asura.nacm.xyz Open in urlscan Pro
2606:4700:20::ac43:486e Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
an-x-request-uuid: b4d90b22-ec25-4224-a030-5502e146e96f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBHGKTScjC5Mi7xEzgyAwps&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5E71
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

170 B
188 B

34ms
33ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

Requested by

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
an-x-request-uuid: 13796525-6125-46a1-984e-06a0ca786d3c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DAAE 6 KB
3 KB 12ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
expires: Fri, 16 Aug 2024 13:01:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F6AF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIvxey3tY9wKeihzKUiW27Q&google_cver=1

43 B
766 B

9ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIvxey3tY9wKeihzKUiW27Q&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY6vrNxQEwAQ&v=APEucNUIQJ2GYfpkqSFvzxwmj981W_YfZGCT-B6fhMgNCUwgKmsGIb8b4icX81y1VH1m-JDU_fyOdaMWehQxh9SQ_H2aLRgTqS2mMIuT85LQaanywiXMcqpZVPUCx13tjwrNQXxM7Y3yHHHWKeqVjgW95lYmRp9pxEWcA4M0BPi50G8RfBSNYZI
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIvxey3tY9wKeihzKUiW27Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F6AF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZN4aKxo5rluYf4iwTO1hqwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1

43 B
766 B

20ms
19ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY6vrNxQEwAQ&v=APEucNUIQJ2GYfpkqSFvzxwmj981W_YfZGCT-B6fhMgNCUwgKmsGIb8b4icX81y1VH1m-JDU_fyOdaMWehQxh9SQ_H2aLRgTqS2mMIuT85LQaanywiXMcqpZVPUCx13tjwrNQXxM7Y3yHHHWKeqVjgW95lYmRp9pxEWcA4M0BPi50G8RfBSNYZI
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame F6AF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

43 B
834 B

20ms
19ms

Image
image/gif

37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY6vrNxQEwAQ&v=APEucNUIQJ2GYfpkqSFvzxwmj981W_YfZGCT-B6fhMgNCUwgKmsGIb8b4icX81y1VH1m-JDU_fyOdaMWehQxh9SQ_H2aLRgTqS2mMIuT85LQaanywiXMcqpZVPUCx13tjwrNQXxM7Y3yHHHWKeqVjgW95lYmRp9pxEWcA4M0BPi50G8RfBSNYZI

Protocol

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
an-x-request-uuid: d054c018-ada0-4f2b-ba08-083c6b6ffc96
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F6AF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

170 B
188 B

24ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

Requested by

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
an-x-request-uuid: d7f0e943-03a0-4b8f-b14c-525523b20f01
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7552 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
expires: Fri, 16 Aug 2024 13:01:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2611 0
20 B 106ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=131719352829&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2611 0
20 B 106ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=131719352829&version=m202307240101&ct=76&x=1&cor=11534396887913978000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2611 104 KB
40 KB 63ms
63ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BPwCpv_m1AWd0ZlP1MLh_1zJV3kqtioLUwQ63wVCsRTGwpOnPW765QRH_Qj9pH3iSEl3B8VOKTUzTLURGv-q8K5d0yku6gh1s7iWcIkolZ4luZtBoD94wvG4GVFpqW4N1JOLwRSVKVEbgjpZIEn497xpokAtEwvcE-DlZ24F_vB-QqN_Y&dbm_d=AKAmf-BgKSw6oysDQVzEZ6z3Q0NIL8A-p75sL9i_GArPa9DPPvQUh5BjohhPGkaxZFYqJROJWeZsruk3Ws_CJra18nwevOLCr_ED50WHurtiis4tjEUhLMdkclFAB9pC7OEIY6BZuU8rJlT7bsXa99yTRmJ9-MZixjoQxikvSwrAzVDeqgNPnSJoYtDT3M6RvD0vDWrwC2tDD-psqLS6Yeqcbb26jv8-f1YYS8547QtzdVw3YLcHD8h_koK7R53fCm5cUjjT88RHABFObAHc8dxY6hyp6TzwMCc3CiEqWCWDWlZO9noVqj5eEEpdeu4wVRElOV-DEDGMK5AGuaJeWxqrKRZQf3I7PCqdVuYPWEI7Iz_iZSJL47uJvdpjSLvqnjkNRfOyKbpWD7ixac04CZnkcjnFWpLAMl4neSFUsjY60O0_YhRb3XSbSjilvqC-cA4kH89jbFYTteFxwbYGd4YDcCYTMED2A5scQHgqTMoe5YZcc_ubSQgPw_ocbQB03Mzas6sFCg-jQUpl4gRi05I_uYik53EFNNk7FNZMVPAJEsgsm0rBJr3OB1DS_de_BmB9SvzgCqdR5V9lJfBmKtf8V8kb0T_sz7JbZbCFx3K8iZKVOZverOvQ6pg0Uz__Qm8k4HKSF94UE6_ZT193CHXfjev5oXc67CZPrUBxkBDVP_DoMGZfwpN2gjjr5i4_jnApOiH0RyZS19YGBIAcRB293bLZyJwC53-i-wOJkiqKUBArf0QAB8e4wy7_ZtA0-GhNRHFBuz3SKyv5GXGF5UT3ROBV4uBkbFUDg4VXp34_FIq4yxIHEsoqkz8Vxz9v2vjilymHs3WkSiaClrj0wF36xS_rgAL9V4P8cOOcvC4JIJP8FG96QBwOEv6RMHk2_q52csFkATVEbdxJ3Ibzj0PDcMdjZfBfTcmryRtjlNr-cVz1IDEMPz3eWCJDTmP0gxYdb7IiLPYvp6wWpfMZILa_RAFv2RvbtvNKt5SX06GWPtW7AFL3O2sikSP6uIwEynebzwauBG2bwjXeewEmQ9HcFEnqw5zyEI-LJEg7QhT8ICA_9hVsIX-whxjixUz_A-O-jYfC3X_tlD2z_K4wKbniXLAOHrNnQ5uyMYa-n65JUJ0B2Hl3Ni4LweJpZucmlQcqZZs3MG2l0gWzHof6w7tB5JtEj-N18aZljK_X43j0wadypwQV0Hj0F0vUra1amFVaKH8kj8FS4aiYxSyt7lzS3g-mC60HbHUdhkDih2-SaFqUSUqgGczJpr9q6jABUVII2wCm6AECYhR9QjxMJTzlWIQ4_m6vKt-QJn3HPrupDbdLT-h_gm7kYfYhP-SMeZtI-We97KNpatx0q9FwRBuUcZOrC9jyeeTR54MKdKKh8Akul9RrikDzp5pp4nRImxOSCU0irlHA1iyHb99l1Shoxpe2PkZOE69bp3pd7hnAFxCbWjcSiTDqhGjpgVzrXzs4FgSOp-13OJPikjkASpDfbbKBwZD8PxRdZbYbQgLnQLkuf9FnOaTeS94cTcyquu4wzweiybSVSbO59BH2axakJCEaTieZcL68TCWjwNO841ZH-EwWyHnPoqx4yHsEZP53P9OHJGrqKt3Baz9Vl7zXopmk7ciW3JFP-f2qi87mGAkYoE8iULQcHKuhOxD8cNividGzkHgfKv7b5gtoKyiW9KLAJJLkaxUMV8doExQHEcEbJNvJL0JTfCIZJW0XQ9PCFy2Yh2FumQqsbyytr25PwKz0HR0qo8j7J0A0939klXEn8Me434HFmZNJsgb03n8Adks7CMcO9KgRhFcPk5XbzZUGAKg2upfmJUSyTYPVtYcuz3oXjSvZ4SmJPw2pRLrNjRe2WYRshrq3aP6VPBZ4dn2jwMBctv4AWj5rChqBej65CImpInR7MNKhxnmV3nUy9uPQcIm8ZCK4CltRbioFPWD9Ih--yBNH70hLbPiZjDI1ym0SNgDzNbtnQygG_4VwVxrvL8I0u79Fas2TAt7lE8tvGPOUI40K12vWhioUUD4-fAgAypLdvMD-_-30mf7tbwneO_cKxvlnoi60hK-OVvoqvdv5hqjnz3t_-_1d2Sc9FHeAlmK7QNvL76s7_YMvbPqp0prH5T75xRtPJ8vOE7tL9UT7v5k0bK9ZF2jQetBZ3CmXZaTaXwNPytTvQMP-R-BseaH7nGoRA73AQXo_5UWR6zGEajcZkXGGyWHHfAVVNhDRkG8MKS5FxbqkHOfG3ok_0QAFEKvc-yJ3aSVXJ6AtyBIOFvrVYakZJ9Avr43emKQPM1xoAp5EVrkHBGUNXTrw1bs_J1g-YLIgb_kHClyo-pghQ7iWIH7KxUM_vqLUFQWQsH3Old-xeH0Hx0NboI1G5gKZdKUDlPOMg4qoznk6JxoHp7cMeWErjRLhbPR5zuAsNrK9H-gclG0ZPa5emCpjUE6QXn5mR8cWXsbw2h0F3qLRet28MwF1riYoV22Sn61qIAc64kRWycOjYbicgIQ6qZlq7k_tUnlEifreBcIc7s1I6ONVb3KtpAIpY3cfTwZAYEyYUN-AomGMxVi39UtylLMPxQS8iCS3d5NMwa8ae_mhftLal-jZuc03dYt-7ImRAgbIr7pe-F6go4p-y3Aml5Ir3c17B9fDaCnIMCZCsXWKiBefk72B3JC8pB90QzXIYVM_kOa7hYc0--RyQrD_ow4F3rxlQoe9X0KuRc-KYctcQM4bNnbWZfqQNajBRRl_NXsj67PNIRb24yl-Keqyn0V6X10CKJ9i6agwf6KRgB4-ynXhmBeWg-ZIHE5eEI2fFNVwnWyxDiEuBIEQp05DUk37IED3Z10UXLtGuQMTuWiUg6xKsFfvAzefdfV0XkmvmDvNDZb0TJ0gk7Baj_WAy8vjH4MUNu2IeZ0PvG6qLTucEOd02geh3jM9XOPdbgKSXXPN3FxhkN2IYFZ4UPLLTVCIp-vKg-eyY7s0Fhl0tb4b2ZI6f_yvQ6d5eZH1DsgDZn1ijOG_LLT5BVtdZZR_p2ytOCHh0iBBLAxtNXwx88aa_2l7vIc9UvMQSPYeM73LhstGLKhy-NErvRlxS7AIWoOFNRcxa1yD-TmCpuXsAZvAGyoIvQLMjil_Sn5rTpXUuPRyZ-tMIi-bs3O0x6sMGC0tsGpq5k515XAFgNuFyupXt4P4YrTRM9234uqqscTFuDKy3yW7G1Wv9j7TswGtcAx4uk--fOfd0aZ8UMEz8jRDGUib_pHlVqSa8sQJoKDBF2_AxHjmn1hq5esrg7l9xqNdc0fLbvT6sA7LM9XlUTvghBgv4Buu6kZ8n-T5LcTgfY2sNeDnxfgQ_zuQKjkYyBJKimbfs--CJW_l-COZlELg5s5C4PeqftQpDIZbKdFCyZEl3jIC5KpdfhtCqyte29H5nmK877sTUSFwdFt8dMO2Iw8Qx8Z4gO4dcfxL3c2L7Yj_b4A9bLmNN6PyFqC8nqobBEEMPJDI0rsbJOgzvy1C5cdoq6VJ-TMsVL5S5mixSzM-OEm2rzRfYGq-rT0-6Ajso3ZCVOlTnAzYMIrF84PWSMvXMR_EHXFTZRwkV-u1LlgA-uawb1kuPR88MlguWIco1jcrxWVsY2kwKWZm0f2bS_ICze3TqTrNHIAr1_naMDdgcMk4_d0TlF5GurV_SVsv6Nxshfqt2LDTL0KmkcFQGcpuA3DaEXcTSFY9juQ50KjxKadeRZp_tyx35ZUopwUiuzkjwwXsQFD-i4q_C-md-iNKmXGtapKaUvuHBS8Vw6M&cid=CAQSXQBpAlJWF9lrcp0yMIUotg2VLlbqNoVXqefaHk7yLO5TkUkeNjTCB28cyaOA_1DIx7_671RKs6OhgPupRn0qyqP1D0ABl47Gn2E8Wt3qGk9JbuY8rs028zS-8FHmkhgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=11534396887913978000&adk=1033480531&idt=82&cac=0&dtd=18

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ac2945f8ea6e8870e72c7e15962b54a7b888c51de28ab1e99f492c7a9928cbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40603
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7135 624 B
242 B 59ms
57ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYmtbjwAEwAQ&v=APEucNWzOMeued8lFnR3xiVM9ywJRIz7jpcyLmENtskHdPTXF__nwWZWaymNeaOBjwkquVtO4wczKahkF9oG8PHY6ZxNHYH68KHBG-y6pejjSz3Pgly72aYJWB-FScaEbyh8rcFVp55U2RrhUaZ3dZnKpy8WNco2p1sPTWpnbsBDYihZ45VLJro

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C823 86 KB
29 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C823 42 B
63 B 117ms
115ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BAwebV-UxYrrlZVLTVKG1PJZqwxk5ieDXR-xbR8SAdwUjGW-uyf59TlDrqNli419nqTbFLVz2wINKwGEkLv2SRX86iyRik9r2KMBSoLi573x8fVT8

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C823 0
20 B 117ms
115ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17176512546772646246&x=1&ct=76

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame C823 3 KB
1 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 09:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Aug 2023 09:47:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame C823 20 KB
8 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:16:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C823 0
0 16ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR911Jr0VGUqlHxREYC4OTVS7JI48H30CoagKx6X5wurZLaPddjRCQQGMz08kAyxRta-e-q0AakYvkVGe7rH3VV1oqW1g
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C823 180 KB
56 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ae55fc0ceb8ac07f56b87f7886371e91a57dafb6ee5154f317b7bb11da12a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57620
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692185840427238"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 container.html Show response
dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A8A0 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
expires: Fri, 16 Aug 2024 13:01:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB16 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2438915025551&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB16 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2438915025551&version=m202307240101&ct=76&x=1&cor=4744279507072988000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FB16 103 KB
40 KB 52ms
50ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DZB2vyfdBKSrJ3xVXO-Qc15YY-ZbzphO5MEghZU_R7NqA2vgCAEL9XW85kpCHxv9ZC83r_w9EOY0LmykVL81htxpPKoV44ptyeMb5O647ZWcm5l0kVOTvzuSuWv1xMSZ6M6WDyGQgETWXgEv6eh3172TPbBx6sSLo_DM4aPa_dLUhDrpk&dbm_d=AKAmf-DT-1hyIhdedpQI8vYmpmDIwPs1lPUhGFTAeHEyo83O92cfupHKI3fsyjaWzlfYVcjJruqsmdxPsi7a8hoWRMejaC0LjOp_GF3FneVMI_1PG5f26N0AXssyUhNn78sR3VQMpdwqZz1Ssnc4p6FFz0CodfjbT9uBptCVbrf8W4fwn0S9t1hakD92le3sFYLhrDpH0O01u-1ArowA0wXrFD_xaezhyM4aMFWn4QGFASoER7BNiq3aLAZbDcBfNTpQgHM7xGBPyFW6Vgt5YrgYNl2zDCAtYrPESZ3vXj0Bs0qdkiUIHO0626tYgKrfgw-oTG2QAJt2U17mB7YQGYsyumd3Qj9jPXMKGumIP3lE0Mf21qx8fH5hd3bGJsb8_-8dy9u2DrBxzf5H25LIDtXFxZ8iO60NEYE_AQGBJjeqt_YUTkQ66zoyBJXOLZDQl0hXnyPsoWRQNgsrkD91O1oPPZND5E4iMauk4C-97EjXzsF8pZcnNqQLi2gJVqRnKhIFrOb7WVs2PQtQD8Vg2acPqntqh9sClWvHN1P2jPbzHWIj9qcmqZZLXxlkKcUhcUz1id6E6jwMcSCb9byixXJlfqBEcfxPQnX7qhP3nRnQDJRJqFNC3vPdA_eJxpVRXhESkQnKS4xbERvBEYHsxM4j9yVOg7U2nh4mrmaQpRafVkP5KekQbQYHP3ZIkmoSIHA0vZZ1ASmD-ebeGvZBJ0nDIdqfTwgxVjPkB8ZNLrUyhNuQ8_AsgVMYobi5MJipPTIh7pwQzYJPOVudQq8bAJ7xHwsfs8K6_76FMMAVLScASw8V3L7wHbN2Ckq85BjM-7JyWgn_FQVJrakyuzHZeOj3tBdKn0H9FA-se9vpx9VjC-f60MVnAFCbgWaQm4XWPdZ2EKZEp6ZGcrKtjiolhSXZTPNSbw39mshO32eOT1uKF-HGq2zi62YxU7m-HAyvnPGiBE9h7m92IxQogsE1cDC1twu5XkanPTBeBomqecWceWBkNb3kabn5DHa9pnwVX4lqclyy7VX2aUwFDEmcoWKLg0SH_jQXF_OHPeFEAKAgXSTnrLPuxtDtKZpZvPLEOlUHgVgCJjAvE7BLb0xxTDB82KMJpLZq-blMUuBDNWoMHVs0-DJwpblgfLNyn42Rz92Uz47zHjFN2SmXGuJSydQMP26mIQrjBmcCxPov6EUJgADXgfUhnNfHt0HKB2faKEl2ciaI9FYmaMq4Cy0poVFSuyTgBfTizOLgQXk0j--WwEQYxiUiUR8ZPdriocu1VQiiP5QrWTIQlDGtz6cI3QUA94uDPBFcgHReqPV9nGCISu3645t6XaDUqepvCABdIg4scxNguGOgldizJ7Zgckw4LIqR2SyVY6q8VgTVwKlKv1fFTrExSjrDNWyn4b0DfPgg4rSh4ZVU2RRmLXGw-IxLCglQVy49Jd2exR4H7uIqgaFgK0WdGy1vpDqUNS8NC9K-LWviXr00Hcsx-8gLNSVOTCX4qmWSk0eq_NvvuVCwONRBTpj7mCXCV8MF-obeZswPV_clzuyPNgEe_77wmP20SXGhNHzyimVMKE720CQ--3J4l2ZQ_pCKLOADCp16DIHbg_p1fIZuPB_sSlU6mu2QzxZpRfC5VECT_JIe8YQv6NEZQpcULc_5BnxPwnvP1HNE7uEwUcg07ErQk-cOYFGRpgBBGsuMcMJ-oTg7UVHOhqNDUqM64MhtoaeVaMOn6HzBJGdGv3BeCsSzpR3_Eon3XOtejNFVo8AiEmaWnJp-efdIRyhDLvvDAoow5EaAdOS9DDpTDw6eRk1YeQY1oF5KGpLVNtJK2zesBWuFiXmwrp0Eh9vALZeXgnm0W8eqVg6HNvJsd_tHF-QLCqH0VMHGi8ic5CMTAMbUCbsaOfFmCxQQ9lxRu6kDaBhUj6Sch39f_v5iWWo8zgBfRy8xlG3Lahm_0nxMgpSaCEQClPcUzUCZvEL0kmHYtyEmMuByvqa2WpgNg0V_R3gqUizpO9F0nuRfi_Z2wTAgttL3E_1d_YYGfKFyQaHQp7KAGpwdtaXkMQdK-WMYCiMvdcFGgM4sJL6XCPnGbLK4_TNJ4k8uxMj9H76gqq4XD8TahWxcnxdt1Wb-G9bQWhukYAID6hElLvm8Tyg8JMOOu6kxDIpBoTqS_sW5rWMyrXAl-DIGwI5gGenbuzxntbffTOAN9W4PhpM4I50kaF6kIHG953nCXOg3XuQd2qNxu43lNrlpwQ9RhpVW7w-Rebix6-TOKsxJakjxpNuf6e7w-YdrLw44woPq-Ir2LZO3dM8cwbE6DtRAi3xpPAs7Q6tXRNc52z2s0JwtgeKVESAaxc_FAyMV19zoGLOWtXWh94isAdMvggg87rLsboxfhHVMztPchaqy83gjXR97AW49A1lrbwrqTECaOd1OfThg18ckUfmbNvD96g3r6PACNU-mFk03gR_MpE0o2ouZyUHaI2oogEITuQtq2iMRbAswjkPR4mj0s-DesWgzBuKNF2kiM47DtE-uZUeRUGeAm1uYVesUxzhqxxr74yCPHbQHf1BNkCp7qhAF_njC6roY1MWvrFVnhulQKwL_mbSazEB-jlswQRZ9wyIoryDjFiDa3LlHClATSjx51Ic5Ex_Xnkql1lrXwcuDvZwRwuvnx6g0iPCTLQDdY28e8QM8xmE1Yhqwhv3MZIlG8h73-txdhQ0BxIU6FSQP1NAwb3k54ZDjMsV3_J5cd7JcmW7zliTN7ArN1lvIrghi9CursoZKK3jsbmaXF-YkbCqtxPA7b8Ha_T2QeahoYwSLkOZAsE8zndB-_mTssemapfbiAuziFOmqn6w-OPFqhG_NnZYWwI-0KJWhm2KQgYRUe0kq46Z0SyGL1q9vFuoCdXOWU1XJUJ9PvU3ejTd6SIVUGxR1kASHBupehmQa1_7wtHWjXWbNT7FJR6nHVIt_levtnppaUQk1xhzvE69wZ-1BxH4SQLTI7Ic7QBeqKqEqc9xreXRJS6HBDa4V3vHRYUiqdK4159S8Y2k01yUxJZpbqjkQOtilFgE1QvPHuGgFJO9YwbGvjQCdt29VrungHmkFFyPKS7yPAaZhTB-ed4hKhfU_UfxMEeqa-xhvxuahxV8jgYfw3UNBcUyzNn1q36kTLXQAL1dFFUhQFKLoY0FAkRMWwwB_QAUUgpOniAQPlow2VGFIZTbC5_7TV8YGNPFiYFL7RDCYM1V9FXftFu2Benj-PgNh8IAyJ2xAmej1RgQHmzdpgaBXlVaxjG_hx5xlSuRS4A8l5_ZrJQFxo8AKW4bqgmeJ-4gMSiLS01waFkokF21xkYyZEdTjBCiulIVBVDAwTQa7_wlvmHVAvsObsj17tIb349aJj48XuGF76xI9LVcSKdwC54zk-FDNRFo7BVKtAfw6q_rKtijjt6OKOreST64TOZ_2YWlC5cPBzzrrBdM91rRpO3juiyJ_lOLR5kzhZQsT5bj_L9BFgRnzsguXzlD5qwqN8g5_MwYsqZQ31T14qZhrY2hi9MgP-AM-3UPMjR8lHE1x92T_xbqzgSnJ4_mG_O_fvoLIlXLdbz-u114xYFOkVhdhFyHO-9aa1gzkGWRvACwBkRD18KicHIXvsPtzDxhq96bSwIWQ8AVXh3RWAlsB6vkZFfQhier8DKU7SzDdolwWpVSSsFpW8eWhYx_NRVyWK4GNo8aIoYrX4IpzFrfJdOxw8IgZYoniYjYbq4ke-VTBcNiPr1oyoMsC-w&cid=CAQSXQBpAlJWIByyRSKku4Xe5Htc3e-YdLt1UNJMcaaBOuKND4xLmdupQ1qtTRAwU_s60duo-nKTNAX-g_mscVsz-oRGWEP70Algv7eWKQb-dMKuvSUq-dfyW6No3nKeABgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=4744279507072988000&adk=4188270525&idt=118&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c8708e0edde638e2f6a4eb42282be392fbc6997a9000e8c3f38ca1be427fef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40542
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 78F0 624 B
242 B 52ms
51ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNXWnqoyWrGSHS2VQ4uddPCJ9E7wkE9E8o5acqIGuP2_Grb6FPTocagSZy9z8Z2Z2vwoNu5Nac0RY8CvDTYqH9eAdQifsjx0qL_pTIAaJzPtod81kZk-wBxXr-5A06_OdbVeM_bQYjI_sybnhulHRB3GM-y2uuEILCnAdK7P8nrPqCpubkI

