JBRwQfXIa8UvFXFIYpFeYP4A1d2MKxECzg&sig=Cg0ArKJSzPyAx06t-aZaEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=207&vt=11&dtpt=122&dett=3&cstd=82&cisv=r20231004.72412&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: x.gd
URL: https://x.gd/view/unsafe/fvMWJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 LogoLockup_Vert_RGB_white.png
s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/ Frame B641 1 KB
1 KB 25ms
25ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/LogoLockup_Vert_RGB_white.png?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

320c83a2ecf5473795e1137deb93090208180cdb0cf8e7f6dad1a1f1aef35770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 05:48:42 GMT
x-content-type-options: nosniff
age: 111119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1502
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:38:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 08 Oct 2024 05:48:42 GMT

GET
H3 200 iStock-1086808322.jpg
s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/ Frame B641 24 KB
24 KB 26ms
25ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/iStock-1086808322.jpg?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f92f0adaf2370f83fcdb0a2001f2d1fd3192982ddade3c9e7853735c78accd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 22:18:11 GMT
x-content-type-options: nosniff
age: 483750
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24431
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:38:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Oct 2024 22:18:11 GMT

GET
H3 200 LogoLockup_Vert_RGB_white.png
s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/ Frame B641 1 KB
1 KB 24ms
24ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/LogoLockup_Vert_RGB_white.png?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

320c83a2ecf5473795e1137deb93090208180cdb0cf8e7f6dad1a1f1aef35770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 05:48:42 GMT
x-content-type-options: nosniff
age: 111119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1502
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:38:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 08 Oct 2024 05:48:42 GMT

GET
H3 200 iStock-1086808322.jpg
s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/ Frame B641 24 KB
24 KB 25ms
25ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/iStock-1086808322.jpg?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f92f0adaf2370f83fcdb0a2001f2d1fd3192982ddade3c9e7853735c78accd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/699028630855374914/EMEA-DEU_XA-09_0_728x90_BAN-A_HTML5_TOFU-no-Networking-GenericUnifiedExperiencesPromov1_0_105/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 22:18:11 GMT
x-content-type-options: nosniff
age: 483750
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24431
x-xss-protection: 0
last-modified: Fri, 05 May 2023 12:38:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Oct 2024 22:18:11 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 131ms
131ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231004&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e8761ed750ff23a16bc424977c149575d7b041f97d8c95e7651df5a582dacf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12026
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 105ms
104ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePs5,time:552,type:e,im:%7Bpci:%7Btdr:507%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:552,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B546~0%5D,as:%5B545~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:109,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:23,sis:204%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:41 GMT
server: nginx
x-server-name: dt20.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 Oct 2023 12:40:41 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4288 13 KB
5 KB 15ms
13ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1648
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 12:13:13 GMT
expires: Wed, 09 Oct 2024 12:13:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EE57 829 B
1 KB 59ms
24ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