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DAAE 86 KB
29 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAAE 42 B
63 B 108ms
107ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CRx1h7YjWFmhgyYqjcCSaexuFVFo154eM0EeqY1CScTTu3Qr8JiWJAHRVT2PQvY0bRMacvc6qqH5j5nt3XOjo50CR1xZABFHxmn01lbUJFTZ2xPQQ

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAAE 0
20 B 109ms
108ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=6755888130485903347&x=1&ct=76

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame DAAE 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 09:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Aug 2023 09:47:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame DAAE 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:16:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DAAE 0
0 18ms
16ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRbUx47uKfl10HfYpReZakU-64B1Ewesn1PZGoO1Z24M-iJk95dRZ24EzB1t0cNCGmmOLn8jnTAyZLEneIJLuy211phoA
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DAAE 180 KB
56 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ae55fc0ceb8ac07f56b87f7886371e91a57dafb6ee5154f317b7bb11da12a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57620
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692185840427238"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 container.html Show response
dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7A46 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
expires: Fri, 16 Aug 2024 13:01:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 7862 0
176 B 77ms
31ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Thu, 17 Aug 2023 13:01:31 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FB3D 640 B
262 B 57ms
53ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYvYTo4gEwAQ&v=APEucNXl2voBNyZcMM1Z227u84lAn-vV96kMgdypirtwP8a0eSi4NqCRFUfy4JCTgEtF5q7es-pGPz5nZS8CyFQdvSq2330edj-iUeuwxhIyDh10BE7hJwH89apQPBpCRFWONJJWIfZ2B-wpkMduAcA2BPc434R7DAdfk4uwKuPxR7JC-6NTF-Y

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7552 86 KB
29 KB 69ms
67ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7552 42 B
63 B 107ms
105ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C2VVvqQcdn23b6mqc1ro5tyvklh2sq4SYVIN1m-gUMO1QkH1sJlAq7AxjEl9ZmxZzdQJ7pyIpu8SpcyDqQDbUQhkKBh-dFkdWglaOH7nO3KkkiAtM

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7552 0
20 B 108ms
106ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17177144858868738503&x=1&ct=76

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame 7552 3 KB
1 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 09:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Aug 2023 09:47:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame 7552 20 KB
8 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:16:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7552 0
0 26ms
24ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTUJMo-7q9RGt7R4z12iGpaRYPjRUHy2Jo5z_rJ-i7RdyiBtzuFYBNA63odb9ekbW3XIu6ZXgt0F-bRlaImgdTbmDLO7A
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7552 180 KB
56 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ae55fc0ceb8ac07f56b87f7886371e91a57dafb6ee5154f317b7bb11da12a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57620
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692185840427238"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7135
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYmtbjwAEwAQ&v=APEucNWzOMeued8lFnR3xiVM9ywJRIz7jpcyLmENtskHdPTXF__nwWZWaymNeaOBjwkquVtO4wczKahkF9oG8PHY6ZxNHYH68KHBG-y6pejjSz3Pgly72aYJWB-FScaEbyh8rcFVp55U2RrhUaZ3dZnKpy8WNco2p1sPTWpnbsBDYihZ45VLJro
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7135
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZN4aKxo5rluYf4iwTO1hqwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYmtbjwAEwAQ&v=APEucNWzOMeued8lFnR3xiVM9ywJRIz7jpcyLmENtskHdPTXF__nwWZWaymNeaOBjwkquVtO4wczKahkF9oG8PHY6ZxNHYH68KHBG-y6pejjSz3Pgly72aYJWB-FScaEbyh8rcFVp55U2RrhUaZ3dZnKpy8WNco2p1sPTWpnbsBDYihZ45VLJro
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 7135
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

43 B
839 B

33ms
32ms

Image
image/gif

37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYmtbjwAEwAQ&v=APEucNWzOMeued8lFnR3xiVM9ywJRIz7jpcyLmENtskHdPTXF__nwWZWaymNeaOBjwkquVtO4wczKahkF9oG8PHY6ZxNHYH68KHBG-y6pejjSz3Pgly72aYJWB-FScaEbyh8rcFVp55U2RrhUaZ3dZnKpy8WNco2p1sPTWpnbsBDYihZ45VLJro

Protocol

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
an-x-request-uuid: 83214736-3888-425c-a75a-1927ab7c5cbe
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7135
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

Requested by

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
an-x-request-uuid: 6abccd68-4302-4147-9de5-16bbe424d934
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 30C0 466 B
235 B 62ms
47ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNV55jw44CJUfRfdmc1QzFg9I_C3DCE74HQWEPYICreINSkPKL_qhyEq6M8g4C35Zgu4-K723oWKSKeDvNwMlQZCQbO3ZhlzVRtWJvhiH8pLwzIOLca8U51otxQdecsi3nLHpznQd2nEiX1Um9prWD-Yk3klmLkEPaKbBqarCAY0EyJ7trQ

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A8A0 86 KB
29 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8A0 42 B
63 B 110ms
107ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D1dTrzsfAx4LBBcAfgebkt9rdraA2IdiFiZI5R8eerH3_jgEq1Jxxg5yo19t6hkPpp4ZLNdN5z3khm0QLs71Id0UI1iCxFUflVXCj5X7XriD6EuGI

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8A0 0
20 B 109ms
107ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17006478036250620956&x=1&ct=76

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame A8A0 3 KB
1 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 09:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Aug 2023 09:47:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame A8A0 20 KB
8 KB 28ms
25ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:16:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A8A0 180 KB
56 KB 29ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ae55fc0ceb8ac07f56b87f7886371e91a57dafb6ee5154f317b7bb11da12a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57620
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692185840427238"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 78F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1

43 B
632 B

16ms
16ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNXWnqoyWrGSHS2VQ4uddPCJ9E7wkE9E8o5acqIGuP2_Grb6FPTocagSZy9z8Z2Z2vwoNu5Nac0RY8CvDTYqH9eAdQifsjx0qL_pTIAaJzPtod81kZk-wBxXr-5A06_OdbVeM_bQYjI_sybnhulHRB3GM-y2uuEILCnAdK7P8nrPqCpubkI
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 78F0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZN4aKxo5rluYf4iwTO1hqwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNXWnqoyWrGSHS2VQ4uddPCJ9E7wkE9E8o5acqIGuP2_Grb6FPTocagSZy9z8Z2Z2vwoNu5Nac0RY8CvDTYqH9eAdQifsjx0qL_pTIAaJzPtod81kZk-wBxXr-5A06_OdbVeM_bQYjI_sybnhulHRB3GM-y2uuEILCnAdK7P8nrPqCpubkI
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAyeiGUxLNkm9ep0jIwk2Lw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 78F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

43 B
839 B

7ms
7ms

Image
image/gif

37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNXWnqoyWrGSHS2VQ4uddPCJ9E7wkE9E8o5acqIGuP2_Grb6FPTocagSZy9z8Z2Z2vwoNu5Nac0RY8CvDTYqH9eAdQifsjx0qL_pTIAaJzPtod81kZk-wBxXr-5A06_OdbVeM_bQYjI_sybnhulHRB3GM-y2uuEILCnAdK7P8nrPqCpubkI

Protocol

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
an-x-request-uuid: 068cb2bf-ec19-4794-96c1-4eb438df1b23
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMCEsle_ku45rib9Dzd5V8A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 78F0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

170 B
188 B

20ms
20ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D

Requested by

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
an-x-request-uuid: 47600502-8e25-42bf-9608-09b2fc5aa1cd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame ABCB 640 B
262 B 86ms
72ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVpZ4IwTB4iHIn-ZsBwWqLTTAmbonYn2r65-GV8Bp6NQaF5QJrHrVKi18T6HnS57ik7CM-i_WXkpqcA3P67Yaa0NWjKbmKnHqutnBPkvc7n0MUoDlEgUlQz4H67HtE8V0IBFN_-84y9QthPqp6ZVdI5ASz4MyTiJ411HMgQyvp3vvZumuM

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7A46 86 KB
29 KB 116ms
102ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:32 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A46 42 B
63 B 120ms
106ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DOxFZrWzRg_K-XAxNPoOb7ju3fbrkS5NyIvYRURp9fP09vRonkSe1-5jsl4hdXAaQSTkfFJLDaEpce1fIlteCZk_kFClYRHcZwrrdM45wBEKSaMnE

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A46 0
20 B 119ms
106ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5210450930677131138&x=1&ct=76