703c370cbe3c949934cef1b68cf02b9940846133198157ef503a3571760a27fb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-D89WG0fpApE3JzAck_AJTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://x.gd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-D89WG0fpApE3JzAck_AJTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 12:40:41 GMT
expires: Tue, 10 Oct 2023 12:40:41 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4288 37 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 19:23:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62225
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14663
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 08 Oct 2024 19:23:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame EE57 0
0 48ms
47ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231004&jk=3776492909807032&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4288 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?PdVfyg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 12:40:41 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3066 42 B
64 B 50ms
50ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvqATdKwi8Vm0ojBCX5ASApxDsQSp3CoyZbiDNW1Q4WCCWe1At8tmFglcYcq-e2UNoJQb6ye3fiwHNiQaBLHL-7FNkVe89ftgQDsYBjwX5qP7YL4B-RrBWSczHhjdgLsPKtCyQ3nn2cJXDp&sai=AMfl-YQMIwo9vSCyIuWgLfI71a0iTM602XGtw-fTl1Fw_34s4JuRmQ_MebDqOhVwyqaaMrKKhKqtpbKQFXtxGYFrYY72UVUA3rhetd4BO55p3SZPgo6NUGcjlIaI9yOi6UhvhDPpZ9aTN8dZQ3M9&sig=Cg0ArKJSzFYp_AfokvYMEAE&cid=CAQSSwDICaaNN89JM3hQXUeW_BrNDyJW0nq65MaN5zwAt52GpjRop6vDoRqjVU103gENVWnj0_EBFXA97D3PscFKK_cIUamQDDAqcogKrBgB&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=501,997,1000,1000,1000&tos=501,496,3,0,0&v=20231009&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1696941640634&rpt=484&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 50ms
50ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231004&jk=3776492909807032&bg=!m5ilmNfNAAbjlzx0w5c7ADQBe5WfOD-OqglNuIyZ9RqBzcTZG12SInAS_l1-pX_mjEWyk9e9rPn5nBxGZZnes1tvVF9PAgAAAExSAAAABWgBB5kCtft15eMgaXw78NESX19OtNBpc4azfQD_0MgpMG56paBjxzGpfl3-6iVuKXLfNBargptrFenz2PgLmbpicxdcKWK1wyc0xsnUPxbdzr64qiKLlzRwfmoDymi9kbLcNR5_MDlDbcTeDLDxVGosvurF1-dNV5tog9fmUtaFW0k2rD0FCKp5gv63bWLRy6XKP1Th-eEcVFjA7BrhBvRg6SFhBmGe7xVCw3UlWuWtAbjDtrxyhSFGONsXHwKIVPWA1ei6VvPGooNuDKnoh1JEM-5kRLCFpXpzUkJ0aRgZSMygzWlyIT13Apmd8o0nlRKHdRTGCXCV2HYdJvNyIqqrJ6dA1Nv8QSKkBVjC1M7qHvrNl8coAIFkJ0jG8fmTPPLt2erSQ7q8oiA8dEoWbJwFbs8se4IK-vOUCqi1OKvSToS7SYzDPTbOUU2mwDAC-GxcESsuRqv2bRaYe-d_i4O-ZTHHNolRgNUTzjmc4d5YYIYi4OvHxI-f0v4Pg3_BJVGu8hODzIjhcsb1hSw6q0BCUrNtV1vCdIielfROM1WLooriQFTqAbVxau6RX27jvmQspClOBeBpsfcIXFbsqF_pn4WKi5Z01xDnqIruCtqXYSmf_PwzuXH5yNNBQGGWrhJX-MWFQtFP_sI4bSclcX5kxoV5dJY09NKpeTLs0Lf3bs4Z2hTPZg-nKUkE4porWRi4KJ8qhIOyP1Wpr8zWQUuFWKHzyGENQn68RnmHVwI07c6c0wXwm8f8wrkHwRFhZPum1ntzCwXSP9viSxVUKl-6WtxgQ7pcfe_hQxCa4z7nruR2KMk5axQpWkiWag40TGXir8DNU66GvAKu4GbrvJ5wvgp8p1_76VxfCSWrZvHG6rA6XdfykTbTXPhJEMQmmKYiYjEBHwzT2nrDl-uYfpd3MPqW3wfGRLqVRg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3066 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9612986470241&version=m202309260101&ct=76&x=1&cor=47316990526281100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 100ms
100ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePLc,pingTime:1,time:1737,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D,%7Bpiv:100,vs:i,r:,t:736%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1001,o:736,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B730~0%5D,as:%5B729~728.90%5D%7D%7D,%7Bsl:i,t:736,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:108,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:23,sis:204%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:42 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3066 43 B
215 B 101ms
101ms Image