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame 7A46 3 KB
1 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 09:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 31 Aug 2023 09:47:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/ Frame 7A46 20 KB
8 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:16:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:16:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7A46 0
0 19ms
15ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQcc3_2jxsDT5wQrPOaX6EWAwO9iqV8MqjyRdUe1fWn67n_IAGVyAYN7mSOHq_e-BSeUNAhHdz53FOC_EZPraTuV9R5Lw
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7A46 180 KB
56 KB 27ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78ae55fc0ceb8ac07f56b87f7886371e91a57dafb6ee5154f317b7bb11da12a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57620
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692185840427238"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:31 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/990511/61634096/ Frame 2611 250 KB
75 KB 137ms
32ms Script
application/javascript 34.248.158.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/990511/61634096/skeleton.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gTc4N21iXMaw-da8UzNDUU
Requested by: Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.33 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-158-33.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 423077ba141164a7b8c0568a57b6dc8cefe71934472b56c85580cf80f0e217a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2611 111 KB
39 KB 41ms
9ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29399
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame 2611 11 KB
4 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BPwCpv_m1AWd0ZlP1MLh_1zJV3kqtioLUwQ63wVCsRTGwpOnPW765QRH_Qj9pH3iSEl3B8VOKTUzTLURGv-q8K5d0yku6gh1s7iWcIkolZ4luZtBoD94wvG4GVFpqW4N1JOLwRSVKVEbgjpZIEn497xpokAtEwvcE-DlZ24F_vB-QqN_Y&dbm_d=AKAmf-BgKSw6oysDQVzEZ6z3Q0NIL8A-p75sL9i_GArPa9DPPvQUh5BjohhPGkaxZFYqJROJWeZsruk3Ws_CJra18nwevOLCr_ED50WHurtiis4tjEUhLMdkclFAB9pC7OEIY6BZuU8rJlT7bsXa99yTRmJ9-MZixjoQxikvSwrAzVDeqgNPnSJoYtDT3M6RvD0vDWrwC2tDD-psqLS6Yeqcbb26jv8-f1YYS8547QtzdVw3YLcHD8h_koK7R53fCm5cUjjT88RHABFObAHc8dxY6hyp6TzwMCc3CiEqWCWDWlZO9noVqj5eEEpdeu4wVRElOV-DEDGMK5AGuaJeWxqrKRZQf3I7PCqdVuYPWEI7Iz_iZSJL47uJvdpjSLvqnjkNRfOyKbpWD7ixac04CZnkcjnFWpLAMl4neSFUsjY60O0_YhRb3XSbSjilvqC-cA4kH89jbFYTteFxwbYGd4YDcCYTMED2A5scQHgqTMoe5YZcc_ubSQgPw_ocbQB03Mzas6sFCg-jQUpl4gRi05I_uYik53EFNNk7FNZMVPAJEsgsm0rBJr3OB1DS_de_BmB9SvzgCqdR5V9lJfBmKtf8V8kb0T_sz7JbZbCFx3K8iZKVOZverOvQ6pg0Uz__Qm8k4HKSF94UE6_ZT193CHXfjev5oXc67CZPrUBxkBDVP_DoMGZfwpN2gjjr5i4_jnApOiH0RyZS19YGBIAcRB293bLZyJwC53-i-wOJkiqKUBArf0QAB8e4wy7_ZtA0-GhNRHFBuz3SKyv5GXGF5UT3ROBV4uBkbFUDg4VXp34_FIq4yxIHEsoqkz8Vxz9v2vjilymHs3WkSiaClrj0wF36xS_rgAL9V4P8cOOcvC4JIJP8FG96QBwOEv6RMHk2_q52csFkATVEbdxJ3Ibzj0PDcMdjZfBfTcmryRtjlNr-cVz1IDEMPz3eWCJDTmP0gxYdb7IiLPYvp6wWpfMZILa_RAFv2RvbtvNKt5SX06GWPtW7AFL3O2sikSP6uIwEynebzwauBG2bwjXeewEmQ9HcFEnqw5zyEI-LJEg7QhT8ICA_9hVsIX-whxjixUz_A-O-jYfC3X_tlD2z_K4wKbniXLAOHrNnQ5uyMYa-n65JUJ0B2Hl3Ni4LweJpZucmlQcqZZs3MG2l0gWzHof6w7tB5JtEj-N18aZljK_X43j0wadypwQV0Hj0F0vUra1amFVaKH8kj8FS4aiYxSyt7lzS3g-mC60HbHUdhkDih2-SaFqUSUqgGczJpr9q6jABUVII2wCm6AECYhR9QjxMJTzlWIQ4_m6vKt-QJn3HPrupDbdLT-h_gm7kYfYhP-SMeZtI-We97KNpatx0q9FwRBuUcZOrC9jyeeTR54MKdKKh8Akul9RrikDzp5pp4nRImxOSCU0irlHA1iyHb99l1Shoxpe2PkZOE69bp3pd7hnAFxCbWjcSiTDqhGjpgVzrXzs4FgSOp-13OJPikjkASpDfbbKBwZD8PxRdZbYbQgLnQLkuf9FnOaTeS94cTcyquu4wzweiybSVSbO59BH2axakJCEaTieZcL68TCWjwNO841ZH-EwWyHnPoqx4yHsEZP53P9OHJGrqKt3Baz9Vl7zXopmk7ciW3JFP-f2qi87mGAkYoE8iULQcHKuhOxD8cNividGzkHgfKv7b5gtoKyiW9KLAJJLkaxUMV8doExQHEcEbJNvJL0JTfCIZJW0XQ9PCFy2Yh2FumQqsbyytr25PwKz0HR0qo8j7J0A0939klXEn8Me434HFmZNJsgb03n8Adks7CMcO9KgRhFcPk5XbzZUGAKg2upfmJUSyTYPVtYcuz3oXjSvZ4SmJPw2pRLrNjRe2WYRshrq3aP6VPBZ4dn2jwMBctv4AWj5rChqBej65CImpInR7MNKhxnmV3nUy9uPQcIm8ZCK4CltRbioFPWD9Ih--yBNH70hLbPiZjDI1ym0SNgDzNbtnQygG_4VwVxrvL8I0u79Fas2TAt7lE8tvGPOUI40K12vWhioUUD4-fAgAypLdvMD-_-30mf7tbwneO_cKxvlnoi60hK-OVvoqvdv5hqjnz3t_-_1d2Sc9FHeAlmK7QNvL76s7_YMvbPqp0prH5T75xRtPJ8vOE7tL9UT7v5k0bK9ZF2jQetBZ3CmXZaTaXwNPytTvQMP-R-BseaH7nGoRA73AQXo_5UWR6zGEajcZkXGGyWHHfAVVNhDRkG8MKS5FxbqkHOfG3ok_0QAFEKvc-yJ3aSVXJ6AtyBIOFvrVYakZJ9Avr43emKQPM1xoAp5EVrkHBGUNXTrw1bs_J1g-YLIgb_kHClyo-pghQ7iWIH7KxUM_vqLUFQWQsH3Old-xeH0Hx0NboI1G5gKZdKUDlPOMg4qoznk6JxoHp7cMeWErjRLhbPR5zuAsNrK9H-gclG0ZPa5emCpjUE6QXn5mR8cWXsbw2h0F3qLRet28MwF1riYoV22Sn61qIAc64kRWycOjYbicgIQ6qZlq7k_tUnlEifreBcIc7s1I6ONVb3KtpAIpY3cfTwZAYEyYUN-AomGMxVi39UtylLMPxQS8iCS3d5NMwa8ae_mhftLal-jZuc03dYt-7ImRAgbIr7pe-F6go4p-y3Aml5Ir3c17B9fDaCnIMCZCsXWKiBefk72B3JC8pB90QzXIYVM_kOa7hYc0--RyQrD_ow4F3rxlQoe9X0KuRc-KYctcQM4bNnbWZfqQNajBRRl_NXsj67PNIRb24yl-Keqyn0V6X10CKJ9i6agwf6KRgB4-ynXhmBeWg-ZIHE5eEI2fFNVwnWyxDiEuBIEQp05DUk37IED3Z10UXLtGuQMTuWiUg6xKsFfvAzefdfV0XkmvmDvNDZb0TJ0gk7Baj_WAy8vjH4MUNu2IeZ0PvG6qLTucEOd02geh3jM9XOPdbgKSXXPN3FxhkN2IYFZ4UPLLTVCIp-vKg-eyY7s0Fhl0tb4b2ZI6f_yvQ6d5eZH1DsgDZn1ijOG_LLT5BVtdZZR_p2ytOCHh0iBBLAxtNXwx88aa_2l7vIc9UvMQSPYeM73LhstGLKhy-NErvRlxS7AIWoOFNRcxa1yD-TmCpuXsAZvAGyoIvQLMjil_Sn5rTpXUuPRyZ-tMIi-bs3O0x6sMGC0tsGpq5k515XAFgNuFyupXt4P4YrTRM9234uqqscTFuDKy3yW7G1Wv9j7TswGtcAx4uk--fOfd0aZ8UMEz8jRDGUib_pHlVqSa8sQJoKDBF2_AxHjmn1hq5esrg7l9xqNdc0fLbvT6sA7LM9XlUTvghBgv4Buu6kZ8n-T5LcTgfY2sNeDnxfgQ_zuQKjkYyBJKimbfs--CJW_l-COZlELg5s5C4PeqftQpDIZbKdFCyZEl3jIC5KpdfhtCqyte29H5nmK877sTUSFwdFt8dMO2Iw8Qx8Z4gO4dcfxL3c2L7Yj_b4A9bLmNN6PyFqC8nqobBEEMPJDI0rsbJOgzvy1C5cdoq6VJ-TMsVL5S5mixSzM-OEm2rzRfYGq-rT0-6Ajso3ZCVOlTnAzYMIrF84PWSMvXMR_EHXFTZRwkV-u1LlgA-uawb1kuPR88MlguWIco1jcrxWVsY2kwKWZm0f2bS_ICze3TqTrNHIAr1_naMDdgcMk4_d0TlF5GurV_SVsv6Nxshfqt2LDTL0KmkcFQGcpuA3DaEXcTSFY9juQ50KjxKadeRZp_tyx35ZUopwUiuzkjwwXsQFD-i4q_C-md-iNKmXGtapKaUvuHBS8Vw6M&cid=CAQSXQBpAlJWF9lrcp0yMIUotg2VLlbqNoVXqefaHk7yLO5TkUkeNjTCB28cyaOA_1DIx7_671RKs6OhgPupRn0qyqP1D0ABl47Gn2E8Wt3qGk9JbuY8rs028zS-8FHmkhgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=11534396887913978000&adk=1033480531&idt=82&cac=0&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52725
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame 2611 30 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2611 41 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C823 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=547975024428&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C823 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=547975024428&version=m202307240101&ct=76&x=1&cor=17176512546772646000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C823 102 KB
38 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cv7zaIJbyd4eI5_FADIn88GH2yimSFj8erRGKp0AXaSd9oVRgjAc5-oFY2ml_3WdPjn5c5OGUmFEm6e7-luFM0M5tLuMBkliSNEHt6rovlKGR4g8BF_gElmlJViKX7Qy901RtdebrriWa3gBuER0Azub9OqakgfGNQfPqXgiW4KLGKDzA&dbm_d=AKAmf-AkGECMnjXGlRaJwTKy9SyopKE9GKdYubCSMLGozpQ30zZ2S0D1I7kYHI0YJ944gBgBPsM2QXzL_Sm9RMeCP-cSMAHi3PIIf9zcga4rqAci-nYZagMmLUPxkDZ5mFEgJuHdktoxSeERNdPjvu7AD6u-lPRkyHth-0eOX5YDDpgPNafu2MEBbsYCVU5atbYixVn_36Ew79DMKwoUj1ng-jPrCnwKHadeO_xqV3ql1AbczwQW_Zt0Ai-nfe_1ufSeoTUIHCBO6Q-CxL2_EncyK8ZUd2KjHM72JSZCAnWy30WNYYzNhG0pEuCF_OGRtnl7P4p9d4mtlZOZlV8aY_JOZw1rG5jfAnU5Y-3_2QQhRQNXwfpY_ytiOQBM2SqOz9RXknUTwr53oALPi6LFEYZDyA272s39DgnG5gMxZnEHIL-e4J04zqt9jDNVb1dJ6j9cO3Vbr7AfT1E4qAIzD2asUcXjlUD1v-XpuXMiPJQRQe4-uus3dMso4sNZzerHUIH1fLbcN5erA6cYzs2bgdIkvpoPxIoAu1BcnR0K7FuCfKFpwydSaSvJaQPrkVy1HsgBX2XvmJRyx9-GPjMpgbxm5jDD-4m53D8WNuini5aU14GSZBOk8hiVAqMWmzdhfiCLwJdR2lTKzKC5d_dtNN31HOOs5V9rGSUENTsJYs9wFSg-HSoS-Gj6FzETq1RrxNPpONBVxNilVWMDhpg2sLXh4WrYhd0xCVKyvFM_LFaVIT-SQmGDvDE6NqpHv05cfb-kTBBNaVk8zSV1fndP6a-cyXUE58LtKM4gtMa3iNcptCYh8lF4a06f2004fRHdB90OexS1zqm7L6EArgFX5rKPXo1T-wL_jxHn7qVZhfAgmmO8_xc9ct4k9WI3O_4E1Bz5B1YGEXqn10PcJQjRHi4OJ1NOX83aJ50hyhwUkDywq-PQNnZJC4jwGvEEvJfl2HFDLMZr2O2EigzZ9VRaPdDbHc7eLp6LNVWELCo-j6W6e5oxvU1FOvfhr3KwhgprEFC-GaDqZh4gNhxtJivkYLmU8_4kiAsUnyw2tauuctjoj1XK9Xk3QuopN3joxx1zBGvmdG0PxB34glp1Yv6ET0Mf9dLqOHjHfEkuMP6yt2svlG63ek8iHdQ-ynFEFUAmkynIAoD8Uci7163GGq3Aq-yEda4QnyIRfWoYLl7v-ks2450ywZqLXXcdlYy_4w-XHh2xAD5gWp6kuxs9NNpiWDsRFYz8bevw2ECwKokalgr_mNaRRUz-LtXqPaxUSl8tr03Emubd7P6tfWfiJqj_6j75PDFzTO_TMxYNmb7JU5r5eHBpL6yTzjTfK38pn5DGRo02oDbe2yNag_3XjY2kccxfr8eZYEjc4OJv3TtdEYrdaPtntn-SV2E6nl0CLAO1q1izvXe05FRAHEYtKJBZzRxEw1ZE2Qcpii7TGETJhrDCpfCgcpfpDHRg1h9DdnXw5-9nalZKYu6-Ujffn5CbOgntQKtJfD8fMjC6DwsWsVao-pJOSfg3tCas-Pbq67Dd8iRfHthuD3DW7wKY2VFInbuxu-zk8CLgHisCQ0Yo5uDUzYV2nYugNztev0lt8FcIDGhIi1H-WLBHwOX9Dax2ZHgfqcQfSx9pXYO_KPxNaIcc62kTNIZLcAXbH-jCd8RGYyR8ZJAC2IuOxGLeJC8nXtoGjHFFIgeqQdQ95S1cW3dcRJfwO-n-XA_Zvi2HUCEz6UQFW6_NSwla4aRyDMP2kTf6B_iauavDxa1tPv7da9JbEWwYaZZ9zbBV1PHRI-PDE9icx_arQvomFyIqQO71Kjy7Rd30vYR2Oz_4iCfn97Vi6zcclZqrdctZgyGCxZI-_xoNS1WlAX6EzpnwfasqOXMKK0lrwHyehAl2kkrb2S5LDaHWMY0FGEJTYkp7AIvzQ55zhYDpmLxuTVm8juVvUVIlDdw7NKHlenAOkGycK4PUpe5x-5iMGk68SKSYUhfz67UdJBj-P53mCcVXVBXKw05TkYw_VDl6yRYFKqGTRnxNUtq5C6IUyMeEbg9gqTxwi5oyNZqJq10G8m-jd97cgMUTEt5KP55RSIRdiFICbcKKMjIeWlSMDJZghPPDg5fNsNtINl5o7ztkmE-WeRzhzc_7dTqThpEyFimvGSIbEKZKvueE-vcuR_1kGQ-YgpXEpi0ATFe33IVH6Z030w-EhJ8-D94RR1h-pkU88XXqugH6BRCxPB8zPxATT6f8bWtEPJS3kb37M-AyAqyLb5R9d4tzeqZSBuIPcER9M09knnw-DIhblfOa4gfTHcxy6ZIwSOgfggxI4iCjCBoN7oJVC1v5ri7TqzwTrCYZ2t4awyZ8do19CuHiraZiN61gIJdmYh-jDmS1_jWXf-4ffQv4qO7ouSrEW3RSDCNM3hbhK9eEtMELrlMdxpJ0i0g_PloFzqnlkHWb1X2hoB8u767q4CD9Ad8So6vWHSDOE8U40MD0fe4fwuQ-LthydzX0U3NX_JgUNPq2bBER4T63FWPXQ-z4scqBCgi5fL-L9b0kqkLbvVnsh3ZiPvEy16uRjZmN0Vx0PPkfT1BvveHw5sCtHRoOkDhfJmVOSivTR07F43JcTSvTslWfynxRlttie6CIEKSteYMeG3ceuG75gfB8itYMX9BvOyMUx-6bXTnKyjnlVUJWFp2LD0QSsQUZEUfDb3tBpfIr6-I_ZXldMP2y7Zo2quc5qhA36cSunoahDtuLXXEU7BiUMKJkIowfQB4oMejEc2j-tVJYrbx2opMnTMrjru4C9wX8E6kcWeQ1CFhPEwHq1EobuWdwgrq_z4onE2YzyiaN-QxYSJw1sIrQaYgTtMCGPhnYmWln9rVZwSTTHsTa7a1Fo9CzctmROgGBDWDC2PX__VKDt6takQ0Pgiw8gybcKVcLIpnw1serwSbJRU7BlOY_hrSUn_NzqBu9C_5uBWNzp-yGyK2ljx2OIROl9Mh3ePyJmz23jRyibFpq5aV2pNqvSWyffwGTPxI0yRHRcZA__a_eGcCr4WX8nZBItcrxJO7bZSZiI7wMGTSYhM2nefcoEXe1WxEfFTSviNCMgaZemsfxGEQcoTv0PXyTz4jTC4Bsbo6NAn7WHvbMSV2hWivi3bhZBX6VclVvWtrf8Uzsy4vXXjgPYSgD37Wu1P2lfK1ySsUohnNduk0NCEojV2VkLx6CxVLZgEeMsDts6FLvLwN1govh8e0yLxRroNZQyp3K5a-ptMmMvkoep4-QuLueiZ-4Qtj00jMYjt40LBuueG93k0b1D6SmqKRGlJqcxl4uKEykUtcELfult1eO7opUTxiffG6Sf5GsmuY_FANUdNg5x7dKYfC1fVT3myTKomg87UHccrYAiB4WNxNivyNPgqe95IRmWqMxkFT9ddXgCqBwhCw7lH0YLMS6hLDp3zRrr6FOTBoxDIJxz98aKiuwp8ZjHzspyPECAIsyNHqmCmQ591A-LH_beO66_Mu8N5L3iLzmRyM71IQUhYzwhlAPOONbS00ajivI0bWPCTtTWmbvHUmeTk-2XmZ987ArUkblI7ZDmZvBx6jAPVGWYjYN3Dk4glCy66nqSlsvNZuT0pse_BC2scJdejPoIS3BgWH8-440FLK6hGQ2egdpKZ8Q8qK_XyItGFFBZBr3GKI-wB4hRvqUy_LMfLMqBo2c0Nj2T9PsppMcxEb4sun63MDUX24&cid=CAQSTQBpAlJW6LY150ybIYE-q23Cs6cJpcaGJnGsb65YCSlzyMQTaras6sF3SmkfPT-6acv9YdzjlboF_A2UpxQpUAjRKrSgvCCCIA8rq2cLGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17176512546772646000&adk=3037181500&idt=72&cac=0&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b79f3b70ebcfadc9d9c902662917fda0965372e704c5168a2eceae25818e7808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38852
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/990511/61634098/ Frame FB16 250 KB
75 KB 94ms
32ms Script
application/javascript 34.248.158.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/990511/61634098/skeleton.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gK6oJYWuYciTwbWLKFnepU
Requested by: Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.33 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-158-33.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: be01d097a1968ff3ad0345839e11cf194284724db2da927be4b9d04e6fc5358b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame FB16 111 KB
39 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame FB16 11 KB
4 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DZB2vyfdBKSrJ3xVXO-Qc15YY-ZbzphO5MEghZU_R7NqA2vgCAEL9XW85kpCHxv9ZC83r_w9EOY0LmykVL81htxpPKoV44ptyeMb5O647ZWcm5l0kVOTvzuSuWv1xMSZ6M6WDyGQgETWXgEv6eh3172TPbBx6sSLo_DM4aPa_dLUhDrpk&dbm_d=AKAmf-DT-1hyIhdedpQI8vYmpmDIwPs1lPUhGFTAeHEyo83O92cfupHKI3fsyjaWzlfYVcjJruqsmdxPsi7a8hoWRMejaC0LjOp_GF3FneVMI_1PG5f26N0AXssyUhNn78sR3VQMpdwqZz1Ssnc4p6FFz0CodfjbT9uBptCVbrf8W4fwn0S9t1hakD92le3sFYLhrDpH0O01u-1ArowA0wXrFD_xaezhyM4aMFWn4QGFASoER7BNiq3aLAZbDcBfNTpQgHM7xGBPyFW6Vgt5YrgYNl2zDCAtYrPESZ3vXj0Bs0qdkiUIHO0626tYgKrfgw-oTG2QAJt2U17mB7YQGYsyumd3Qj9jPXMKGumIP3lE0Mf21qx8fH5hd3bGJsb8_-8dy9u2DrBxzf5H25LIDtXFxZ8iO60NEYE_AQGBJjeqt_YUTkQ66zoyBJXOLZDQl0hXnyPsoWRQNgsrkD91O1oPPZND5E4iMauk4C-97EjXzsF8pZcnNqQLi2gJVqRnKhIFrOb7WVs2PQtQD8Vg2acPqntqh9sClWvHN1P2jPbzHWIj9qcmqZZLXxlkKcUhcUz1id6E6jwMcSCb9byixXJlfqBEcfxPQnX7qhP3nRnQDJRJqFNC3vPdA_eJxpVRXhESkQnKS4xbERvBEYHsxM4j9yVOg7U2nh4mrmaQpRafVkP5KekQbQYHP3ZIkmoSIHA0vZZ1ASmD-ebeGvZBJ0nDIdqfTwgxVjPkB8ZNLrUyhNuQ8_AsgVMYobi5MJipPTIh7pwQzYJPOVudQq8bAJ7xHwsfs8K6_76FMMAVLScASw8V3L7wHbN2Ckq85BjM-7JyWgn_FQVJrakyuzHZeOj3tBdKn0H9FA-se9vpx9VjC-f60MVnAFCbgWaQm4XWPdZ2EKZEp6ZGcrKtjiolhSXZTPNSbw39mshO32eOT1uKF-HGq2zi62YxU7m-HAyvnPGiBE9h7m92IxQogsE1cDC1twu5XkanPTBeBomqecWceWBkNb3kabn5DHa9pnwVX4lqclyy7VX2aUwFDEmcoWKLg0SH_jQXF_OHPeFEAKAgXSTnrLPuxtDtKZpZvPLEOlUHgVgCJjAvE7BLb0xxTDB82KMJpLZq-blMUuBDNWoMHVs0-DJwpblgfLNyn42Rz92Uz47zHjFN2SmXGuJSydQMP26mIQrjBmcCxPov6EUJgADXgfUhnNfHt0HKB2faKEl2ciaI9FYmaMq4Cy0poVFSuyTgBfTizOLgQXk0j--WwEQYxiUiUR8ZPdriocu1VQiiP5QrWTIQlDGtz6cI3QUA94uDPBFcgHReqPV9nGCISu3645t6XaDUqepvCABdIg4scxNguGOgldizJ7Zgckw4LIqR2SyVY6q8VgTVwKlKv1fFTrExSjrDNWyn4b0DfPgg4rSh4ZVU2RRmLXGw-IxLCglQVy49Jd2exR4H7uIqgaFgK0WdGy1vpDqUNS8NC9K-LWviXr00Hcsx-8gLNSVOTCX4qmWSk0eq_NvvuVCwONRBTpj7mCXCV8MF-obeZswPV_clzuyPNgEe_77wmP20SXGhNHzyimVMKE720CQ--3J4l2ZQ_pCKLOADCp16DIHbg_p1fIZuPB_sSlU6mu2QzxZpRfC5VECT_JIe8YQv6NEZQpcULc_5BnxPwnvP1HNE7uEwUcg07ErQk-cOYFGRpgBBGsuMcMJ-oTg7UVHOhqNDUqM64MhtoaeVaMOn6HzBJGdGv3BeCsSzpR3_Eon3XOtejNFVo8AiEmaWnJp-efdIRyhDLvvDAoow5EaAdOS9DDpTDw6eRk1YeQY1oF5KGpLVNtJK2zesBWuFiXmwrp0Eh9vALZeXgnm0W8eqVg6HNvJsd_tHF-QLCqH0VMHGi8ic5CMTAMbUCbsaOfFmCxQQ9lxRu6kDaBhUj6Sch39f_v5iWWo8zgBfRy8xlG3Lahm_0nxMgpSaCEQClPcUzUCZvEL0kmHYtyEmMuByvqa2WpgNg0V_R3gqUizpO9F0nuRfi_Z2wTAgttL3E_1d_YYGfKFyQaHQp7KAGpwdtaXkMQdK-WMYCiMvdcFGgM4sJL6XCPnGbLK4_TNJ4k8uxMj9H76gqq4XD8TahWxcnxdt1Wb-G9bQWhukYAID6hElLvm8Tyg8JMOOu6kxDIpBoTqS_sW5rWMyrXAl-DIGwI5gGenbuzxntbffTOAN9W4PhpM4I50kaF6kIHG953nCXOg3XuQd2qNxu43lNrlpwQ9RhpVW7w-Rebix6-TOKsxJakjxpNuf6e7w-YdrLw44woPq-Ir2LZO3dM8cwbE6DtRAi3xpPAs7Q6tXRNc52z2s0JwtgeKVESAaxc_FAyMV19zoGLOWtXWh94isAdMvggg87rLsboxfhHVMztPchaqy83gjXR97AW49A1lrbwrqTECaOd1OfThg18ckUfmbNvD96g3r6PACNU-mFk03gR_MpE0o2ouZyUHaI2oogEITuQtq2iMRbAswjkPR4mj0s-DesWgzBuKNF2kiM47DtE-uZUeRUGeAm1uYVesUxzhqxxr74yCPHbQHf1BNkCp7qhAF_njC6roY1MWvrFVnhulQKwL_mbSazEB-jlswQRZ9wyIoryDjFiDa3LlHClATSjx51Ic5Ex_Xnkql1lrXwcuDvZwRwuvnx6g0iPCTLQDdY28e8QM8xmE1Yhqwhv3MZIlG8h73-txdhQ0BxIU6FSQP1NAwb3k54ZDjMsV3_J5cd7JcmW7zliTN7ArN1lvIrghi9CursoZKK3jsbmaXF-YkbCqtxPA7b8Ha_T2QeahoYwSLkOZAsE8zndB-_mTssemapfbiAuziFOmqn6w-OPFqhG_NnZYWwI-0KJWhm2KQgYRUe0kq46Z0SyGL1q9vFuoCdXOWU1XJUJ9PvU3ejTd6SIVUGxR1kASHBupehmQa1_7wtHWjXWbNT7FJR6nHVIt_levtnppaUQk1xhzvE69wZ-1BxH4SQLTI7Ic7QBeqKqEqc9xreXRJS6HBDa4V3vHRYUiqdK4159S8Y2k01yUxJZpbqjkQOtilFgE1QvPHuGgFJO9YwbGvjQCdt29VrungHmkFFyPKS7yPAaZhTB-ed4hKhfU_UfxMEeqa-xhvxuahxV8jgYfw3UNBcUyzNn1q36kTLXQAL1dFFUhQFKLoY0FAkRMWwwB_QAUUgpOniAQPlow2VGFIZTbC5_7TV8YGNPFiYFL7RDCYM1V9FXftFu2Benj-PgNh8IAyJ2xAmej1RgQHmzdpgaBXlVaxjG_hx5xlSuRS4A8l5_ZrJQFxo8AKW4bqgmeJ-4gMSiLS01waFkokF21xkYyZEdTjBCiulIVBVDAwTQa7_wlvmHVAvsObsj17tIb349aJj48XuGF76xI9LVcSKdwC54zk-FDNRFo7BVKtAfw6q_rKtijjt6OKOreST64TOZ_2YWlC5cPBzzrrBdM91rRpO3juiyJ_lOLR5kzhZQsT5bj_L9BFgRnzsguXzlD5qwqN8g5_MwYsqZQ31T14qZhrY2hi9MgP-AM-3UPMjR8lHE1x92T_xbqzgSnJ4_mG_O_fvoLIlXLdbz-u114xYFOkVhdhFyHO-9aa1gzkGWRvACwBkRD18KicHIXvsPtzDxhq96bSwIWQ8AVXh3RWAlsB6vkZFfQhier8DKU7SzDdolwWpVSSsFpW8eWhYx_NRVyWK4GNo8aIoYrX4IpzFrfJdOxw8IgZYoniYjYbq4ke-VTBcNiPr1oyoMsC-w&cid=CAQSXQBpAlJWIByyRSKku4Xe5Htc3e-YdLt1UNJMcaaBOuKND4xLmdupQ1qtTRAwU_s60duo-nKTNAX-g_mscVsz-oRGWEP70Algv7eWKQb-dMKuvSUq-dfyW6No3nKeABgB&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=4744279507072988000&adk=4188270525&idt=118&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame FB16 30 KB
11 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FB16 41 KB
13 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame FB3D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1

43 B
114 B

16ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYvYTo4gEwAQ&v=APEucNXl2voBNyZcMM1Z227u84lAn-vV96kMgdypirtwP8a0eSi4NqCRFUfy4JCTgEtF5q7es-pGPz5nZS8CyFQdvSq2330edj-iUeuwxhIyDh10BE7hJwH89apQPBpCRFWONJJWIfZ2B-wpkMduAcA2BPc434R7DAdfk4uwKuPxR7JC-6NTF-Y
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame FB3D 43 B
219 B 38ms
17ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYvYTo4gEwAQ&v=APEucNXl2voBNyZcMM1Z227u84lAn-vV96kMgdypirtwP8a0eSi4NqCRFUfy4JCTgEtF5q7es-pGPz5nZS8CyFQdvSq2330edj-iUeuwxhIyDh10BE7hJwH89apQPBpCRFWONJJWIfZ2B-wpkMduAcA2BPc434R7DAdfk4uwKuPxR7JC-6NTF-Y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame FB3D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1

23 B
163 B

53ms
42ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYvYTo4gEwAQ&v=APEucNXl2voBNyZcMM1Z227u84lAn-vV96kMgdypirtwP8a0eSi4NqCRFUfy4JCTgEtF5q7es-pGPz5nZS8CyFQdvSq2330edj-iUeuwxhIyDh10BE7hJwH89apQPBpCRFWONJJWIfZ2B-wpkMduAcA2BPc434R7DAdfk4uwKuPxR7JC-6NTF-Y
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:32 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame FB3D 23 B
163 B 133ms
69ms Image
image/gif 104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYvYTo4gEwAQ&v=APEucNXl2voBNyZcMM1Z227u84lAn-vV96kMgdypirtwP8a0eSi4NqCRFUfy4JCTgEtF5q7es-pGPz5nZS8CyFQdvSq2330edj-iUeuwxhIyDh10BE7hJwH89apQPBpCRFWONJJWIfZ2B-wpkMduAcA2BPc434R7DAdfk4uwKuPxR7JC-6NTF-Y
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:32 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAAE 0
20 B 106ms
106ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4793362267544&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAAE 0
20 B 105ms
104ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4793362267544&version=m202307240101&ct=76&x=1&cor=6755888130485903000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DAAE 88 KB
37 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwRqmesJrC-JOStd2g_pjyQ6ha-R-w5ojc2qwdmeKlqgj6cExE_L8zn6PR1fojtEmEQ8qPn0MAxJEB8-aqHwCd4NnWoA&cry=1&dbm_d=AKAmf-ArpI62Pfk12lgRbdwWebPpXKT38wumI6s955DQmOMUMYyUwPvQhJw8Bak7-jnpx1tKZeo7j7ZcDTe9J4ccKzjhUwXT6CgPoeIzkrSy4WyZTe3Oc6fSUBrn_YiPsWPuL7WK5RUnXx4c7nEN-7IlxhsxgMGksg3nbty7g16lFWZ3Ghn_r3sSqDjyOr-wDlpvZXTg4rnxjlJeE7SbcbUhGqrXSOAblgs9iNKzD6R-f9V3FbBq_wLDpCXA6LbB8CL7OQuYgT2rvcRjTL6FVhWELAOI20921GXl_d8QYK875K92i61rob_5rsI3Gy8K2j01cfRswq-hX3fauK2QoG3icDF5UWenc16p6MIBQiEz8ptkOz_iqizDLl7b-JRfHMEEvN_0dSI1vt5w7MqfmDGgyOplWPCBe2hdWj9H6LmROfM6RlbuI3QdACOuK9AYvMBhw6CsfPReIkJKQqVHEUeJg3mulpm17eO9i3d1nVNTXsQRK2McvO7Cr1MmatvXS1UAm1wgN7SiGkLeg22sDDqXJeC7Ao8AsfYQXtk0NZRoD9ZPS6qW0KNxKZNDDak_1BzxN6V7JpFOQcEdE-00l6sEWQUB9jXIBT1g65DWdwTljVo_XFv9Qsr3NOrrsNKoy9BJpw6i9mzGw02ul51X2YP9rbTeDcQ2ild0ft3K5E1iJ9F0qWheqmXBogXZ0O07odTcURJJTn-R6PqXMDVn85JAooBCkdrp0Et9R8E1Pwnaw_hBM8EzEOqoF9BS-q4xzhl_dym-9KIDKB1fA-QjnOaa9zU2xL8ZY4_otyOZBMK5Rdl8ngkgcytJyGG-ZfT5L3Dm9FVZIrZm00U1TeEzVyFPPrjI2kp5oKWbIBjK1sND62G2tGAfvpd2zTjW2UN4zTVoTtdzuI7JT5kXFISAvzNoWkwEvcFXWSshz_WiIFWmq9jw-ZGsCl4pK6I8mUxg_CbAwSH24SiZ2rIAjb65MdqNqWPJjUQTbprwHqjEHzLQDMzB2Ln8jL1y9vQgahc4_yOIT5GuCVnfbAnTWgcH1LraQe5SJnN088urTmlmKBXTZAZapY9Gjdo-CyI3fTY7skqxyqwOstc6PVlhP8D6b98qM8O2Ti8S_eGsygGEFpu9OYxZRxoV8ueAa-uJ6MWTVNaRvZZC80QtI_WNFWbIa1C0rq33Q6mf8u2IrRCt8zaDSEeP5BDXMhomfpOxiblAsOvxYbXEuHYnZsUl3Q_jmOGSH5aFaqb4I_eZmVGxhlSgh07gOmNR_WstE7wTKF9CD8GZHEFW_VHeyW8g3fVnOHeEVTc6-_Ved1oKJ1zUeO8u9zSlsvuUW3y9EwKmkTbmEKNkkXbEPiVx_GDjMpHGzbEYYJ-ddMMLlR7KeRm-9M4QMIn8M5Gdqx8cDgCWLdX4FSYJsnahTQc-4Zb6s_YE8Xz2B_9rUA4UZBDDjXA1xUTjrfKFECGcsps76RwqjGXp_TOARPD-0zKFxPSWFZ5R7DOmXdUMf7V5sykd30lqwZAN4kDOMPRdx-31AxkHvYjnJ8rHPJJ6Epvj6rekZvOROcibHiw5qXW0wh2iZJC8EP_gDSivolmc7YBGHhzDDWppPAZzI0vIsCRibA_PwJHbvP0yfKTGv1aRUj35WYeQCepj7QOkzscRk7MDTf5xxMxXlpD02nkaZFibscZ7NPZEWCs4A84YcTt80j6wCAif8adElDXqcLP9MHMzVaXeyGByqX0ljKoGQvMSKBwKzW3aMKajO0NbjR4rEUGIWGXfm8CAfsoIDPb4DNtO2URmTX57prZmzByDZAD4aN7AmbGDhYR_MsolBy3EusZupdxgb3sLO679tq147FBwSvFMwamkobusI_f3L7qDhOFwy461hmsabX25LQvqd5ue92kD-KA6HlvmQPbf9Be9vECfjlV080mN4Kgysvwv9eqxYGYQSMQYfvGIHVgZ4bLZLigqEuDmWK6ck7lzD9X7rtAT2xYz9vysfrzbcvsNCkp2FV-2GELU7HUp9cR4SLnT7optQ8gUUlbu13QrYSZQ8z7pz_lbs-YTRo0Praati2r06xVsm7wpsJL93_TNx1qJhtQb5khU2HwrEXOgRVhavElnpIE1CxhqGqg5wYiq11o7uxk0Qlt1z7Gol_O4SW-UDXS0UwJZeNPklHCLBRPkDDPA_4sbVp9UNd8L9UGNDMmK0boDuLdUBrZn3vIwip8LCqs59GsFtlUx4w55ofPsU5iH7UV9TrlfjG5wZO40QRnllPPBcl7Tx_kUIlS0wHcIEcOL7Ssq5eBGm21CuybxRAfRUvx-yxZGE6ZEsGN_rOKWciLm464EWYHEIXpH3pQMjZ4tXoae67DKdJsnfxhjruVzxe4Wet2poHWB83TVw27rzvxlhrTaYjWXQep3bTl57tc_lzk8Z5yknUzyrTl34xO6O6mKm_V_yjPWkGDh-kZ8xDcO9sTdJ7leEveE7mBG0KPtxUoMD_SjYcvhGOdFQu-2pMIzPyvjZ9EJcxloPqsXhd5owNECkPOhJMYlCmthGMLbIbi9Vy8yZZ3ALlsKq5at5K2MY6leOFxlA1enJljoMJ-tDR4ifuOYJSEWvk1lxSX2kIMAnVz5zn_SLr8bN6LuM4w6ovBbx32rsTHbsPOXQLhxsyQrQSfREalYlIFChU-TX3lxtZcWRPt7zP8LUgO8nNnl9Y1zbZSNV7Wf4AJjjMVS2aLc0Ltch9dy1dYW6iVFUg7wIEw5lK2sPjGUmddcGpmgBaPetX4HvM1LjaMQ3WVyRZt_AtcD_gOcLrniioJsqmC5qZqgwTXZtLPVIKudWGlyH_ahWFYWU_9n5dB5BLxVR3vhgate54tibnqwvpxrPU2cL0HG7Be12r3wLrg5etIMskHht8G_0h5f4GpNJdEcrxh-L09c3Vke3qfWGHB3P8yZKnlk-ybPmp631VUYLq1MICiHdIbQly6uGE7XyKaDWrTgO7jIKqHpON-GyqP3XRb6W3k2ObvyXsF7miPHE3BAOjE06OuhrDW38noXwlA_Rm24b_0qjSf6mbrIfVa1eFa8h3bHSoLsGxKi13vtneldnD2e2CZ589toBRO_tGjdLTZU8oLws9jxtPwjHTsIs_fVjZDtqWwyUmQ9EDKLzW6UMnDiEnkVreo_XsxnIWnR_UHCgQE2VNJ2B5EyVeBfBMz1RDT5gex6E1ExLli12ApOrsv5nQIof9Me1kRF6YFd7HNF_vtvxF25VLMkHlwE_q0-Ul8NzlmPyk7z5iyf7-RzULVJBs9SFh_WO61AUi1fvdrTcjzt9mCpPoLqEEyU98Z73c1bfJJc2NFrBwI8_3w7q1f12PK3zWXrYAOKfuVNX-HoBIquDC4t3FhpIMP__RJxPiOBbS7h5hmbgw88wgAsKeeyy7uI5GdUb09RHdb3uUN2cOPS-F2qqz5pZnlEpVnQYUeBG_0lw9FY-tNuFiUhvnP4NtgUV6DgAKYZLI4N0-lzfWje2OjBdL7rgsui1cJmcjzYkPJs7fmSEcmhC-_9AmQkWOn2SosRIA3gvtJ3bZ2XtdjfwpAeo2xM4qduLNwI0bUpmBucyux4_LHrlrVbMvzLJf5bwRcr1M3CyVsKxCzFDXeGKeGZUA&cid=CAQSTQBpAlJW3Bz4x7GNRcl-UXg6D-yNEyjgZzN7Y_NUs4FCTGbEqDXFnRtKxce1QuD9uc56Q2HrfM_QrMllAtdHhstU01b3Vl5x9e86_tavGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=6755888130485903000&adk=2004672170&idt=76&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77be7bfbfc3cc32fca21d3916f3b7f3880a59d8d9eac9e87fed6e948e53cd7b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37669
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 2611 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ad8c13089ecefe724a02d0d800c4cebd5f71d921c4dcea964cda48c0aec6d1b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET

partner
sync.search.spotxchange.com/ Frame 30C0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEPGetsxg1NAUPQZ_XIS8JEk&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame 30C0 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 30C0 0
125 B 63ms
10ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO-p_psDEOa-zKMDGJjN8OwBMAE&v=APEucNV55jw44CJUfRfdmc1QzFg9I_C3DCE74HQWEPYICreINSkPKL_qhyEq6M8g4C35Zgu4-K723oWKSKeDvNwMlQZCQbO3ZhlzVRtWJvhiH8pLwzIOLca8U51otxQdecsi3nLHpznQd2nEiX1Um9prWD-Yk3klmLkEPaKbBqarCAY0EyJ7trQ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.75 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:32 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.75
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 64d34b57e4b0f53403597f52
ng2.virgul.com/tck/imp/ 0
212 B 213ms
42ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/64d34b57e4b0f53403597f52?g=1&t=gb&r=158661@site_geneli@asura_gg:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1&info=&mt=1692277290670&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:32 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
DATA 200
OK truncated
/ Frame FB16 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4633f9d0f75f2094a567640d11099a3f923da380f28a575273e66b9bdd572f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A1AF 0
10 B 7ms
7ms Image
text/plain 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?UFsDbw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:32 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7552 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1707234391290&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7552 0
20 B 105ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1707234391290&version=m202307240101&ct=76&x=1&cor=17177144858868738000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7552 95 KB
38 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Du8qmt5PHBlHc7wh3UYE5YM_MZYjsNBdQfr362v1SSLGjoa-PUeF8gaazUbS7h_BysXGhnCwOWlTxAH-cyVt2dfYXnp0P4nB4XI_yY92cf-k487sw&cry=1&dbm_d=AKAmf-DtWtTTRPcKECVSzlm0WtplPkyMpvJvD4pPWPPXbz_a2_Oncp2p5Xjlbe2Oaiy47prm9vpyZ_0K_jgK_LabSLfb2DX9LjJ-6j_rGT0eqlZFZd1e1kGHgTy3T5sYzRvNDgRzNsJzRTX5zoakCajGQdLYR5u8G_Mg9Q_2milTBxTN-TnmnC0rWrvmg0nT9ClJScrExTP4I4fN_VIY1bmrlpkgFGKJEBPJmRb2QxkECdxw543eYVTjQWuBDLiObLqMp3CHKoQNOmG9plw4F3MQQceA4ko6jDuJcY737Vy9OCs8uQdGJFfaIHgdlgEV7Z0aQRcQVX_2Qd6BF4rgdW7ZWDgaXGI9dURIefilvG6VS1Jb6dcrZyXPwgR35M3AkW5iAwrG2_YYYhB99iniG_8mMJt6t74D1abF2oUafUvsz5VibZH3EjVdqTaB1hH7XUGnZS59ewfrpntutp4eAyxUIb9_WzJCS7xAOdK93PadcFqUPi6y6a-OqHo1HU0M_vZzUtEceQseDTw-3_Wp38UeFXscCOmRfrbj-EOW1O6SVQkVrlZGrUsL4kVtfbvr_WqXto2Vm6hsROLc6UT0DD3o_xDIjYf1RyABVjL0w5vZ6AXqYeY78of7FRxVhFI5M2PH9o2iWtpzW5dPQtNqdsSscS-v8rUneJkeJUb0n_MPK8UHj0gW4aO7q-LBpWkk96mz44ptrDcAwqjCP_iRyjQ9h4x2G1dZTnECIaPnvph0WvY5VmdKzB_tb-Tk24c6CaA6bV6g1T4oTrWGOtP_vOV1mrEiuHHm8OqcdcZNVca0K61OSVkrRl_gUOfYIASU1X2qOXKyy2cyKjshBH_VLVZNKWiL-SWu1IpLOm-8s0O6QL-R0vVjfMPvILDSVmwCrt4YI3NqTcAkBLygDDf7agq7PcO92_xvXMa27X4ie9nBDS6f-TT7rKPJP3z1m6sNuEhe3qQ4BgAHm6eEckxl2WxL-62BXmj8jfcZxxIKoL20eOVbuySk1fhPmZkSlTV85BEukFMqJ8nzY7KLspMryqpTXnoWCPkoWZ2DvnLbo2upFHAiwEZ-b4tf1CCn047KBbQa-AT2cOxB8z6v25sFUoILoX-Bs5cs-U7iFcKZ6b4Pz2pU1zqISRLLmwwoAJBN2fyf-7pYFvSkgRQo9N6XuXKfvrR8hHXM6e1DjdPBin5Pz8LycjHHtl5UEqUf79ZfNK2HLUmiD8C6z5dbdlMOaOAMgi7UIhAp5MUcXWmJFpP-I5MtkW1HuqOEQcG9GtnSpb5thDHPzq11tDypaHLBRhOdEGutLtcxS5-1lx_NTw6k5gaMOTrtOaQODsTnpT7n1fE4BxGKmWrwa1KF6M2F6l07_JGJK7GmPv1wjlrc2b4V9XCnR1Wv_--qszcreuD1d7r1XNtDNT9Lj_PX3SV7KBNohwKBn4LLUXLoLv07k0F69cv0p0OvvFhX4449HwFtaBH6JkVPfuO2OUqdX1oXbkDjxBzHKfqzoDCsI6MPGRZFsRm7oZBpUU8o8t3JKGWdyboA5lk3Z9IhmGc_H9iZneYSC6o9dcI8IDb-5H3gtZoJSrF-DMHR5RzzpZIqGzTpYjY9-hSo8IeMQa0hTp6LvArzKs1IIAugozWP6vuvTJxLkORW09YJWB94Ka6oJSAsNaaBQHN_jHasB6aWGwu-sZI2t9Kzr46-gMWK66XWfX9dVsVrpjNNS1u9Fu3E8oVqMG3ESabbU7s4y6sZmbhk-oDkZnzZ28wY98maQd53PonXA-oVWdTBPkyJG6i5k_Qk9SrZB7aytltKehc3-SlrtJ8Mb6WCgQKANDhsYeDiSBbdY6TKoqm38Ky_wnm6fdV-vMUHpyO6PJoDniT41weDSdElZ_TLTIgZUjFsvbxmYS9LCXlL_0ZVLX5dJpcVEXLxV-nVpq2hLL67FoqI9WPYwvYNrIwk5GjNY_Q1AT-35xxwOp_LYP2CemSiEhYKgAplEvh8LpI9xK3IvfBUWD7oDXp9TbEoSa9lP_ecMlZRlq9K_ZrjWP-fQe3U8RuhaXart_A34tOFgcBgOXpYZR7xgzqxfABp8DBGfAQBOOS_kVk15VvD_U-BehNE-7Y5peV6W4XAZNVg8C5YCJ_Notv7x6deri6TKd3xiHEVBJGh_s3BEMQnn5mRPSVr7M8KtkwhOWlB06dHYF6QhY7pzQyK55OG_ZcQu7q_HIHliqHJq5ak-OLPiXPmH58E2EOsXmMS8Ym9K_BHn3XfS8PpI5OXjxQ6WMtYqMANHCqvvORrETnxiTsOeQlsFlxdAIGGNq8wMO6z9TQlRJeKZHvgDa2KaZC8OIR2-agvclnrhDtVY47G-hCJNnnfgOb3lNXcj__k1RVAlDPnRUXxxRGzD1J0PvLu8SEOsVOODNYCdbFWrjAIZLoKvSJdmEbPa-OAFXIBRhUSmo2s-5C0ZYH8rSWTqoBsK27Yg9Z6wUHPepI7vCwWRfZFFEBwk0K4dF6CEkJS8DbSFRZYLm5LbchyetGzyylPpDI-hz1MU_NRTrmcheGDdcA_4_rpUATeyX9gOpf06BdP7w_Rnoq2PT-2gkCoBX_AqCWXtytJfcYCTLVNB-2NLixpEU-mTQkC7dz34BFCQZbj_fE4yqRHN8amYJ7s9pPiUBP_fOkGpiNWeY3_IUggNHnh4-Ltr7BlxAx5dThLPpoVcA8qXSziw7Cg4lkoZLbzABwmuSF8YRZjsGgiGi2OuQltfDRZzAW7-Es8gg3SuOHpxyFGlwilS36AZBd00EI0Gejf-D55RqqZP7Fsj5HgQn_U6ZIkj7V_6qT1vEKaOkO7ICE-8eeiX0IbLsKPrzJbUvQDRTRWWxucdMVifvSwgYwgdMdoeJGIMqlsy040i3K2RY6ssL57M8rWgcH0AWB0xm1UPCycIkAbAFBl6FZdLYAqV6-qB19pT1VFfE4yRO82tE2wjnsHsE3mlO4aL20bObeoOSLf1Jj6CUd4epQ_Nh6tb1Bh7NTZHq5Fw2QeSIdPQXO6pBB7aFu4RlTx7umWlpZs-Pm05433tad_MMBTqtrqigbYaE5s6ILEaXylHQ5C1EdU5xXHcMTt51dFu3caGG1u76F64MywvY0GFg2cjqA_bDdko4EpVd9jdT1BbzQpi0llpJ6nRScACy3KwScL8B05879lLTWFrg8wZm_z9ADmpUe5nFvOF59-bG98aebs8J6PUH2tGkhJVmO403K9oNfGOdDmB5Gp9epdXYgdCSgcy5hU2qfsL1jAEwNyYnyOay0FeFlE7XXMJ1K4SMcvSXeb54QU2ifQ39lR_OcqiW9bHEs3W3GXbWMrE45O5YfJYw-6fxeM9qVu3Stikl2Vu957mVUUPbXCJSW8-y__WMG2p_nRlPqmCS54ONwGrsRalHo5cM_HfgcYcS4d0QelwfWNa98gIfycnD4CGoCj0hQJzbQSpCDzxP-UJG6NxsjsSyWiHnb2F81A9f7CP98Kcz3GJg7-k1u_dBqMsrxoMsaA7wZ7pKI&cid=CAQSTQBpAlJWEwco3Kp-_1bxJQCA_Ald-n16DbeTI76cGr2Yiibt5lduBi2x927Sdo4NtkARIuIp5ulsiu5tX0E4nPnqy-Rf7bspPTaE3ar1GAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17177144858868738000&adk=792902355&idt=79&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

400d703056b3f5c521e0b5c5153e26cec5955b234b8707dcb3ecee57f3036e93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38854
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ABCB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1

43 B
61 B

17ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVpZ4IwTB4iHIn-ZsBwWqLTTAmbonYn2r65-GV8Bp6NQaF5QJrHrVKi18T6HnS57ik7CM-i_WXkpqcA3P67Yaa0NWjKbmKnHqutnBPkvc7n0MUoDlEgUlQz4H67HtE8V0IBFN_-84y9QthPqp6ZVdI5ASz4MyTiJ411HMgQyvp3vvZumuM
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP6iGPcwZEZxBVMP1YNF-So&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame ABCB 43 B
120 B 17ms
17ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVpZ4IwTB4iHIn-ZsBwWqLTTAmbonYn2r65-GV8Bp6NQaF5QJrHrVKi18T6HnS57ik7CM-i_WXkpqcA3P67Yaa0NWjKbmKnHqutnBPkvc7n0MUoDlEgUlQz4H67HtE8V0IBFN_-84y9QthPqp6ZVdI5ASz4MyTiJ411HMgQyvp3vvZumuM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame ABCB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1

23 B
163 B

55ms
50ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVpZ4IwTB4iHIn-ZsBwWqLTTAmbonYn2r65-GV8Bp6NQaF5QJrHrVKi18T6HnS57ik7CM-i_WXkpqcA3P67Yaa0NWjKbmKnHqutnBPkvc7n0MUoDlEgUlQz4H67HtE8V0IBFN_-84y9QthPqp6ZVdI5ASz4MyTiJ411HMgQyvp3vvZumuM
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:32 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEMSrk6kP9PfgiD1Rwqlfuw4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame ABCB 23 B
163 B 68ms
57ms Image
image/gif 104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkY-O_NxQEwAQ&v=APEucNVpZ4IwTB4iHIn-ZsBwWqLTTAmbonYn2r65-GV8Bp6NQaF5QJrHrVKi18T6HnS57ik7CM-i_WXkpqcA3P67Yaa0NWjKbmKnHqutnBPkvc7n0MUoDlEgUlQz4H67HtE8V0IBFN_-84y9QthPqp6ZVdI5ASz4MyTiJ411HMgQyvp3vvZumuM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:32 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8A0 0
20 B 119ms
119ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6072538666098&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8A0 0
20 B 119ms
119ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6072538666098&version=m202307240101&ct=76&x=1&cor=17006478036250622000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A8A0 89 KB
37 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CU1jV3zro3T-ill9-tYBqqHKOlAfrRFUmzwvYgpw1cWJLjHQmIeew0EtcEMb8TWmAXIUA0lFXY-0DbC1l0NCZSuoMm9Q&cry=1&dbm_d=AKAmf-AEGw5v42NS-NN_1zPotK4WNLOUsP2A9fbxsl7t5KoIpXUlpQCFZP5mgQQFk12iAzSvpAZEWeTRp0NNxy7-z3WZMOhryAG-gAc6BUWR3BQmC5MYum-LT1GM7B5bmQD-nEGw3y1gHCYlFk1NWQhm-gwoxkNjRAzVjeZL01VYX836s-PryKOANbGkNXHygFvxIm9R4z-g2YEtja1jF6VBzHcnVEChvhFGwS6Gbo2vPhQJNmgUZOIYGVDcX8vPwdA-t3Nywm77arOQ1D0B1J6R4yvrhPDZdsIaDexsjrLDAsMnbPPCRVNgbb6l0Ic1Eryt9EApBad675cR0GV22GBKN45RAyPNK8MPJnOrp8XA4rga3y8cIlUJWwIffrAsG4QucZEPOsTPnMJONjBPYCIdF_rGvR35d92J4nTuTGytSNBOLBPwIMRujYOwgZDheYxlIPvzBEv1ias1cnNv6YNXzhWrcSGAhGePYk5_eijR3HV98AYgyU2-P1MAjDNzMVuYnAwtKvtFB4CG49JCtNyAxU6kI2cKSKvIvWJZwuZ7ZdBMYs98BcJ6Qvj4-RNsY35-fb0QheYE-nTLSJhICc44czMc2y7uabcI-1SVCHpiM2aTexE5Jhm1MkcEXAv0mkDD96CbMwN7ab3lInMdxZnuuh-UicJLplofsobZxNWYrIwZKtPXcHuKeEFcforFTFrq9ZCiKQI3-tUSZWYNFPCSY9kiMnu-Ut1_-y-oz0sXfyohjdIAk4dbDybhLeHf6cTKGYS8zwexj3maqlxrzxaR0agNZySCX-RJYxbZZWpZwhpTb03li3CfxpIOGBKNHN3bl4aZlW0PwfikNxPQAUExilQxFM1POXT7EisqQ2Hj5migWWDOr249uNV_yNsjd_-__hetxq-Kaz14ye5mAMsxyPfUFIECTWoZygbvgoa4Lvr9GipVSLGoYyanfjkLI2B3YjEuP6c986WvOSyg8hqyOSfKNhqtwSDbg74utaYJ0Eo6q2EqkQ2rrIFFpHNLnYPYSipZCxnNpUC60kNx1JI_nKikS_8vS0OtJZ4uN1YAyJ3PfoErulVWNy4hfwmdt4bh98Z3pxpgOaDG8Yyfe-8t3XoBq9zmQLwImrsPSLfDAAg0obD9oa5emjetCZdgdvN9toqs7CFIXHeh-f15-gH3YziHidBLuU_DupceC35vzSTpFfuvSFSbWvlAPojEwBhm1NYb7Ww3Qe5JotzyeBh2kilQ4DFxBhu1p3hO1TxuckrCDBf5H13qwWP4XsWFF3aVvShEwm4AI2Kudmu6SnHTJAH5UTh9uLwEBlTDoH1rQMSnzXuBNReA-S5Asv-hTkGeNDf6c5U4ZspCrE-qATQS42BRYdasKWMtONb3rNPqAI0vGZT0NZhNItvpbcgHjErZsffjTAp8P7HGEqeHx_vteU8MgcD6MTOe_ALeRHgiElI79wKX8Q0jxX1ZFjphmbCAodjuantMO7UbuAp3Q736Ecs3ZUVeNlTBrswlegYqpsQVxU0FK44uTABKgL6O7H1WVeWaqsRO-g4V-4BccOBm_HZNJgzYbzohvJZKGgfwrV95dpAJoDsPGEiySi5aWatH6b8PVb0R-V0U6gyHy-T2ViCLtbdlh0nkJjEN_sDltJcw_-MzJEveW-9c2wLVSsIPatw4KfTvLG-CQeIbj2X0vCkpVCoVMwz7z0xHIC8Yd0IIyHvyEFN0zu5kwdIOwgBKRm2sAdaoLlLUtx7Zlb2wgNqd26Z7g9ydmtz3_qHEKRlDHASMY9YQOLycXqLS6pGwuhHVvxLg8p-MoRQDv8ZlHsg7jtAHH_bohkVd75kt0IhgBqdnhjrFiFisj6mXXzHdzOFS5Ax7tUAY3gAWkbo5Go5KmYDLyS3R2rW1JnOXRmXkCaSb3QzPwQGjkdyRjXm1YBiAR-18AWmJf9pfTaZQ4kZ74t9G5hLmBIv7g0JQnNcWQ-DHFpBJ7SQPrOR8-ajw9eur-GTqpzf6gEj43F8dw3F_27KBUw7aiadc0QAhuRfIgFy3kongkeYJzQ5lABqT4FW5BmgkO4-dGw5J1mSEEeIJud--NAU8ZRMPK4Euu_vZZwCSNKnU0Jem67UtLU99WrkKu3SoVefK85-q1dql6LLlwFMRVYoD9sy1NQtavj_9sHWzFW-uGJUcndfcnb_l-1sw3PU-9A-UfKQRnGnJ3NmJ1jlwjyZE4wAPhE80hgcK8Wcc3rTRo3Ru8yk0eXUrBpp8-I2xGvH-oWP7PuGwVIVb2yg9zaES3SlvqbFFISKiMhHrQeL3pIZgi790vS44OmmjzEDAXkmGAIgzuKJsEJy6vjyJ0cLk0QQLzvBdH88zGaZCdDBY19U4KOGkGE_W1WWoagovFCYnjFD7uCKuAAWnBJMj7Q0QRYgti91PGVF_ckTddr5G-S6SxiAW9h8ePuHSzLe1tdH6_gcn82Xx5CDv7SF81gDHrug4pBeVtefz8zT7hY1WipLRm7rC9Qwh4_3TXyuSxclTYlSpXvkCMgGVa33R7htxiS3aGHV6Dqpk_u5Cbc7Si-8gH_tlP_GxBYAgpkb-G1EoLg6st8dbnObTlWbDP4RHMcroQriiWpP1X796Z16eLwk52qFjuGpQ6do7PX2OOTyrVm3ecdrDhoKuoX0_KwRvvqKYNxXLZuYgtZqz1UznRzIhQy5QTQ-AANzz--SbuRdQ2HCYZcy5SWh7tR9Trqn4ZiYg9gg7XhKx2YGnDlGx7OeXzsd2Rvuk02egcznz-0qq1gQ10RoD77_xj2WKLunahAf6RXiIc_P0BvuBE36irX5xQmK1V1LmciRzBOB45szisQBlxeQguctSeq9bNA6F9EWtJEo-9cP98dmrhRE-fDSgMSBGvlUZNuzyprCxwHWqP_pkRCOguY2-OvaGJ3i2uJ013evi_yvQaJsst6DC1Fl9zOv3LRqY7lcz6hk_lDnCOa9mzG7Z3gfE0LzHo5gYEf4C20mhLPyrKUaJuZtQCVZA3h4YL87balph0jc8AkrJEDTDpSnmIvSdY7O6foi1eb8cUU4rUcsARvjWkGpRNH-tUOgn5MpMZLQciO2iFYInUqCjdBFRuFLpCCOsNhxnsWuf4cczTYy2sbuweJzsuh2bZl2dzfEursH379PhneJz6CJ1uZ9B1CzaJ2tILFuihHYoKYyLxxc2Q-pW6b1njCrIwmeWrp0VrK2-Nsv3alrcUTqRDCexBWtGP67BZWzXWRCCY6gW36FBsMveOr56FrVSDfsYW9nutn5-DbwcjO88IjBTX_gfNWsfjfUb6fp2UINNI2RBkZI0is-YUwERAwpu0cXK9I7VieOt5458dRsEpG6akPbDa1kaBfqFj7wZWChehljhv8qOwKyEk6ZLWjpEWajh-AJFAsy24JbuZCZL5j0AUj9B3xn3fPbqzAre3jeviKZj7xCduzmFIex1WfnGU3VkD404ylJzIloavx3aOkvUNQO8vlA-UwYapefkT4telMJ8Cvm5N9cP3XYXv9p9zSQjWbHTW2yZR5zAuc6wbODg3HjmfDE4oNKdxgAu0RD__UmaXZKQHEncV3al3Kw5F2T8YOilJBvNRXHhN1g3SAjTexhDvz0OqRzXaA&cid=CAQSTQBpAlJW6Yw5A-5Lw8Fx3HpLm6JHdA07KAoagFe1J-w6lNPGS6OJaO--zQQAAu6OAYd2yYZkKbWJREnNQPj-blkTwsIZqudW8uD1xEeqGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17006478036250622000&adk=3661671305&idt=59&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

febfc4fd0d96a371c72c30f04c6a24c3ee3b8814d62f5e432ab6858ad543457e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37601
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame C823 172 KB
60 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27548
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:22:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame C823 11 KB
4 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cv7zaIJbyd4eI5_FADIn88GH2yimSFj8erRGKp0AXaSd9oVRgjAc5-oFY2ml_3WdPjn5c5OGUmFEm6e7-luFM0M5tLuMBkliSNEHt6rovlKGR4g8BF_gElmlJViKX7Qy901RtdebrriWa3gBuER0Azub9OqakgfGNQfPqXgiW4KLGKDzA&dbm_d=AKAmf-AkGECMnjXGlRaJwTKy9SyopKE9GKdYubCSMLGozpQ30zZ2S0D1I7kYHI0YJ944gBgBPsM2QXzL_Sm9RMeCP-cSMAHi3PIIf9zcga4rqAci-nYZagMmLUPxkDZ5mFEgJuHdktoxSeERNdPjvu7AD6u-lPRkyHth-0eOX5YDDpgPNafu2MEBbsYCVU5atbYixVn_36Ew79DMKwoUj1ng-jPrCnwKHadeO_xqV3ql1AbczwQW_Zt0Ai-nfe_1ufSeoTUIHCBO6Q-CxL2_EncyK8ZUd2KjHM72JSZCAnWy30WNYYzNhG0pEuCF_OGRtnl7P4p9d4mtlZOZlV8aY_JOZw1rG5jfAnU5Y-3_2QQhRQNXwfpY_ytiOQBM2SqOz9RXknUTwr53oALPi6LFEYZDyA272s39DgnG5gMxZnEHIL-e4J04zqt9jDNVb1dJ6j9cO3Vbr7AfT1E4qAIzD2asUcXjlUD1v-XpuXMiPJQRQe4-uus3dMso4sNZzerHUIH1fLbcN5erA6cYzs2bgdIkvpoPxIoAu1BcnR0K7FuCfKFpwydSaSvJaQPrkVy1HsgBX2XvmJRyx9-GPjMpgbxm5jDD-4m53D8WNuini5aU14GSZBOk8hiVAqMWmzdhfiCLwJdR2lTKzKC5d_dtNN31HOOs5V9rGSUENTsJYs9wFSg-HSoS-Gj6FzETq1RrxNPpONBVxNilVWMDhpg2sLXh4WrYhd0xCVKyvFM_LFaVIT-SQmGDvDE6NqpHv05cfb-kTBBNaVk8zSV1fndP6a-cyXUE58LtKM4gtMa3iNcptCYh8lF4a06f2004fRHdB90OexS1zqm7L6EArgFX5rKPXo1T-wL_jxHn7qVZhfAgmmO8_xc9ct4k9WI3O_4E1Bz5B1YGEXqn10PcJQjRHi4OJ1NOX83aJ50hyhwUkDywq-PQNnZJC4jwGvEEvJfl2HFDLMZr2O2EigzZ9VRaPdDbHc7eLp6LNVWELCo-j6W6e5oxvU1FOvfhr3KwhgprEFC-GaDqZh4gNhxtJivkYLmU8_4kiAsUnyw2tauuctjoj1XK9Xk3QuopN3joxx1zBGvmdG0PxB34glp1Yv6ET0Mf9dLqOHjHfEkuMP6yt2svlG63ek8iHdQ-ynFEFUAmkynIAoD8Uci7163GGq3Aq-yEda4QnyIRfWoYLl7v-ks2450ywZqLXXcdlYy_4w-XHh2xAD5gWp6kuxs9NNpiWDsRFYz8bevw2ECwKokalgr_mNaRRUz-LtXqPaxUSl8tr03Emubd7P6tfWfiJqj_6j75PDFzTO_TMxYNmb7JU5r5eHBpL6yTzjTfK38pn5DGRo02oDbe2yNag_3XjY2kccxfr8eZYEjc4OJv3TtdEYrdaPtntn-SV2E6nl0CLAO1q1izvXe05FRAHEYtKJBZzRxEw1ZE2Qcpii7TGETJhrDCpfCgcpfpDHRg1h9DdnXw5-9nalZKYu6-Ujffn5CbOgntQKtJfD8fMjC6DwsWsVao-pJOSfg3tCas-Pbq67Dd8iRfHthuD3DW7wKY2VFInbuxu-zk8CLgHisCQ0Yo5uDUzYV2nYugNztev0lt8FcIDGhIi1H-WLBHwOX9Dax2ZHgfqcQfSx9pXYO_KPxNaIcc62kTNIZLcAXbH-jCd8RGYyR8ZJAC2IuOxGLeJC8nXtoGjHFFIgeqQdQ95S1cW3dcRJfwO-n-XA_Zvi2HUCEz6UQFW6_NSwla4aRyDMP2kTf6B_iauavDxa1tPv7da9JbEWwYaZZ9zbBV1PHRI-PDE9icx_arQvomFyIqQO71Kjy7Rd30vYR2Oz_4iCfn97Vi6zcclZqrdctZgyGCxZI-_xoNS1WlAX6EzpnwfasqOXMKK0lrwHyehAl2kkrb2S5LDaHWMY0FGEJTYkp7AIvzQ55zhYDpmLxuTVm8juVvUVIlDdw7NKHlenAOkGycK4PUpe5x-5iMGk68SKSYUhfz67UdJBj-P53mCcVXVBXKw05TkYw_VDl6yRYFKqGTRnxNUtq5C6IUyMeEbg9gqTxwi5oyNZqJq10G8m-jd97cgMUTEt5KP55RSIRdiFICbcKKMjIeWlSMDJZghPPDg5fNsNtINl5o7ztkmE-WeRzhzc_7dTqThpEyFimvGSIbEKZKvueE-vcuR_1kGQ-YgpXEpi0ATFe33IVH6Z030w-EhJ8-D94RR1h-pkU88XXqugH6BRCxPB8zPxATT6f8bWtEPJS3kb37M-AyAqyLb5R9d4tzeqZSBuIPcER9M09knnw-DIhblfOa4gfTHcxy6ZIwSOgfggxI4iCjCBoN7oJVC1v5ri7TqzwTrCYZ2t4awyZ8do19CuHiraZiN61gIJdmYh-jDmS1_jWXf-4ffQv4qO7ouSrEW3RSDCNM3hbhK9eEtMELrlMdxpJ0i0g_PloFzqnlkHWb1X2hoB8u767q4CD9Ad8So6vWHSDOE8U40MD0fe4fwuQ-LthydzX0U3NX_JgUNPq2bBER4T63FWPXQ-z4scqBCgi5fL-L9b0kqkLbvVnsh3ZiPvEy16uRjZmN0Vx0PPkfT1BvveHw5sCtHRoOkDhfJmVOSivTR07F43JcTSvTslWfynxRlttie6CIEKSteYMeG3ceuG75gfB8itYMX9BvOyMUx-6bXTnKyjnlVUJWFp2LD0QSsQUZEUfDb3tBpfIr6-I_ZXldMP2y7Zo2quc5qhA36cSunoahDtuLXXEU7BiUMKJkIowfQB4oMejEc2j-tVJYrbx2opMnTMrjru4C9wX8E6kcWeQ1CFhPEwHq1EobuWdwgrq_z4onE2YzyiaN-QxYSJw1sIrQaYgTtMCGPhnYmWln9rVZwSTTHsTa7a1Fo9CzctmROgGBDWDC2PX__VKDt6takQ0Pgiw8gybcKVcLIpnw1serwSbJRU7BlOY_hrSUn_NzqBu9C_5uBWNzp-yGyK2ljx2OIROl9Mh3ePyJmz23jRyibFpq5aV2pNqvSWyffwGTPxI0yRHRcZA__a_eGcCr4WX8nZBItcrxJO7bZSZiI7wMGTSYhM2nefcoEXe1WxEfFTSviNCMgaZemsfxGEQcoTv0PXyTz4jTC4Bsbo6NAn7WHvbMSV2hWivi3bhZBX6VclVvWtrf8Uzsy4vXXjgPYSgD37Wu1P2lfK1ySsUohnNduk0NCEojV2VkLx6CxVLZgEeMsDts6FLvLwN1govh8e0yLxRroNZQyp3K5a-ptMmMvkoep4-QuLueiZ-4Qtj00jMYjt40LBuueG93k0b1D6SmqKRGlJqcxl4uKEykUtcELfult1eO7opUTxiffG6Sf5GsmuY_FANUdNg5x7dKYfC1fVT3myTKomg87UHccrYAiB4WNxNivyNPgqe95IRmWqMxkFT9ddXgCqBwhCw7lH0YLMS6hLDp3zRrr6FOTBoxDIJxz98aKiuwp8ZjHzspyPECAIsyNHqmCmQ591A-LH_beO66_Mu8N5L3iLzmRyM71IQUhYzwhlAPOONbS00ajivI0bWPCTtTWmbvHUmeTk-2XmZ987ArUkblI7ZDmZvBx6jAPVGWYjYN3Dk4glCy66nqSlsvNZuT0pse_BC2scJdejPoIS3BgWH8-440FLK6hGQ2egdpKZ8Q8qK_XyItGFFBZBr3GKI-wB4hRvqUy_LMfLMqBo2c0Nj2T9PsppMcxEb4sun63MDUX24&cid=CAQSTQBpAlJW6LY150ybIYE-q23Cs6cJpcaGJnGsb65YCSlzyMQTaras6sF3SmkfPT-6acv9YdzjlboF_A2UpxQpUAjRKrSgvCCCIA8rq2cLGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17176512546772646000&adk=3037181500&idt=72&cac=0&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame C823 30 KB
11 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C823 41 KB
13 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A46 0
20 B 110ms
105ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7328980788853&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A46 0
20 B 109ms
106ms Ping
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7328980788853&version=m202307240101&ct=76&x=1&cor=5210450930677131000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7A46 103 KB
40 KB 76ms
73ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AqCKnYqEbq-NzNQ3Htpi0Tze21c1ZNpaDPP79PyXvdsbW0uiSdqQIvlc06B2T2LxwwveyzJsg0bbwWXkA8a0EEJZWPPIDH7TOaeUYUlc1xAgy7-nGFW2RTI7O5VSO7Ow-zYFETYWPjO8TZgkHAOn8niaRv6oEJNrI6hW5P6T6a82Dm8AM&dbm_d=AKAmf-AHE6cQ_u5FOMiOOOBaldFDImkaqNYb2uDKhITVy_v4OWePIZ6XU8RvBdg5j-oLverHQ9p-5aEfM8ihTel-wYCzqe-tOI6KjRoK0UCxjsblh_iuAbAn1o2T6FyAN7WUztJHjJdktRzLnKMf-5yGF9hHhwkA__xG4Lr_z1fqEt8wC1Piq5SZpEUo6yUYSL8lsdYQ1RLssCsFFm_J4TEaqJYhrizhxNVv7grckUSvpF6ugZ7N1W5xV0mK87GC-rW2PAivvSRb7AVlH1CVe9X9pSVyTVLB1Jw6NOXD8J-727GWKMHr1vEMFUNo7oENDrf1Em5WqI8T2-Ur1Tj27SVGkmaBX1AIJ8B2hireKgTYsx7rwnp0h_Siyu6ipmPCYxGtSKwy75amRon1e9tBIT-gYa5yQN5y5jJrl1V4BcFOmspERxgrvXfqlNjFiyNeW_0ZmHtdZmnxjEzkldc6OI3IcQK7ZPMwfhWqY5eCk40VQmuddBQGIx7tNj5UTS8fRa9gsyAZb5a168mMofP33_sOp5ErfZZlDdLHp1lXn-0cOUOmhpaGbL9Tri--DGmx8HvyAJkefjf0agrXWAkv7D3ZWAMJq0abhUMiW1wrti_xR2IpbS5GLH12AkfOG4xLYIo85aPhGX3vAIhfG97kJUl8NtSCqcLeA_8655BcM5daQbCoqsz27NQhXSoUY-FKz_0rvO_uKSBLlU9WHuG6f4e76zrQeUsNzZc68TuaQoV6XcrL1FykfQ_hYcL5xEa0GX7drnhyhOpI42gLqmYa6ru0jkQsEIW6HxFI51nG2geljhWnxiUaE1po9nK4BibNKZ43jFHgiF-eq3cMqpyzgDn2u8FRyocFHGuhDeL6Ct3nktNvfiCIRpbfNm4PRF4TOV9G1JMms5R3yajhoYB5wZsZbwFIEu8MVtBymMWWmevESiagN8KziQh-R5tvYwX89c06VZiruKfxbNI7Ausgeh1oEXVJU-eukLHGzeJjKUvC6gwVcWTA6xSeq0CoNQuzLexw83Q4NBPl_cDH4mlg8K5kiUVcERm_KSOYXsYIoKTRykR4mjSkrpPKjU8Wi1jwYxlGKG4xvH_GQNnlqyzoK0gbd0r3IRNlY2uEe8bIdsiO1it3peT_lIvsN_3wA0ASxqk8ONEWqXfFnEJECXEY2TQJwkE3U_TneBIh8_x6OCBWhCBp_G2nrzC1iihxbhCd2sbnz7SRUhyMoHeK9jJ-UJbYr9-hF4df3ncnRFQEbhdL8TePMY8IrcvML1HRoD-6U3nezmVRMW7isyxfy6BhAhSRTxgZiccGrwbXAfJd4dFuAGoOBFGULppP11KL3SRtlyrMpDiFdv4Ey3knM3XAJ8mjGYClTTU00fj-qP26hIScILTURK3zbYNkpPchhgj_1PC4baOMrZmr7vWApo1Hoc84Ylm2Wxni9aB9JVb8Gl6idBPz200WW2OR-usY5dkSD6kiec9xCalqkU9X6sQf8nKdEZCfrlX26_YSzOlbcNL5YZLV9IdzhA2DQpBR12f2bMWzBQ2Pq92U2_YCgAkODvSDmr4cW-Y4PwH1jJyCHFJCeTTIPHc3v-M-cwgc9dCxqPrAmNd3L7Sk3wt69rBWyokBara1EqexYefOCqHuBRE05bbg9yc14jiAjAJf9hTU8akxedq4klNcGj6_8V9nid7BRqBw7xDI1VzdbJS2Yh86PVGDROA7rJ9lAJ3_LCcymZjDwPSaouoXy-_GplhsEN2N5EhV8PqCUK10V54gbALXhVC8_6_Wa10EeSU2EYr66xRgJoULkqraKtdrpn0WMPIrkxAuDdjVMLFujtpiPgCO5zthRoD2UdRNvQsbcDoo3Lc7eFaNK9qG3dMEHFkoUB3j1ZdZe4zGxXQhR-TMSxUjI7SubJiF7kJyIcz3c-qKv6KPXfQXwnABbRik3hE5MteDlUSHW-LwuVcTRuSRs-WpGIa99tuRLCBtgCT5FzlB5hU7wlxCM6yOrSLUlQMgvSITRivHHYy0-P4ZT8wAv-Gx5G6Zsi8G5jciodbLwOnQK1agFJyyeLodr5FSggFw0cjHhLGBOeObffVRP3zqH_KROM88bnEFqbD7VVsoGrnEL7AQ2Cl2uW2dfDdAjjSIj_qFhN3eCDzE-MWiba123f6fvhdhfdcoAnOADzSXjoeJZ_V4E-6D8-zIIhPLqJW5Gfuw_iGpkvKEfIO0_fFzpOm_y6qrOtbUICpfMaARw3O9QvJ9mz43cdE-kGdjVvxh5S3Jx3capw3TjkNl2aqAEsFvtGmkSkBlF68pbxLdBUeBoYeuOCfhppsmwS4FHcII1tmABWai36IDreKsCJDoeKsL9a1OfBENFeOp4KMaYklfE5zHEcZze2_XWLqEg8wqBhuPn5YmJZnHMZ4_vIJ1D41Y3iVh5vV9UIxV7v_MxBvN5acQdAZVVVy5400LBLa8P9v5RP7v5Ffz3SeDtCaezP4HFaZ1SxtMWA16gnVpdlNYcOWkwCEHrGm25rJmk4fh1_5CGI-6eThpCT8bfshAALjzXNV3F_8KXp6q5ggg-p8X1s3CNQh2HSWD9eUzUafdw2FTlcLeWI2srp10jksYoEHl5cem0aglcv1yL-wh9EuAFCdipkuTh_ef-xUOne6Ypi-8NfgxJ0kVa8bhAeMXPtUO90XEiNaQz2W9DXV3wqMXMlh9N_101atBBFCV_oAx6G9TuyxZeh7bvgVvLCxV3CLD80575R83LQdCeM6nCVLpP6YXHP4Ek_cqvIGEZKoFLpv0tA20bBuoWANHVkILuPu94DsxLb5cJzZG8icM6oyM1Vj18Y9Nx_0z3u11ZEaLtdAUB3QcOBf8DvdJLtCKG6y4sq45Y6fKoUGdG5pqsZI3yFDhSRp1ZFH2Zy1hfPr5h8le2BzXwDP_DH-5cac66OQmVlMvWuGJKodeZV8d1YnOSH-jR8Z41Cbn8ZyA0PdWlqSnm-s5Kg1zDi-TqSHTAjb4ivqLc1VjaKvqM5s_KhkyTmKHLJ1vJu8kw94ub2ZRGXxF8JtcoMQcpc9H9S2ZlD2hLS_gUWO4Chljzd4NDDFIP04TzgNuGF6NFq-kmYznoup8_2XcOsW4EZ2zir9cxVJDhWujIDMf2hGNoTr4feCv9JBUIy2yYRmXRy_GEYjXb20GreO-aqS-U_KGLUPyUdzo6c1WrbDO7JK664tBUuIoLv8HiKHMa1qpsJ6vjGmzEERB4asJ3GDzqPIsJE52pLgDeLQnIhg3oFG2qcz9ureqLnN0ev1n-ky9uICtnFHatjDNMQ9Tr9Bs49wm3ELjavlcNA-NHgEFb2aDNOAEQ4z2vH9pqmQQrZna4HIbsP67jP8UbR0ll3sHrdNO34_5vos4NPY6Y5XCsih98Xq3vgMIsemhgj7-DU19wCh-rgxTebCX1OE7fpA6DF77-drwHzSJVpm79dC_DeH67V45GrWQ4lfcAQPm1_G_abKxSN6MGR1m8CJi1aijIK8c1kMqOvmZhCOJ4OeGq4lSJpoWVQRFPT4F0wooAF86i0Si-uzpNlWgazHXonhMF6qYAYNLnaXUa3nfDGgStw9z4xQGAFJ4clMy3pH63BtUMOj35ndDWoVmIxgZ2O8g4c2tRiEJtQBM4IepuiqcvPYptsJhuDcaBDbBpdtemzhfrJOxi5zygvHZ9HGyN-M83H9NScOVeSU_LTNEVa9LlEdeHbs-vl63kfCwKjb_enV1u3aRILQBiNkWJIJQdEa6M2w_j4MLbQw16-QMTAVSA5M&cid=CAQSTQBpAlJWu6tto0bptvpZxk7mBphyDwMbH5Sm0k9Z4iAMcSIB-9OxVz7KHh98hmkMk1bQVXMgBcaV_C_zGRMnYgERVWDxkaPvqPZs_qvaGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=5210450930677131000&adk=2265872549&idt=121&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