image/gif 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1474271&asId=f7ac32aa-5150-5ec6-f2de-b65ae1839a5e&tv=%7Bc:qEePLc,pingTime:1,time:1737,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D,%7Bpiv:100,vs:i,r:,t:736%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1001,o:736,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B730~0%5D,as:%5B729~728.90%5D%7D%7D,%7Bsl:i,t:736,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:108,fm:tShQbM5+11%7C12%7C13%7C1411%7C151*.1474271-71242846%7C1511%7C1512,idMap:151*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:23,sis:204%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:42 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 204 collect
region1.google-analytics.com/g/ 0
45 B 19ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-K53RX1V2LY&gtm=45je3a40&_p=625649420&cid=178216782.1696941640&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1696941639&sct=1&seg=1&dl=https%3A%2F%2Fx.gd%2Fview%2Funsafe%2FfvMWJ&dt=URL%E7%9F%AD%E7%B8%AE%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9%20X.gd&en=page_view&_ee=1&_et=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-K53RX1V2LY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://x.gd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Oct 2023 12:40:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://x.gd
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.x.gd/	1970-01-21 00:07:57	Name: cf_clearance Value: LMumDY6kKcdPQcyT1trxYes7NQly6ikCYZ5aQIapDmE-1696941639-0-1-751bc84b.fa754cdb.2ae1a5c4-0.2.1696941639
.x.gd/	1970-01-21 00:58:21	Name: _ga_K53RX1V2LY Value: GS1.1.1696941639.1.1.1696941639.0.0.0
x.gd/	1970-01-21 00:58:21	Name: si Value: g72qfw0i
.x.gd/	1970-01-21 00:58:21	Name: _ga Value: GA1.2.178216782.1696941640
.x.gd/	1970-01-20 15:23:48	Name: _gid Value: GA1.2.1142234889.1696941640
.x.gd/	1970-01-20 15:22:21	Name: _gat Value: 1
.doubleclick.net/	1970-01-21 00:43:57	Name: IDE Value: AHWqTUmDTBzjAluGTZZETvJSl538qFNsu9GETL_EzWxmnqt7byIhFmhJ3c81meSX
.x.gd/	1970-01-21 00:43:57	Name: __gads Value: ID=4f836760dbd2f863:T=1696941639:RT=1696941639:S=ALNI_MZdzv8lawrj-CNDzT7mo7ubp7T51Q
.x.gd/	1970-01-21 00:43:57	Name: __gpi Value: UID=00000c9471caa604:T=1696941639:RT=1696941639:S=ALNI_MY2ls2i_aeX9-5lIjNvocLEymnbxw
.adnxs.com/	1970-01-20 17:31:57	Name: uuid2 Value: 8879938776982842242
.casalemedia.com/	1970-01-21 00:07:57	Name: CMID Value: ZSVGSBrIm8YjrGRWpisVIgAA
.casalemedia.com/	1970-01-20 17:31:57	Name: CMPS Value: 1178
.casalemedia.com/	1970-01-20 17:31:57	Name: CMPRO Value: 1178
.doubleclick.net/	1970-01-20 19:41:33	Name: APC Value: AfxxVi6Zwi_OYdkVBh35_ZbdsYO1Elxm9HRrk1EP2TAUR1rZcX7-9Q
.adnxs.com/	1970-01-20 17:31:57	Name: anj Value: dTM7k!M41.D>6NRF']wIg2C$Gp/Q)>!]tbPl1M>e)ZlrFUfJ+tGXxoeL+/J[OV'ndQ/U_^N9BbuaygL_[8.:b[DU]MbpRzqF1`*b^J%)nK$6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bid.g.doubleclick.net
cm.g.doubleclick.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
fonts.googleapis.com
fw.adsafeprotected.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
partner.googleadservices.com
polyfill.io
region1.google-analytics.com
s0.2mdn.net
static.adsafeprotected.com
tpc.googlesyndication.com
v01.net
v2.x.gd
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.gd
104.18.27.193
104.21.46.170
142.250.184.194
2001:4860:4802:32::36
216.58.212.130
2600:1f18:1aca:4281:46cd:d9d2:4aa:c72b
2600:9000:223f:ca00:8:48e:53c0:93a1
2606:4700:3036::6815:1123
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::200e
2a00:1450:4001:81c::2003
2a00:1450:4001:828::2006
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2004
2a00:1450:4001:831::2008
2a04:4e42:400::282
37.252.171.149
52.30.24.178
64.233.184.156
01be5c3fa76587c1689c66f7e9bb394fc372741e0c4c7e8f397de4a548a4b9f0
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
0a9ff32d85258ef227ddc9a6763db635f084caaaaded2d4b28bb98ea0b1253c9
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0dfe1f9ce8410e9cd1eb921153319aa98dd53d12a6e4fb0efca81ab345bda814