077f0bfd302dd50f7e02be8547cf0a11c820033cb039c4f4e7c702e4e39e7fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40591
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DAAE 111 KB
39 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame DAAE 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwRqmesJrC-JOStd2g_pjyQ6ha-R-w5ojc2qwdmeKlqgj6cExE_L8zn6PR1fojtEmEQ8qPn0MAxJEB8-aqHwCd4NnWoA&cry=1&dbm_d=AKAmf-ArpI62Pfk12lgRbdwWebPpXKT38wumI6s955DQmOMUMYyUwPvQhJw8Bak7-jnpx1tKZeo7j7ZcDTe9J4ccKzjhUwXT6CgPoeIzkrSy4WyZTe3Oc6fSUBrn_YiPsWPuL7WK5RUnXx4c7nEN-7IlxhsxgMGksg3nbty7g16lFWZ3Ghn_r3sSqDjyOr-wDlpvZXTg4rnxjlJeE7SbcbUhGqrXSOAblgs9iNKzD6R-f9V3FbBq_wLDpCXA6LbB8CL7OQuYgT2rvcRjTL6FVhWELAOI20921GXl_d8QYK875K92i61rob_5rsI3Gy8K2j01cfRswq-hX3fauK2QoG3icDF5UWenc16p6MIBQiEz8ptkOz_iqizDLl7b-JRfHMEEvN_0dSI1vt5w7MqfmDGgyOplWPCBe2hdWj9H6LmROfM6RlbuI3QdACOuK9AYvMBhw6CsfPReIkJKQqVHEUeJg3mulpm17eO9i3d1nVNTXsQRK2McvO7Cr1MmatvXS1UAm1wgN7SiGkLeg22sDDqXJeC7Ao8AsfYQXtk0NZRoD9ZPS6qW0KNxKZNDDak_1BzxN6V7JpFOQcEdE-00l6sEWQUB9jXIBT1g65DWdwTljVo_XFv9Qsr3NOrrsNKoy9BJpw6i9mzGw02ul51X2YP9rbTeDcQ2ild0ft3K5E1iJ9F0qWheqmXBogXZ0O07odTcURJJTn-R6PqXMDVn85JAooBCkdrp0Et9R8E1Pwnaw_hBM8EzEOqoF9BS-q4xzhl_dym-9KIDKB1fA-QjnOaa9zU2xL8ZY4_otyOZBMK5Rdl8ngkgcytJyGG-ZfT5L3Dm9FVZIrZm00U1TeEzVyFPPrjI2kp5oKWbIBjK1sND62G2tGAfvpd2zTjW2UN4zTVoTtdzuI7JT5kXFISAvzNoWkwEvcFXWSshz_WiIFWmq9jw-ZGsCl4pK6I8mUxg_CbAwSH24SiZ2rIAjb65MdqNqWPJjUQTbprwHqjEHzLQDMzB2Ln8jL1y9vQgahc4_yOIT5GuCVnfbAnTWgcH1LraQe5SJnN088urTmlmKBXTZAZapY9Gjdo-CyI3fTY7skqxyqwOstc6PVlhP8D6b98qM8O2Ti8S_eGsygGEFpu9OYxZRxoV8ueAa-uJ6MWTVNaRvZZC80QtI_WNFWbIa1C0rq33Q6mf8u2IrRCt8zaDSEeP5BDXMhomfpOxiblAsOvxYbXEuHYnZsUl3Q_jmOGSH5aFaqb4I_eZmVGxhlSgh07gOmNR_WstE7wTKF9CD8GZHEFW_VHeyW8g3fVnOHeEVTc6-_Ved1oKJ1zUeO8u9zSlsvuUW3y9EwKmkTbmEKNkkXbEPiVx_GDjMpHGzbEYYJ-ddMMLlR7KeRm-9M4QMIn8M5Gdqx8cDgCWLdX4FSYJsnahTQc-4Zb6s_YE8Xz2B_9rUA4UZBDDjXA1xUTjrfKFECGcsps76RwqjGXp_TOARPD-0zKFxPSWFZ5R7DOmXdUMf7V5sykd30lqwZAN4kDOMPRdx-31AxkHvYjnJ8rHPJJ6Epvj6rekZvOROcibHiw5qXW0wh2iZJC8EP_gDSivolmc7YBGHhzDDWppPAZzI0vIsCRibA_PwJHbvP0yfKTGv1aRUj35WYeQCepj7QOkzscRk7MDTf5xxMxXlpD02nkaZFibscZ7NPZEWCs4A84YcTt80j6wCAif8adElDXqcLP9MHMzVaXeyGByqX0ljKoGQvMSKBwKzW3aMKajO0NbjR4rEUGIWGXfm8CAfsoIDPb4DNtO2URmTX57prZmzByDZAD4aN7AmbGDhYR_MsolBy3EusZupdxgb3sLO679tq147FBwSvFMwamkobusI_f3L7qDhOFwy461hmsabX25LQvqd5ue92kD-KA6HlvmQPbf9Be9vECfjlV080mN4Kgysvwv9eqxYGYQSMQYfvGIHVgZ4bLZLigqEuDmWK6ck7lzD9X7rtAT2xYz9vysfrzbcvsNCkp2FV-2GELU7HUp9cR4SLnT7optQ8gUUlbu13QrYSZQ8z7pz_lbs-YTRo0Praati2r06xVsm7wpsJL93_TNx1qJhtQb5khU2HwrEXOgRVhavElnpIE1CxhqGqg5wYiq11o7uxk0Qlt1z7Gol_O4SW-UDXS0UwJZeNPklHCLBRPkDDPA_4sbVp9UNd8L9UGNDMmK0boDuLdUBrZn3vIwip8LCqs59GsFtlUx4w55ofPsU5iH7UV9TrlfjG5wZO40QRnllPPBcl7Tx_kUIlS0wHcIEcOL7Ssq5eBGm21CuybxRAfRUvx-yxZGE6ZEsGN_rOKWciLm464EWYHEIXpH3pQMjZ4tXoae67DKdJsnfxhjruVzxe4Wet2poHWB83TVw27rzvxlhrTaYjWXQep3bTl57tc_lzk8Z5yknUzyrTl34xO6O6mKm_V_yjPWkGDh-kZ8xDcO9sTdJ7leEveE7mBG0KPtxUoMD_SjYcvhGOdFQu-2pMIzPyvjZ9EJcxloPqsXhd5owNECkPOhJMYlCmthGMLbIbi9Vy8yZZ3ALlsKq5at5K2MY6leOFxlA1enJljoMJ-tDR4ifuOYJSEWvk1lxSX2kIMAnVz5zn_SLr8bN6LuM4w6ovBbx32rsTHbsPOXQLhxsyQrQSfREalYlIFChU-TX3lxtZcWRPt7zP8LUgO8nNnl9Y1zbZSNV7Wf4AJjjMVS2aLc0Ltch9dy1dYW6iVFUg7wIEw5lK2sPjGUmddcGpmgBaPetX4HvM1LjaMQ3WVyRZt_AtcD_gOcLrniioJsqmC5qZqgwTXZtLPVIKudWGlyH_ahWFYWU_9n5dB5BLxVR3vhgate54tibnqwvpxrPU2cL0HG7Be12r3wLrg5etIMskHht8G_0h5f4GpNJdEcrxh-L09c3Vke3qfWGHB3P8yZKnlk-ybPmp631VUYLq1MICiHdIbQly6uGE7XyKaDWrTgO7jIKqHpON-GyqP3XRb6W3k2ObvyXsF7miPHE3BAOjE06OuhrDW38noXwlA_Rm24b_0qjSf6mbrIfVa1eFa8h3bHSoLsGxKi13vtneldnD2e2CZ589toBRO_tGjdLTZU8oLws9jxtPwjHTsIs_fVjZDtqWwyUmQ9EDKLzW6UMnDiEnkVreo_XsxnIWnR_UHCgQE2VNJ2B5EyVeBfBMz1RDT5gex6E1ExLli12ApOrsv5nQIof9Me1kRF6YFd7HNF_vtvxF25VLMkHlwE_q0-Ul8NzlmPyk7z5iyf7-RzULVJBs9SFh_WO61AUi1fvdrTcjzt9mCpPoLqEEyU98Z73c1bfJJc2NFrBwI8_3w7q1f12PK3zWXrYAOKfuVNX-HoBIquDC4t3FhpIMP__RJxPiOBbS7h5hmbgw88wgAsKeeyy7uI5GdUb09RHdb3uUN2cOPS-F2qqz5pZnlEpVnQYUeBG_0lw9FY-tNuFiUhvnP4NtgUV6DgAKYZLI4N0-lzfWje2OjBdL7rgsui1cJmcjzYkPJs7fmSEcmhC-_9AmQkWOn2SosRIA3gvtJ3bZ2XtdjfwpAeo2xM4qduLNwI0bUpmBucyux4_LHrlrVbMvzLJf5bwRcr1M3CyVsKxCzFDXeGKeGZUA&cid=CAQSTQBpAlJW3Bz4x7GNRcl-UXg6D-yNEyjgZzN7Y_NUs4FCTGbEqDXFnRtKxce1QuD9uc56Q2HrfM_QrMllAtdHhstU01b3Vl5x9e86_tavGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=6755888130485903000&adk=2004672170&idt=76&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame DAAE 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DAAE 41 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

GET
H2 200 bridge3.584.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame DBCF 718 KB
231 KB 12ms
7ms Document
text/html 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.584.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ef0267d5ec7e7ef7a525893a3fe2d6833c3a3810a12d45907c2017e9c45159a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://asura.nacm.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 10731
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 235822
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 10:02:41 GMT
expires: Fri, 16 Aug 2024 10:02:41 GMT
last-modified: Tue, 08 Aug 2023 13:51:58 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
16 KB 50ms
22ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 13:01:32 GMT

POST
H2 200 count
logger.virgul.com/ 0
116 B 213ms
41ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=infoLoad&g=m&r=npm_asura_gg:::&o=0-100&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:32 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 8DCF 40 KB
14 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6300f448d738e70ac11f0140df0b3ce91a2de9e0da7fdf09d32d28031600ba51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 12:50:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 673
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13893
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 15:57:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Thu, 17 Aug 2023 13:50:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0449 1 KB
643 B 9ms
8ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 14202
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 09:04:50 GMT
etag: 48472445140208031
expires: Fri, 18 Aug 2023 09:04:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C823 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 964fcd56bc0f2f5cda03f15d7f4fa08c5e790722879319c60e90982043493f51

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4374 1 KB
643 B 7ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 14202
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 09:04:50 GMT
etag: 48472445140208031
expires: Fri, 18 Aug 2023 09:04:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DAAE 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4a6536524763b66224877732dab560ae6d293bc1c3ca10f33dea1edacb6596c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7CA0 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32632
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17990266662471768200/ Frame 889E 141 KB
22 KB 9ms
7ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17990266662471768200/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57c2b596262f49dfc85822938e3989a0345fcd5ddd698423283ca15f162f6b99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 469795
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22865
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 12 Aug 2023 02:31:37 GMT
expires: Sun, 11 Aug 2024 02:31:37 GMT
last-modified: Wed, 09 Feb 2022 10:37:12 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2611 0
0 121ms
86ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstSK5E8Qnq2oBgsTqyqMb1gJvJdGlF9kgONdZJov9QY9xtOZWww4g80o32ZmTc5a8pZyJg8zknYv7JWd-IgQrIcE5Eueu0_q67tmszwRnPknpjJ-DglyL9WfojDlJyYwLTOVd_5rN7DAcAvDQfxKiWHphJYymkjt9oUaz9IXStTd2TJitDkcEG8aynYsSYK3aM6163TUtP-WcpDtzQUVmaosK0gLhBkznIwbxVusWjb7teAtkeBHDP2V19kFJ0OnRWgNqdu-LuvSfIsahmtxVQlYz9msOEqgckEs8YmTSmWTXvzP_LmQGeWaCdz5txMWo03DCkbKxSmVVgkhuRda9O62XsUuIYbg8zpZ8YDFJZQkDb63O6eU4Og55jxD18JLic0kwlVPvlmhDo2gqe8qI4R95zrRytY7fDAEz5vsSfyogEFpPa7xYwlgbvdJgpz2js9iHFFmH_8Sx4ZqtKJVCo0QqAMzxhJz0U5wxgbimaMToVlOC6kAiZKxwv6noB3zC9AbjTBmx7FbUo3WVh1V4znrSC1VwHP9Vha0TRjHY88pRONus5caaCzynvLfx_sWY1Cj55P6tF4t0wapH6S4CgyaXyF98tpvFLeMtXvk_jGe9ta4xsN1qVGyDObt8HblUbIxS0iGwVVAMzW3C4zp_4eRN6Mi4tkb4JJcuNXMi86XjfNeW9vWUTDtAJM883iDmg8fnynJ1bmd2zhQNfigHqxSUAa15TE9Of_b1ZQ4QcJGkCtdGHCLVboeA7yuQ6haShnyKscPLS318ak6EuXehtnKI7pJphadQDoWAfyh0mwYrszwNESAiF8mmZTnJa3UeEN4WLht0QWgWCoKz8miGF95FHA2WpIo2OTOFUK4Rg2ymqtYLhvuEFClmbNuKn0TzspTy-jmgzBTr_sWKSbZw0R3cW_qQ-sk9zVwHrIMQeHVHo7-qNDWPwrWkO3l3_-w1ELCt0wHoyd3-c6IHEEzkTzweRD3n7bA8AkCW_m3Q-ZfVQKRjZbxEmBHZOZzd_wXgfpTuvi5aSTStCpYeLpBCE6vOrR1v7qlfSxfBEC3bZ6NZ1dR9RDhPZHfk1fAl5oX2GgcoSh7FQvGCGufFMDc42clGO7CD_uTlpYjsy82WY8nia-YHT-U4lktjwVTOBwfdZDnawA30FAPROMF2nOYjYx_wSCRJ--lGyfkRr_2bDH4zRe5cidU2KnChQokk9vhIBkjU9CosY40Sq9uy__1LthZWwCTJGYHKzJIBmodR29QTK8c7V1HAC3IM7fevqIcRAUpuUPMXcX3pBQdq1f&sai=AMfl-YSdwSh-9kT9NjPWObLsfOFhypgLffZKnOW-1Y0WmZM8uDmyw_B7PW8D67QqqAVEW4El1Tik61twoAF3M1JMY--mXNpxNkOL-02V_oI38mdNZ4q68bAdU6O6xtmXF8VLGe_V7MPcPZpUsV2fQcNM5hKoRz0p8EgHdAjJu-cAwCRnsmQSesIegY0qFfBcEuIqdIK_CwrHCYz2YUkt3w3ETLkhCd4QdcaYBMGK-BtTUgovcJAqwS5bX1aTljBqetpOYEwORw5WP5tQBb0tM_NttJKbDsCzFA6BLDRMlHSu-cgeRtLZumw8A3J-F1NZXiPh7x4NidoBC3is8pNEmQJr_cseI5yy4Q&sig=Cg0ArKJSzCnu_St62fsGEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=404&cbvp=1&cstd=400&cisv=r20230815.46139&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:32 GMT

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame FB16
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/990511/61634098/4.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&i...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

12ms
12ms

Script
application/javascript

2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: akOqjFMSMxNB2K6FJA8jdyBVXEiL5nl0
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
date: Tue, 15 Aug 2023 19:01:33 GMT
x-amz-cf-pop: AMS1-P1
age: 151201
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 08 Aug 2023 19:01:30 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: P7vKz3WvNOm9a8q2E7miBdiEtcbMtSHKyJ3I_jdxnhUcNnggBlqUCQ==

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: nginx
x-server-name: app20.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 885D 91 KB
23 KB 62ms
14ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 29 Mar 2023 13:56:00 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 12179133
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 8nUhbV52HWTRAkVwRo7kkWZvTOsE5ap3keVzuM07uY9LIZjqXMXAXw==

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 2611
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/990511/61634096/4.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&i...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

14ms
14ms

Script
application/javascript

2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: akOqjFMSMxNB2K6FJA8jdyBVXEiL5nl0
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
date: Tue, 15 Aug 2023 19:01:33 GMT
x-amz-cf-pop: AMS1-P1
age: 151201
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 08 Aug 2023 19:01:30 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: AX-Ea8TL0fWP4boItZqegSKJxkax2uphW6xyDAkY9r-lG9sqQ22OdQ==

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
server: nginx
x-server-name: app25.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 8542 91 KB
23 KB 17ms
17ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 29 Mar 2023 13:56:00 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 12179133
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 8oRn605Ntkju7xt-QXq51g3TL9ZFYyx00w3ZANT9KmrIEcaAENav6Q==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8EF0 22 KB
8 KB 9ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32632
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10256918388168393334/ Frame A6F6 148 KB
23 KB 10ms
9ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10256918388168393334/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c69976cd568b69a76e60900676f5e45c901c66b2cd4b0181e1ac468bc28c986c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 495853
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 23597
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Aug 2023 19:17:19 GMT
expires: Sat, 10 Aug 2024 19:17:19 GMT
last-modified: Wed, 09 Feb 2022 10:34:13 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FB16 0
0 97ms
97ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuhr8y0i52kxcKoS4JJwelfDJNncJviws1Hap_DidZOc2X1AUQTeozG2goPWUCDIrJMOAAtHdvpw6LlF37swVaG7Vr1sJRhyfJfXRPuUlEwRtx9tnFY91XXmQNnt-ozorJKSdA2yDuuOXsqn9LGIK74VIr5eFsTDmZfvVr_JAA1nX6xcvxcRhHawU4CZKLF_M3cicqNPEoNWlrqL3EqxRzhsjHwyA0LWgQgxFWfQIvr7iq8T87QnhvrAlprZlWAhkz7MrehxvmxSEpWvQhkFBCtMeoVByST3344Ts-rbF1J1FxYsDckt5P8fqQnlt3X3dQ4xA6Oot5QpI8ytVXZklaHpKRwDyYnv4-kRB0xj4A6pi6QoOyUUjZIoyGpF5RycfPFZ3PlGza9orTeuaYXCvBMRT87O8oF6iI4pqA42LrCvXQHtUUKurAyBTMhLnYzwp6yji_L63m58haA5Pw3kOywkAJAbztkNm3HMRJ5D4AZ6xJmLr7DvrIkjZ_SNxrZzfPrioct5g7sGUPMeyjRwnkDNKuY7Twv29OWfhAwcI6Qb0MsM6Ta-wMbdJymG5vuYNcBm70KQAifhGv2FDYtLw1PqFu2CGdp--pgTc6P_YKAI1cw5tT1o-wmi0KiuctYke24PDt6JTk-mzDgZMNvcu1-pyJmeAUiecM8gRI5N-8Al_qJ7CrSykfuVNAHkjER1C9ByWxWpTdRd_n-4zwaPw3_8r1HevdD5RY-2PeRYlCbydb1caJo_qwCRFTAG9CZfgBZZ1s7p_y8hX1lIV58r6t_1fexHJ9ciKNkD6tl95VJlml0gwg9bv-Q4P1vXii1jWZ4ujTHVTBNob4dJvohPQBO0GzTdrAWFp9HOEh4tWV4gHhSL2UTvJo7Rxajwz5Lr87hdqQSVF2zxhqOr72ui9JbaLzIUx2S-Vf-rqKHMEC2w2PLXn8J-h7Eb1oKXlmlYNc5H7LQDiSA_406belAcEk3WU4A0s0SubCuHIsr0768amaGIskWd5_ccqCX0HYrk5Oa-tTaHYQHcp18mG8A03i2XktGjn5XmJ7lFiS55eQrwBKMkSZgYm1bGqY4SCPXouNLgrNXORHHcJF7z4J9dGVNnbSRigsQxuYBIa_KTpT98MAs2GamDFbHH7YVQBQ3OEyzyZUbUZbtSHguZWxY7R2C8JHbachAJyljPYdtkjnDSrYBG6giMu5F8XkY9TtB3LlTAATWiWmqRE743wulWz8EhJY0ne7qJ3pD-L0bNDSVJuAzpod4fxx6TK9sjth1aUYt2DWuKw&sai=AMfl-YRAMXQnAcKU6oG_qBdEE9SjclBzxeniPJw3U6uJeOqrythgrif5Aq6o0NgdyPt0vJWOjFWcXTa8U2Uht2NdDx22OBm2p4UH2HHNwG9eTYXHtTtLAuMUMxjygdgsUQfa878Wu1kFL8nmng0qCAX_qoZCwkQJYjjn3crCehPNIuIonhCgmj5yRi2shT90nt5oYgqy_9hgjqP017vxdE8f5ZSa2rsVIrUn-pcMUtmNk9iH9GOZNoqONUazQ1Na7GU9-r1W-p8Hq-n3v9MWjRjDVdJjpZeDKa_VZeDAjeO22Ju7SLOonGtcMSg6L_ncsGbT1OfvyKIWZ2ng8-lD7WF_NeRtNo9WPg&sig=Cg0ArKJSzLEk_6l-snUTEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=517&cbvp=1&cstd=515&cisv=r20230815.96657&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:32 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:32 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7552 172 KB
60 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27548
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:22:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame 7552 11 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Du8qmt5PHBlHc7wh3UYE5YM_MZYjsNBdQfr362v1SSLGjoa-PUeF8gaazUbS7h_BysXGhnCwOWlTxAH-cyVt2dfYXnp0P4nB4XI_yY92cf-k487sw&cry=1&dbm_d=AKAmf-DtWtTTRPcKECVSzlm0WtplPkyMpvJvD4pPWPPXbz_a2_Oncp2p5Xjlbe2Oaiy47prm9vpyZ_0K_jgK_LabSLfb2DX9LjJ-6j_rGT0eqlZFZd1e1kGHgTy3T5sYzRvNDgRzNsJzRTX5zoakCajGQdLYR5u8G_Mg9Q_2milTBxTN-TnmnC0rWrvmg0nT9ClJScrExTP4I4fN_VIY1bmrlpkgFGKJEBPJmRb2QxkECdxw543eYVTjQWuBDLiObLqMp3CHKoQNOmG9plw4F3MQQceA4ko6jDuJcY737Vy9OCs8uQdGJFfaIHgdlgEV7Z0aQRcQVX_2Qd6BF4rgdW7ZWDgaXGI9dURIefilvG6VS1Jb6dcrZyXPwgR35M3AkW5iAwrG2_YYYhB99iniG_8mMJt6t74D1abF2oUafUvsz5VibZH3EjVdqTaB1hH7XUGnZS59ewfrpntutp4eAyxUIb9_WzJCS7xAOdK93PadcFqUPi6y6a-OqHo1HU0M_vZzUtEceQseDTw-3_Wp38UeFXscCOmRfrbj-EOW1O6SVQkVrlZGrUsL4kVtfbvr_WqXto2Vm6hsROLc6UT0DD3o_xDIjYf1RyABVjL0w5vZ6AXqYeY78of7FRxVhFI5M2PH9o2iWtpzW5dPQtNqdsSscS-v8rUneJkeJUb0n_MPK8UHj0gW4aO7q-LBpWkk96mz44ptrDcAwqjCP_iRyjQ9h4x2G1dZTnECIaPnvph0WvY5VmdKzB_tb-Tk24c6CaA6bV6g1T4oTrWGOtP_vOV1mrEiuHHm8OqcdcZNVca0K61OSVkrRl_gUOfYIASU1X2qOXKyy2cyKjshBH_VLVZNKWiL-SWu1IpLOm-8s0O6QL-R0vVjfMPvILDSVmwCrt4YI3NqTcAkBLygDDf7agq7PcO92_xvXMa27X4ie9nBDS6f-TT7rKPJP3z1m6sNuEhe3qQ4BgAHm6eEckxl2WxL-62BXmj8jfcZxxIKoL20eOVbuySk1fhPmZkSlTV85BEukFMqJ8nzY7KLspMryqpTXnoWCPkoWZ2DvnLbo2upFHAiwEZ-b4tf1CCn047KBbQa-AT2cOxB8z6v25sFUoILoX-Bs5cs-U7iFcKZ6b4Pz2pU1zqISRLLmwwoAJBN2fyf-7pYFvSkgRQo9N6XuXKfvrR8hHXM6e1DjdPBin5Pz8LycjHHtl5UEqUf79ZfNK2HLUmiD8C6z5dbdlMOaOAMgi7UIhAp5MUcXWmJFpP-I5MtkW1HuqOEQcG9GtnSpb5thDHPzq11tDypaHLBRhOdEGutLtcxS5-1lx_NTw6k5gaMOTrtOaQODsTnpT7n1fE4BxGKmWrwa1KF6M2F6l07_JGJK7GmPv1wjlrc2b4V9XCnR1Wv_--qszcreuD1d7r1XNtDNT9Lj_PX3SV7KBNohwKBn4LLUXLoLv07k0F69cv0p0OvvFhX4449HwFtaBH6JkVPfuO2OUqdX1oXbkDjxBzHKfqzoDCsI6MPGRZFsRm7oZBpUU8o8t3JKGWdyboA5lk3Z9IhmGc_H9iZneYSC6o9dcI8IDb-5H3gtZoJSrF-DMHR5RzzpZIqGzTpYjY9-hSo8IeMQa0hTp6LvArzKs1IIAugozWP6vuvTJxLkORW09YJWB94Ka6oJSAsNaaBQHN_jHasB6aWGwu-sZI2t9Kzr46-gMWK66XWfX9dVsVrpjNNS1u9Fu3E8oVqMG3ESabbU7s4y6sZmbhk-oDkZnzZ28wY98maQd53PonXA-oVWdTBPkyJG6i5k_Qk9SrZB7aytltKehc3-SlrtJ8Mb6WCgQKANDhsYeDiSBbdY6TKoqm38Ky_wnm6fdV-vMUHpyO6PJoDniT41weDSdElZ_TLTIgZUjFsvbxmYS9LCXlL_0ZVLX5dJpcVEXLxV-nVpq2hLL67FoqI9WPYwvYNrIwk5GjNY_Q1AT-35xxwOp_LYP2CemSiEhYKgAplEvh8LpI9xK3IvfBUWD7oDXp9TbEoSa9lP_ecMlZRlq9K_ZrjWP-fQe3U8RuhaXart_A34tOFgcBgOXpYZR7xgzqxfABp8DBGfAQBOOS_kVk15VvD_U-BehNE-7Y5peV6W4XAZNVg8C5YCJ_Notv7x6deri6TKd3xiHEVBJGh_s3BEMQnn5mRPSVr7M8KtkwhOWlB06dHYF6QhY7pzQyK55OG_ZcQu7q_HIHliqHJq5ak-OLPiXPmH58E2EOsXmMS8Ym9K_BHn3XfS8PpI5OXjxQ6WMtYqMANHCqvvORrETnxiTsOeQlsFlxdAIGGNq8wMO6z9TQlRJeKZHvgDa2KaZC8OIR2-agvclnrhDtVY47G-hCJNnnfgOb3lNXcj__k1RVAlDPnRUXxxRGzD1J0PvLu8SEOsVOODNYCdbFWrjAIZLoKvSJdmEbPa-OAFXIBRhUSmo2s-5C0ZYH8rSWTqoBsK27Yg9Z6wUHPepI7vCwWRfZFFEBwk0K4dF6CEkJS8DbSFRZYLm5LbchyetGzyylPpDI-hz1MU_NRTrmcheGDdcA_4_rpUATeyX9gOpf06BdP7w_Rnoq2PT-2gkCoBX_AqCWXtytJfcYCTLVNB-2NLixpEU-mTQkC7dz34BFCQZbj_fE4yqRHN8amYJ7s9pPiUBP_fOkGpiNWeY3_IUggNHnh4-Ltr7BlxAx5dThLPpoVcA8qXSziw7Cg4lkoZLbzABwmuSF8YRZjsGgiGi2OuQltfDRZzAW7-Es8gg3SuOHpxyFGlwilS36AZBd00EI0Gejf-D55RqqZP7Fsj5HgQn_U6ZIkj7V_6qT1vEKaOkO7ICE-8eeiX0IbLsKPrzJbUvQDRTRWWxucdMVifvSwgYwgdMdoeJGIMqlsy040i3K2RY6ssL57M8rWgcH0AWB0xm1UPCycIkAbAFBl6FZdLYAqV6-qB19pT1VFfE4yRO82tE2wjnsHsE3mlO4aL20bObeoOSLf1Jj6CUd4epQ_Nh6tb1Bh7NTZHq5Fw2QeSIdPQXO6pBB7aFu4RlTx7umWlpZs-Pm05433tad_MMBTqtrqigbYaE5s6ILEaXylHQ5C1EdU5xXHcMTt51dFu3caGG1u76F64MywvY0GFg2cjqA_bDdko4EpVd9jdT1BbzQpi0llpJ6nRScACy3KwScL8B05879lLTWFrg8wZm_z9ADmpUe5nFvOF59-bG98aebs8J6PUH2tGkhJVmO403K9oNfGOdDmB5Gp9epdXYgdCSgcy5hU2qfsL1jAEwNyYnyOay0FeFlE7XXMJ1K4SMcvSXeb54QU2ifQ39lR_OcqiW9bHEs3W3GXbWMrE45O5YfJYw-6fxeM9qVu3Stikl2Vu957mVUUPbXCJSW8-y__WMG2p_nRlPqmCS54ONwGrsRalHo5cM_HfgcYcS4d0QelwfWNa98gIfycnD4CGoCj0hQJzbQSpCDzxP-UJG6NxsjsSyWiHnb2F81A9f7CP98Kcz3GJg7-k1u_dBqMsrxoMsaA7wZ7pKI&cid=CAQSTQBpAlJWEwco3Kp-_1bxJQCA_Ald-n16DbeTI76cGr2Yiibt5lduBi2x927Sdo4NtkARIuIp5ulsiu5tX0E4nPnqy-Rf7bspPTaE3ar1GAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17177144858868738000&adk=792902355&idt=79&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame 7552 30 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7552 41 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame A8A0 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame A8A0 11 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CU1jV3zro3T-ill9-tYBqqHKOlAfrRFUmzwvYgpw1cWJLjHQmIeew0EtcEMb8TWmAXIUA0lFXY-0DbC1l0NCZSuoMm9Q&cry=1&dbm_d=AKAmf-AEGw5v42NS-NN_1zPotK4WNLOUsP2A9fbxsl7t5KoIpXUlpQCFZP5mgQQFk12iAzSvpAZEWeTRp0NNxy7-z3WZMOhryAG-gAc6BUWR3BQmC5MYum-LT1GM7B5bmQD-nEGw3y1gHCYlFk1NWQhm-gwoxkNjRAzVjeZL01VYX836s-PryKOANbGkNXHygFvxIm9R4z-g2YEtja1jF6VBzHcnVEChvhFGwS6Gbo2vPhQJNmgUZOIYGVDcX8vPwdA-t3Nywm77arOQ1D0B1J6R4yvrhPDZdsIaDexsjrLDAsMnbPPCRVNgbb6l0Ic1Eryt9EApBad675cR0GV22GBKN45RAyPNK8MPJnOrp8XA4rga3y8cIlUJWwIffrAsG4QucZEPOsTPnMJONjBPYCIdF_rGvR35d92J4nTuTGytSNBOLBPwIMRujYOwgZDheYxlIPvzBEv1ias1cnNv6YNXzhWrcSGAhGePYk5_eijR3HV98AYgyU2-P1MAjDNzMVuYnAwtKvtFB4CG49JCtNyAxU6kI2cKSKvIvWJZwuZ7ZdBMYs98BcJ6Qvj4-RNsY35-fb0QheYE-nTLSJhICc44czMc2y7uabcI-1SVCHpiM2aTexE5Jhm1MkcEXAv0mkDD96CbMwN7ab3lInMdxZnuuh-UicJLplofsobZxNWYrIwZKtPXcHuKeEFcforFTFrq9ZCiKQI3-tUSZWYNFPCSY9kiMnu-Ut1_-y-oz0sXfyohjdIAk4dbDybhLeHf6cTKGYS8zwexj3maqlxrzxaR0agNZySCX-RJYxbZZWpZwhpTb03li3CfxpIOGBKNHN3bl4aZlW0PwfikNxPQAUExilQxFM1POXT7EisqQ2Hj5migWWDOr249uNV_yNsjd_-__hetxq-Kaz14ye5mAMsxyPfUFIECTWoZygbvgoa4Lvr9GipVSLGoYyanfjkLI2B3YjEuP6c986WvOSyg8hqyOSfKNhqtwSDbg74utaYJ0Eo6q2EqkQ2rrIFFpHNLnYPYSipZCxnNpUC60kNx1JI_nKikS_8vS0OtJZ4uN1YAyJ3PfoErulVWNy4hfwmdt4bh98Z3pxpgOaDG8Yyfe-8t3XoBq9zmQLwImrsPSLfDAAg0obD9oa5emjetCZdgdvN9toqs7CFIXHeh-f15-gH3YziHidBLuU_DupceC35vzSTpFfuvSFSbWvlAPojEwBhm1NYb7Ww3Qe5JotzyeBh2kilQ4DFxBhu1p3hO1TxuckrCDBf5H13qwWP4XsWFF3aVvShEwm4AI2Kudmu6SnHTJAH5UTh9uLwEBlTDoH1rQMSnzXuBNReA-S5Asv-hTkGeNDf6c5U4ZspCrE-qATQS42BRYdasKWMtONb3rNPqAI0vGZT0NZhNItvpbcgHjErZsffjTAp8P7HGEqeHx_vteU8MgcD6MTOe_ALeRHgiElI79wKX8Q0jxX1ZFjphmbCAodjuantMO7UbuAp3Q736Ecs3ZUVeNlTBrswlegYqpsQVxU0FK44uTABKgL6O7H1WVeWaqsRO-g4V-4BccOBm_HZNJgzYbzohvJZKGgfwrV95dpAJoDsPGEiySi5aWatH6b8PVb0R-V0U6gyHy-T2ViCLtbdlh0nkJjEN_sDltJcw_-MzJEveW-9c2wLVSsIPatw4KfTvLG-CQeIbj2X0vCkpVCoVMwz7z0xHIC8Yd0IIyHvyEFN0zu5kwdIOwgBKRm2sAdaoLlLUtx7Zlb2wgNqd26Z7g9ydmtz3_qHEKRlDHASMY9YQOLycXqLS6pGwuhHVvxLg8p-MoRQDv8ZlHsg7jtAHH_bohkVd75kt0IhgBqdnhjrFiFisj6mXXzHdzOFS5Ax7tUAY3gAWkbo5Go5KmYDLyS3R2rW1JnOXRmXkCaSb3QzPwQGjkdyRjXm1YBiAR-18AWmJf9pfTaZQ4kZ74t9G5hLmBIv7g0JQnNcWQ-DHFpBJ7SQPrOR8-ajw9eur-GTqpzf6gEj43F8dw3F_27KBUw7aiadc0QAhuRfIgFy3kongkeYJzQ5lABqT4FW5BmgkO4-dGw5J1mSEEeIJud--NAU8ZRMPK4Euu_vZZwCSNKnU0Jem67UtLU99WrkKu3SoVefK85-q1dql6LLlwFMRVYoD9sy1NQtavj_9sHWzFW-uGJUcndfcnb_l-1sw3PU-9A-UfKQRnGnJ3NmJ1jlwjyZE4wAPhE80hgcK8Wcc3rTRo3Ru8yk0eXUrBpp8-I2xGvH-oWP7PuGwVIVb2yg9zaES3SlvqbFFISKiMhHrQeL3pIZgi790vS44OmmjzEDAXkmGAIgzuKJsEJy6vjyJ0cLk0QQLzvBdH88zGaZCdDBY19U4KOGkGE_W1WWoagovFCYnjFD7uCKuAAWnBJMj7Q0QRYgti91PGVF_ckTddr5G-S6SxiAW9h8ePuHSzLe1tdH6_gcn82Xx5CDv7SF81gDHrug4pBeVtefz8zT7hY1WipLRm7rC9Qwh4_3TXyuSxclTYlSpXvkCMgGVa33R7htxiS3aGHV6Dqpk_u5Cbc7Si-8gH_tlP_GxBYAgpkb-G1EoLg6st8dbnObTlWbDP4RHMcroQriiWpP1X796Z16eLwk52qFjuGpQ6do7PX2OOTyrVm3ecdrDhoKuoX0_KwRvvqKYNxXLZuYgtZqz1UznRzIhQy5QTQ-AANzz--SbuRdQ2HCYZcy5SWh7tR9Trqn4ZiYg9gg7XhKx2YGnDlGx7OeXzsd2Rvuk02egcznz-0qq1gQ10RoD77_xj2WKLunahAf6RXiIc_P0BvuBE36irX5xQmK1V1LmciRzBOB45szisQBlxeQguctSeq9bNA6F9EWtJEo-9cP98dmrhRE-fDSgMSBGvlUZNuzyprCxwHWqP_pkRCOguY2-OvaGJ3i2uJ013evi_yvQaJsst6DC1Fl9zOv3LRqY7lcz6hk_lDnCOa9mzG7Z3gfE0LzHo5gYEf4C20mhLPyrKUaJuZtQCVZA3h4YL87balph0jc8AkrJEDTDpSnmIvSdY7O6foi1eb8cUU4rUcsARvjWkGpRNH-tUOgn5MpMZLQciO2iFYInUqCjdBFRuFLpCCOsNhxnsWuf4cczTYy2sbuweJzsuh2bZl2dzfEursH379PhneJz6CJ1uZ9B1CzaJ2tILFuihHYoKYyLxxc2Q-pW6b1njCrIwmeWrp0VrK2-Nsv3alrcUTqRDCexBWtGP67BZWzXWRCCY6gW36FBsMveOr56FrVSDfsYW9nutn5-DbwcjO88IjBTX_gfNWsfjfUb6fp2UINNI2RBkZI0is-YUwERAwpu0cXK9I7VieOt5458dRsEpG6akPbDa1kaBfqFj7wZWChehljhv8qOwKyEk6ZLWjpEWajh-AJFAsy24JbuZCZL5j0AUj9B3xn3fPbqzAre3jeviKZj7xCduzmFIex1WfnGU3VkD404ylJzIloavx3aOkvUNQO8vlA-UwYapefkT4telMJ8Cvm5N9cP3XYXv9p9zSQjWbHTW2yZR5zAuc6wbODg3HjmfDE4oNKdxgAu0RD__UmaXZKQHEncV3al3Kw5F2T8YOilJBvNRXHhN1g3SAjTexhDvz0OqRzXaA&cid=CAQSTQBpAlJW6Yw5A-5Lw8Fx3HpLm6JHdA07KAoagFe1J-w6lNPGS6OJaO--zQQAAu6OAYd2yYZkKbWJREnNQPj-blkTwsIZqudW8uD1xEeqGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=17006478036250622000&adk=3661671305&idt=59&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame A8A0 30 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A8A0 41 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

POST
H2 200 count
logger.virgul.com/ 0
116 B 41ms
41ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=adDataLoad&g=m&r=npm_asura_gg:preroll:100&o=&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:32 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

GET
DATA 200
OK truncated
/ 1016 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6823cdc5c5bc297bd4ac06187687fecb2a5c110658ebd5efba820132571fe6a2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 zoneview
ng.virgul.com/ 0
212 B 43ms
43ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/zoneview?c=&mt=1692277292606&v=https%3A%2F%2Fasura.nacm.xyz%2F%26vi%3D10762648%40&r=158641:asura_gg&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a&tp=&os=&call=&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc1,hf1,vv1&info=&ref=&rdmt=0.46606339813568143
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:32 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/990511/61634100/ Frame 7A46 250 KB
75 KB 34ms
33ms Script
application/javascript 34.248.158.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/990511/61634100/skeleton.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gilsrPCk64b_hPQHQNaYmy
Requested by: Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.158.33 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-158-33.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ded9e67980216c09fe34d577e4794f00d87ad376848261b35492af61843fe114

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:32 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7A46 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Origin: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29400
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/ Frame 7A46 11 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AqCKnYqEbq-NzNQ3Htpi0Tze21c1ZNpaDPP79PyXvdsbW0uiSdqQIvlc06B2T2LxwwveyzJsg0bbwWXkA8a0EEJZWPPIDH7TOaeUYUlc1xAgy7-nGFW2RTI7O5VSO7Ow-zYFETYWPjO8TZgkHAOn8niaRv6oEJNrI6hW5P6T6a82Dm8AM&dbm_d=AKAmf-AHE6cQ_u5FOMiOOOBaldFDImkaqNYb2uDKhITVy_v4OWePIZ6XU8RvBdg5j-oLverHQ9p-5aEfM8ihTel-wYCzqe-tOI6KjRoK0UCxjsblh_iuAbAn1o2T6FyAN7WUztJHjJdktRzLnKMf-5yGF9hHhwkA__xG4Lr_z1fqEt8wC1Piq5SZpEUo6yUYSL8lsdYQ1RLssCsFFm_J4TEaqJYhrizhxNVv7grckUSvpF6ugZ7N1W5xV0mK87GC-rW2PAivvSRb7AVlH1CVe9X9pSVyTVLB1Jw6NOXD8J-727GWKMHr1vEMFUNo7oENDrf1Em5WqI8T2-Ur1Tj27SVGkmaBX1AIJ8B2hireKgTYsx7rwnp0h_Siyu6ipmPCYxGtSKwy75amRon1e9tBIT-gYa5yQN5y5jJrl1V4BcFOmspERxgrvXfqlNjFiyNeW_0ZmHtdZmnxjEzkldc6OI3IcQK7ZPMwfhWqY5eCk40VQmuddBQGIx7tNj5UTS8fRa9gsyAZb5a168mMofP33_sOp5ErfZZlDdLHp1lXn-0cOUOmhpaGbL9Tri--DGmx8HvyAJkefjf0agrXWAkv7D3ZWAMJq0abhUMiW1wrti_xR2IpbS5GLH12AkfOG4xLYIo85aPhGX3vAIhfG97kJUl8NtSCqcLeA_8655BcM5daQbCoqsz27NQhXSoUY-FKz_0rvO_uKSBLlU9WHuG6f4e76zrQeUsNzZc68TuaQoV6XcrL1FykfQ_hYcL5xEa0GX7drnhyhOpI42gLqmYa6ru0jkQsEIW6HxFI51nG2geljhWnxiUaE1po9nK4BibNKZ43jFHgiF-eq3cMqpyzgDn2u8FRyocFHGuhDeL6Ct3nktNvfiCIRpbfNm4PRF4TOV9G1JMms5R3yajhoYB5wZsZbwFIEu8MVtBymMWWmevESiagN8KziQh-R5tvYwX89c06VZiruKfxbNI7Ausgeh1oEXVJU-eukLHGzeJjKUvC6gwVcWTA6xSeq0CoNQuzLexw83Q4NBPl_cDH4mlg8K5kiUVcERm_KSOYXsYIoKTRykR4mjSkrpPKjU8Wi1jwYxlGKG4xvH_GQNnlqyzoK0gbd0r3IRNlY2uEe8bIdsiO1it3peT_lIvsN_3wA0ASxqk8ONEWqXfFnEJECXEY2TQJwkE3U_TneBIh8_x6OCBWhCBp_G2nrzC1iihxbhCd2sbnz7SRUhyMoHeK9jJ-UJbYr9-hF4df3ncnRFQEbhdL8TePMY8IrcvML1HRoD-6U3nezmVRMW7isyxfy6BhAhSRTxgZiccGrwbXAfJd4dFuAGoOBFGULppP11KL3SRtlyrMpDiFdv4Ey3knM3XAJ8mjGYClTTU00fj-qP26hIScILTURK3zbYNkpPchhgj_1PC4baOMrZmr7vWApo1Hoc84Ylm2Wxni9aB9JVb8Gl6idBPz200WW2OR-usY5dkSD6kiec9xCalqkU9X6sQf8nKdEZCfrlX26_YSzOlbcNL5YZLV9IdzhA2DQpBR12f2bMWzBQ2Pq92U2_YCgAkODvSDmr4cW-Y4PwH1jJyCHFJCeTTIPHc3v-M-cwgc9dCxqPrAmNd3L7Sk3wt69rBWyokBara1EqexYefOCqHuBRE05bbg9yc14jiAjAJf9hTU8akxedq4klNcGj6_8V9nid7BRqBw7xDI1VzdbJS2Yh86PVGDROA7rJ9lAJ3_LCcymZjDwPSaouoXy-_GplhsEN2N5EhV8PqCUK10V54gbALXhVC8_6_Wa10EeSU2EYr66xRgJoULkqraKtdrpn0WMPIrkxAuDdjVMLFujtpiPgCO5zthRoD2UdRNvQsbcDoo3Lc7eFaNK9qG3dMEHFkoUB3j1ZdZe4zGxXQhR-TMSxUjI7SubJiF7kJyIcz3c-qKv6KPXfQXwnABbRik3hE5MteDlUSHW-LwuVcTRuSRs-WpGIa99tuRLCBtgCT5FzlB5hU7wlxCM6yOrSLUlQMgvSITRivHHYy0-P4ZT8wAv-Gx5G6Zsi8G5jciodbLwOnQK1agFJyyeLodr5FSggFw0cjHhLGBOeObffVRP3zqH_KROM88bnEFqbD7VVsoGrnEL7AQ2Cl2uW2dfDdAjjSIj_qFhN3eCDzE-MWiba123f6fvhdhfdcoAnOADzSXjoeJZ_V4E-6D8-zIIhPLqJW5Gfuw_iGpkvKEfIO0_fFzpOm_y6qrOtbUICpfMaARw3O9QvJ9mz43cdE-kGdjVvxh5S3Jx3capw3TjkNl2aqAEsFvtGmkSkBlF68pbxLdBUeBoYeuOCfhppsmwS4FHcII1tmABWai36IDreKsCJDoeKsL9a1OfBENFeOp4KMaYklfE5zHEcZze2_XWLqEg8wqBhuPn5YmJZnHMZ4_vIJ1D41Y3iVh5vV9UIxV7v_MxBvN5acQdAZVVVy5400LBLa8P9v5RP7v5Ffz3SeDtCaezP4HFaZ1SxtMWA16gnVpdlNYcOWkwCEHrGm25rJmk4fh1_5CGI-6eThpCT8bfshAALjzXNV3F_8KXp6q5ggg-p8X1s3CNQh2HSWD9eUzUafdw2FTlcLeWI2srp10jksYoEHl5cem0aglcv1yL-wh9EuAFCdipkuTh_ef-xUOne6Ypi-8NfgxJ0kVa8bhAeMXPtUO90XEiNaQz2W9DXV3wqMXMlh9N_101atBBFCV_oAx6G9TuyxZeh7bvgVvLCxV3CLD80575R83LQdCeM6nCVLpP6YXHP4Ek_cqvIGEZKoFLpv0tA20bBuoWANHVkILuPu94DsxLb5cJzZG8icM6oyM1Vj18Y9Nx_0z3u11ZEaLtdAUB3QcOBf8DvdJLtCKG6y4sq45Y6fKoUGdG5pqsZI3yFDhSRp1ZFH2Zy1hfPr5h8le2BzXwDP_DH-5cac66OQmVlMvWuGJKodeZV8d1YnOSH-jR8Z41Cbn8ZyA0PdWlqSnm-s5Kg1zDi-TqSHTAjb4ivqLc1VjaKvqM5s_KhkyTmKHLJ1vJu8kw94ub2ZRGXxF8JtcoMQcpc9H9S2ZlD2hLS_gUWO4Chljzd4NDDFIP04TzgNuGF6NFq-kmYznoup8_2XcOsW4EZ2zir9cxVJDhWujIDMf2hGNoTr4feCv9JBUIy2yYRmXRy_GEYjXb20GreO-aqS-U_KGLUPyUdzo6c1WrbDO7JK664tBUuIoLv8HiKHMa1qpsJ6vjGmzEERB4asJ3GDzqPIsJE52pLgDeLQnIhg3oFG2qcz9ureqLnN0ev1n-ky9uICtnFHatjDNMQ9Tr9Bs49wm3ELjavlcNA-NHgEFb2aDNOAEQ4z2vH9pqmQQrZna4HIbsP67jP8UbR0ll3sHrdNO34_5vos4NPY6Y5XCsih98Xq3vgMIsemhgj7-DU19wCh-rgxTebCX1OE7fpA6DF77-drwHzSJVpm79dC_DeH67V45GrWQ4lfcAQPm1_G_abKxSN6MGR1m8CJi1aijIK8c1kMqOvmZhCOJ4OeGq4lSJpoWVQRFPT4F0wooAF86i0Si-uzpNlWgazHXonhMF6qYAYNLnaXUa3nfDGgStw9z4xQGAFJ4clMy3pH63BtUMOj35ndDWoVmIxgZ2O8g4c2tRiEJtQBM4IepuiqcvPYptsJhuDcaBDbBpdtemzhfrJOxi5zygvHZ9HGyN-M83H9NScOVeSU_LTNEVa9LlEdeHbs-vl63kfCwKjb_enV1u3aRILQBiNkWJIJQdEa6M2w_j4MLbQw16-QMTAVSA5M&cid=CAQSTQBpAlJWu6tto0bptvpZxk7mBphyDwMbH5Sm0k9Z4iAMcSIB-9OxVz7KHh98hmkMk1bQVXMgBcaV_C_zGRMnYgERVWDxkaPvqPZs_qvaGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fasura.nacm.xyz%2F&ds=l&xdt=1&iif=1&cor=5210450930677131000&adk=2265872549&idt=121&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 22:22:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 22:22:46 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/ Frame 7A46 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ae072b67edb6016f6425f5d59b9ffd393f38f1d631d108a6dd05339cc726835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 23:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49746
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11536
x-xss-protection: 0
server: cafe
etag: 2200807439755941123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Aug 2023 23:12:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7A46 41 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6218
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Aug 2024 11:17:54 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 889E 29 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17990266662471768200/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17990266662471768200/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:02:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28716
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:02:56 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FB16 43 B
216 B 291ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=c6e1b6bd-775d-2585-bdd6-d242562229b3&tv=%7Bc:lyzHlC,pingTime:-3,time:627,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:52%7D,%7Br:r,w:160,h:600,t:282%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:627,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:51,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B618~0%5D,as:%5B273~0.0,345~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634098%7C1e1%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1e*,rmeas:1,rend:0,renddet:svg.us,siq:53%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt22.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FB16 43 B
215 B 267ms
97ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=c6e1b6bd-775d-2585-bdd6-d242562229b3&tv=%7Bc:lyzHm3,pingTime:-6,time:654,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:654,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:51,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B645~0%5D,as:%5B273~0.0,372~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634098%7C1e1%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1e*,rmeas:1,rend:0,renddet:svg.us,siq:53%7D&tpiLookup=ao:asura.nacm.xyz*&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2611 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=1cdc615f-9e3c-a3b7-1cca-a39a53d420b2&tv=%7Bc:lyzHpQ,pingTime:-3,time:803,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:803,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B796~0%5D,as:%5B796~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d*.990511-61634096%7C1d1%7C1d2%7C1d3%7C1e.990511-61634098%7C1e1%7C1e2%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1d*,rmeas:1,rend:0,renddet:DIV,siq:23%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2611 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=1cdc615f-9e3c-a3b7-1cca-a39a53d420b2&tv=%7Bc:lyzHpR,pingTime:-6,time:804,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:804,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B797~0%5D,as:%5B797~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d*.990511-61634096%7C1d1%7C1d2%7C1d3%7C1e.990511-61634098%7C1e1%7C1e2%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1d*,rmeas:1,rend:0,renddet:DIV,siq:23%7D&tpiLookup=ao:asura.nacm.xyz*&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6933 1 KB
644 B 7ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 14203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 09:04:50 GMT
etag: 48472445140208031
expires: Fri, 18 Aug 2023 09:04:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7552 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3184e31fc4a46b861116911d4ab695938c4522a41eae7b347e3b5368af40d611