0f2cf005dedcb9975f17e93dd5b354f1279921dd3f85a66da1e3aa591eb5642f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
19c834f891914a5f888e3f9bd06ac2e2accf49ca378d78772af9b23799deba41
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e8761ed750ff23a16bc424977c149575d7b041f97d8c95e7651df5a582dacf9
1f025961b53d26682cd1ebc7a8e1225bbaf2517826bd0703c0d50c2f7356581a
24366c51064fc57cb419cc93db561f43bf3461affb1d04deb4d552a7e2ba4956
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2d76d4eb560f3f07393988e9f8f8425791f26d0438483c222ff53c73b9900be4
2f92f0adaf2370f83fcdb0a2001f2d1fd3192982ddade3c9e7853735c78accd3
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
320c83a2ecf5473795e1137deb93090208180cdb0cf8e7f6dad1a1f1aef35770
336951503a0ffc84310fb5345be5eaa6f9d8a2bdfad0dae493cf3abce96b425f
39488b5646fd7a7ba52a4e1a67c4655730f91b93c6681524e4c581090fabb716
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3c847609f754f8ef61726942bc7ebd8eab9334f79bab20ce2bece9c73150d6f3
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bb740ceed140679c16224a106c01352f017684bbbee10376340fcaa8578371b
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4fcc2c45e5c8be67198b1d2c38bef90e3373e59b91be75e915711bfa7c10d22a
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57fe5d68d345e4df7c6f2c97a5882e08cd679f311261860f045f454abc068d8c
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6cae06665d26b473f021a9a237bdda85b6c0a725529f6bc8c7f7853c1d5966dd
6cef9bae76758ab5dfc858064f86ef7c7cc896c74ba6a266b2e97f191e49fe89
703c370cbe3c949934cef1b68cf02b9940846133198157ef503a3571760a27fb
71620f57a772c04244170561127e0a11e3d25ad5006cd8c9d952e1b2b1668681
729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc
75cdd2b07cc10b264cec6ee65e857a721afa6e0fbd5d1f7a1bd4f67bf16d5c65
79012285b56d1fd455abf8f5bf09d3e8820f41d8233094b527a4781da1e6443d
7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee
868dfd97cac2c7206fafc3d400032fdaef5f11f45c503cb2685147c5b7a3b50d
871a7b8bcb97cdd205338833653c0370a8211208faea841eb9b305eda7140b69
892f40e3c7296cbecb37b1af01f727850abe65a6fac3b9d2b7dcede431a1d089
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a4b09660a66cd340dc87828ed48f054b5d777483622d59cbe5c6c95ac8d71b12
ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb91a256d2278323b0d197ffdb7c8e2ce3d1538ae6af22e8014341e1490af2a2
c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47
cb55c65f6747f9b69496d73e248401c87e43827f6a70b55b4603073a7da7d5b7
cddd430daf998a276a353cd4843121656471f245a4b3980e39898cef714074b3
d68792895f86c25ba4927823a2bbc062460c49c85d30003fd4795c26becdc51b
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d994f746285f65e7bf7720c4a13207ed20b5aba2281c40cc72646a629f0f32a4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20
e12b805d2a18703922add16c904fb182e55e0d1ebdf9348bd4d0204fed7f7584
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e92bb644cf1b22aeb26864f8f977c46fee244a8280e1aa87c39cf51a8095c619
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f78315c8a89ee0cf5a8ec5b5e43afe3900ada5057e0881e97495c5c71608be42
f88b997c25f00d059f449ab79d245018b3287f01a9c07f560ee59f4c1650a79a
f9d63d94d11e65be863b3a754ace1b9f2fa71e5e874d7b0ad2ca3e9a831cf3fa
fea062bbd2df097caaefd466405b7184f36f347a785806fd52da9e420d3f4069

x.gd Open in urlscan Pro 104.21.46.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

96 Requests

94 %HTTPS

70 %IPv6

16 Domains

24 Subdomains

24 IPs

4 Countries

1728 kBTransfer

4419 kBSize

15 Cookies

1 Outgoing links

Page URL History

Redirected requests

96 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

x.gd Open in urlscan Pro
104.21.46.170 Public Scan

Screenshot
Live screenshot

Full Image

96
Requests

94 %
HTTPS

70 %
IPv6

16
Domains

24
Subdomains

24
IPs

4
Countries

1728 kB
Transfer

4419 kB
Size

15
Cookies

96 HTTP transactions
3 data transactions