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame A6F6 29 KB
10 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10256918388168393334/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10256918388168393334/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:02:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28717
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:02:56 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15874828848628604197/ Frame 5EBE 673 B
438 B 16ms
16ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9bc147189922e69bb8162e64a86b223280ad3549a743ada86b5ee06eb6dbe133

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 410
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:33 GMT
expires: Fri, 16 Aug 2024 13:01:33 GMT
last-modified: Mon, 10 Jul 2023 11:52:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C823 0
0 55ms
54ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvT23qfWc0CGqiZkdvCHR5zEwyo46WCOS0zp7U_7SUIs0bzyYkNBBMA1u2xrmAPt9aV2a--eqMJ52ySFwvUbajAJAAQMMYgVo0Vqk2yjGwcNn90EUPjBoVIb4uXFUNSl-KbeAwTfQTvF3UTYwc9sLwm6hZloo2o6toJrXTyUTgv8gJrT9_5PRFUSGl-V2ao2uUv9xvb-HeaeuThPXJgIb1TRd1Irqp7N7YIZnY_v95-JqTC1eDx5XP5RmBnKZiFIGorargjspsDBMfSME7DLVBdQTwyMMwikhHZF_AE7Xn9Lm1vPD_6x1PxqXQP6ikKUYsP86K5FWQgMNPK26BQqvxLGb27dK0GEOJzxv9G88A4I-OIkgiiGwfQIeosygfOuwkcaxbep6y-JAGqFCnVfbf3B0Qeklck32wOGVpVTivIBc2Td0uYRWr2Fpi4bGQfNdK2-mm6KiL6jZTdI9rvAXR75p2243-ErTRaXsRvdbhHUG1JFV99anecGh7xRdbd7vNAuZApt22gbeu3M35ZShjRirmchGeniq-qGj5kWU0mrpFOGJVpRC_sJA10ql0Q2CG3RA4Kk5Bm7pT2cKO4ovcr8YxkjecrkJri5X-wJtHYsOG022zXvMwIUxQOTahFHbGwboktpBxtwxtzLkBXvUusVdaHvw1faCuvct_4XfFrdfBByDJ8ydBb1glES-cMuvckdqOGWQd8UZqCgJhmlBnk9pq9FEQaAoqt7FugVAGcoacjSWHKXSjpU6Tb0smjRebvQBiR5tg9baOUS8ZmSmq-Vtrxr_WotqGw8JN6uvXhBc42jkSPKWqxzknadggDLoBhZbITQt14B08TJcSr6BKhsdCfQJdivoMndRkBX6qfQ7ctn_yGOXSxJ7_cXbf3spnD2rv6fZ_Jg9SxFUix76Lso-tSw8NdItKEPYjM9pqrm72tFq1t_g6mrj20iiB1M3lNuOPfHRwMjLCV_Kk3L4fUtZ-sLXDxj7e9zgXd5BYcLSyFwMKLf-knCk8H2AL7WwnEqNYxuh04TlQ70MaNZLVBwHwv89-4cQKex4wd0UuLFsMOJLhx_P_egq4jYVqpnM0Yh04Z1hpx23PXoKdt8gRVkvbUzn8xx6RSzzX1ywf2401fXCebgUBkacLwm89hA9RmVLUmdwbGM4bHAM6xMxBiF4MPHjXpgv8jfg7Z18Tv8go3ydg7BRMo3ibTY7SAK7tnwW357TK8BA38zypk5f1R7Nkc9J7uY5ED84jSPNiGIQFJkFxxli4llcTO8fPqJiaIj3wW1rwiwapeTBNDS5r7ISrHeQ&sai=AMfl-YTliQ-8sfMGqwNLsq5CJ-2YotayRC_N-hb9APlQK5FE5LKuvTWnwm-7ZhXHdM-78zAz6atOsORyPfJOgVhTo3ofw-1P1h70qPypR5CduU-KSAdi0En7yNvP7J2KthVGH5mz0zN5xrXFCdNccjVfiFttN4IND6-qny_6v2z3rTGhY9VteL1gpdvLpWGVkDz1JXLYHBYJGATGR7PIS2WTmIab_U9PqQyzKiON_4hLUss_1D91IwK_lcU_G1bGkehZC5SYEsk9ifm79VUmp1hoo5VTFmPq9DjAysPRRITIRy45A0O15zzRlunv5xXy&sig=Cg0ArKJSzBEDROZmdGcsEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1156&cbvp=1&cstd=1146&cisv=r20230815.22653&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CD95 1 KB
644 B 7ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 14203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 09:04:50 GMT
etag: 48472445140208031
expires: Fri, 18 Aug 2023 09:04:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A8A0 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd3c63e926dea95d0471aa02fe3f6b80bf6cd86fd5c7944f59a37a10dd53840c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 31 KB
10 KB 8ms
8ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1d6853a919d9061910b35746b0026d3e9b721bc6b6dfc3e49d7736e8b9a37ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 547261
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 10417
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Aug 2023 05:00:32 GMT
expires: Sat, 10 Aug 2024 05:00:32 GMT
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DAAE 0
0 94ms
94ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvVyAZQA5enlbzwXHv_84AjzrAvXz-JVPx1I-3vS2-4fQe0fJf-789LIPmiTU0VbmKm-JNah-6nYbTYxn0XeU5kttllvIuY8L1fKIYX2mn3kJHz-8C8duKDdvIpz3GB8x784w06d1fsW9Vs4WeOZ1Csmo7Ex2M5JUJi7xjOxfVGEY-b9VwIctFcZkweku4D4vnlmibcMnnD8f-avaZBszrQgXFIDgHoSu-eiQaeDEIqcd8kq4WMd7l9qQ6Z_5y8UkY1e27YwiBmG5sy-GLf9GXl598Qy6Pawg549_-4TQzJnzh4pvcRjqEsiA_3et4qZ5Cm7HIc7QrERaO6l1tgcQu4SvgtHnBB4ZP9d86ZZFcbcRSXTYQxMiyRbOZ4WXj8ly770ms5wOR1J5b9Pv0F-N7B1RuGG5XBGL_YgwP0j_d1EQAy2fTXuJtn8kqFQFnTJ28siwVYibSF2NkxeWNXuDOHjedAL-6abZRMT4PeDchEi4xERDpBJvslV7XTijvr-ZKkUjIt9ZEm1vc08pAKVoq0lfvfQpBnDSo1gX6K9jCHRIZ8T6LVOoLzKt73LH8dA2Hj0jcge8cshV310eOuTNNHaJukxaILfu_-3p1YkukW-8HNcNKSLEnRkhtfYI9WxV6Z7-sEL45CCS2_dW9RJZ63mcOfLp1Hz-0qfi4VxCIQYmz1jgUTvEkAefPHqRWq_rp-0ba3EEmhyRzOJNSg-kY9IFOv68iPKusK0gLwHnk5mwQKOtpvSmStMQwSsqCbZFddmw6jp69x523P9yfQ2ZpUOlLg88MVydb1ttejXw6xmbVByPKj2oipcnfcQuJedKQth2l3LuneOqdkSU5_hE0vkMJCmQBaR__JcQoDAM3HjWt4nmZ_U19NtKLKS7TyGCits0JRHaRTW5qyxGVr9XxuTwUR_3UFe_t-qOY7AJd1vi1B75HTT_kVZ8wuqPu-2hMaJsR2fAFXCdnwdPnadrRB6_Tm7_s75jrJFJ0oY_lA0uYfIvGQZ48RCZyLOIdfhA_iCkIKu5dhEMhydg6LABaudwTy2JWkwOlCRzsXJ6fn_VY0kSMhqILhTQYQIF_o1mh-Z3R038v7WYQ11F6KtS6EkI_he2yLK3jFSkY1hQHRD4WvCeBEP2dAMj6TJq4bVLxz708FgNtSb-6g5fdEZqQVPdVm_Qdgv-dvtyvyBMN0BggA8Fn5eaSD8aFJTjVgipWv2zIxKbBCGDCSaCmo9hEVrqa17bCjCNnGbj-IDUevIHVJcpMZmJFQ&sai=AMfl-YT58EDxO_HqB6sBs88YXy-veqA8QR5jlFjMm4-YQr4OhKJ0lSCdaXSVZXYCWba3za48Ke6zjyQIc0yIfX8dhmDg440MFnS8hwMF5D0BCvSHJiXYHlr8OLsMdB0sSqdi7dhMLZEto-QPjPMRVEoTFkfikpCD4nlMDfqcVO7wozSk77sPqbzQN6MxpEcivH7ZUkfJc9JxB_2k5_VjF91XiOEvRsFN09XVFYb9HVJR6CgeIiGqee_ZCVexxoM8BHmolVGHrddd9uUqW-ygO2gPmWEE0fSfZJMFSQ8BllUk37x_tkX9jJhqKlege254&sig=Cg0ArKJSzI1wj2d_en2HEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1194&cbvp=1&cstd=1192&cisv=r20230815.85325&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:33 GMT

POST
H2 200 count
logger.virgul.com/ 0
116 B 41ms
41ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=alive&g=h&r=&o=npm_asura_gg::25:::vnet391e7226-65d8-4598-874d-43f080f02c8a&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:33 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

POST
H2 200 count
logger.virgul.com/ 0
116 B 42ms
41ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=alive&g=h&r=&o=npm_asura_gg::50:::vnet391e7226-65d8-4598-874d-43f080f02c8a&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:33 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

POST
H2 200 count
logger.virgul.com/ 0
116 B 42ms
42ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=alive&g=h&r=&o=npm_asura_gg::75:::vnet391e7226-65d8-4598-874d-43f080f02c8a&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:33 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

GET
H2 206 10762648-270_1-72k.mp4
istr-n22.nktcdn.com/data/videos/10762/ 903 KB
0 420ms
41ms Media
video/mp4 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://istr-n22.nktcdn.com/data/videos/10762/10762648-270_1-72k.mp4?token=abiVLfjzvsyAoLyrcbEuVQ&ts=2043906581
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash

Request headers

Referer: https://asura.nacm.xyz/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Range: bytes=0-

Response headers

access-control-allow-origin: *
Content-Range: bytes 0-3178148/3178149
date: Thu, 17 Aug 2023 13:01:33 GMT
last-modified: Wed, 26 Apr 2023 13:57:33 GMT
server: openresty/1.15.8.3
Content-Length: 3178149
content-type: video/mp4

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C95F 1 KB
644 B 7ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 14203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 09:04:50 GMT
etag: 48472445140208031
expires: Fri, 18 Aug 2023 09:04:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7A46 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81d158b227b7e060ed50c86201397a4d9a188ea160ff2de22862897f745305bb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 64d34559e4b0f534035966cc
ng2.virgul.com/tck/imp/ 0
212 B 42ms
41ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/64d34559e4b0f534035966cc?g=1&t=gb&r=158659@site_geneli@asura_gg:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1&info=&mt=1692277290670&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:33 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FB16 43 B
215 B 99ms
99ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=c6e1b6bd-775d-2585-bdd6-d242562229b3&tv=%7Bc:lyzHtX,pingTime:-2,time:1144,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:848,beZ:850,mfA:853,cmA:855,inA:855,inZ:860,prA:860,prZ:894,si:900,poA:901,poZ:926,cmZ:926,mfZ:926,loA:1501,loZ:1504,ltA:1992,ltZ:1992%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:52%7D,%7Br:r,w:160,h:600,t:282%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:1144,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:51,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1135~0%5D,as:%5B273~0.0,862~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d.990511-61634096%7C1d1%7C1d2%7C1d3%7C1e*.990511-61634098%7C1e1%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1e*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:53,sinceFw:1090,readyFired:true%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 64d34559e4b0f534035966cc
ng.virgul.com/tck/i_vb2/ 0
212 B 45ms
44ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/64d34559e4b0f534035966cc?l=&r=158659@site_geneli@asura_gg:site_geneli&cs=1692277293526&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:33 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2611 42 B
64 B 114ms
113ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvKK661HS237ZYuadijC6VPa3J56LUyYbhEF_Bq_apv3Fbl7q-pj9EGFkAg-TgPTIrIdqNI_r8GIiZ_CCgNjl3vyr3xnnhozJvCrnORH7RYhRnex_rQHc4xYVfsg2WU98cSvS2kmAYWsBkB&sai=AMfl-YQE_Wc_JlAUSVDeFANKLWJYaReFVmxWUigOqEBWjGUmGfTvi5Ibj1Rfqz4Pr__Vn-SBRfpwum4xnw0sXQ6r3O-8XR_xKnMkivPALIDg7q5LlaMpUVfM2vrys5C4lGNg7W-425VLBijjPAk56ErnxUOjT1vTXyuvpvMAam0A&sig=Cg0ArKJSzDeDOQK46gGwEAE&cid=CAQSXQBpAlJWF9lrcp0yMIUotg2VLlbqNoVXqefaHk7yLO5TkUkeNjTCB28cyaOA_1DIx7_671RKs6OhgPupRn0qyqP1D0ABl47Gn2E8Wt3qGk9JbuY8rs028zS-8FHmkhgB&id=lidar2&mcvt=1393&p=1110,436,1200,1164&mtos=1393,1393,1393,1393,1393&tos=1393,0,0,0,0&v=20230816&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3909368317&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1692277291471&rpt=606&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 0449 35 B
464 B 39ms
8ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKW7GE8TlE6aoPj95ylYhnc&google_cver=1&google_push=AXcoOmTAXYgaDBT-yOY8kwHd59g92OrqEhqKDRyGZIXbFNM6_qb-TbS2IcviQIDdhHrSRSKFeOXHraiV_a3nj7JOF2APctXk6q5x

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0449
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEKSDMMbLcMyFS6p8gn2g1Og&google_cver=1&google_push=AXcoOmQYKByzrwFu6DEq1b_VRao6yJgrK6zR4WF7ihHDXco7A4-s1rI2mtTWmowHT43NDuSWF-smDMseDavXPWyv...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQYKByzrwFu6DEq1b_VRao6yJgrK6zR4WF7ihHDXco7A4-s1rI2mtTWmowHT43NDuSWF-smDMseDavXPWyvRWoqeo10ve4Q

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQYKByzrwFu6DEq1b_VRao6yJgrK6zR4WF7ihHDXco7A4-s1rI2mtTWmowHT43NDuSWF-smDMseDavXPWyvRWoqeo10ve4Q

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 17 Aug 2023 13:01:33 GMT
Server: MT3 1031 59fd23a master zrh zrh-pixel-x1 config_version:"1524"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQYKByzrwFu6DEq1b_VRao6yJgrK6zR4WF7ihHDXco7A4-s1rI2mtTWmowHT43NDuSWF-smDMseDavXPWyvRWoqeo10ve4Q
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 17 Aug 2023 13:01:32 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0449
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEOzdQmL2KcIuMQ7CdUgBmwo&google_push=AXcoOmSpXMywxW88A_b6o-Ewlpbjd4nktqypg2wiAFU4smhBsMDa98oevB...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEOzdQmL2KcIuMQ7CdUgBmwo&google_push=AXcoOmSpXMywxW88A_b6o-Ewlpbjd4nktqypg2wiAFU4smhBsMDa98oevBWkrv-b_g3WPbpX9f2otVrZ5EwJzcYI65rmc0KxBDs

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230036-FRA
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1692277294.584251,VS0,VE88
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEOzdQmL2KcIuMQ7CdUgBmwo&google_push=AXcoOmSpXMywxW88A_b6o-Ewlpbjd4nktqypg2wiAFU4smhBsMDa98oevBWkrv-b_g3WPbpX9f2otVrZ5EwJzcYI65rmc0KxBDs
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0449
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESELRl3d9FpPmEwEc3NwoBKWE&google_cver=1&google_push=AXcoOmQvgVqW2Q5L1eVRod5NPKOgoORQqJZxW5J9UEflGm1fpcyRAAmvr8D_H4jNgNOSubxqMGvwxG5JpR7MToPXsyM-Ges...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESELRl3d9FpPmEwEc3NwoBKWE&google_cver=1&google_push=AXcoOmQvgVqW2Q5L1eVRod5NPKOgoORQqJZxW5J9UEflGm1fpcyRAAmvr8D_H4jNgNOSubxqMGvwxG5JpR7MToPXsyM-G...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQvgVqW2Q5L1eVRod5NPKOgoORQqJZxW5J9UEflGm1fpcyRAAmvr8D_H4jNgNOSubxqMGvwxG5JpR7MToPXsyM-GesM7lAG

170 B
188 B

21ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQvgVqW2Q5L1eVRod5NPKOgoORQqJZxW5J9UEflGm1fpcyRAAmvr8D_H4jNgNOSubxqMGvwxG5JpR7MToPXsyM-GesM7lAG

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQvgVqW2Q5L1eVRod5NPKOgoORQqJZxW5J9UEflGm1fpcyRAAmvr8D_H4jNgNOSubxqMGvwxG5JpR7MToPXsyM-GesM7lAG
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0449
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmQm90w-_JkQz8gszxOTbuHHikm68fAof2W2gc8fDDu-LOlsPxWYKVETNUTu-CoBCq-6k7JSsrBV6_-YhLLZ3KopHS7flbEY

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmQm90w-_JkQz8gszxOTbuHHikm68fAof2W2gc8fDDu-LOlsPxWYKVETNUTu-CoBCq-6k7JSsrBV6_-YhLLZ3KopHS7flbEY
date: Thu, 17 Aug 2023 13:01:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0449
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEBb-C4iIGy5lDwk-qW6WigA&google_cver=1&google_push=AXcoOmT1xOPN4g5BTnnUvPQdRjmRhJGzm6P1A5mTkxdEEnNyzBMbHfqiNswxzrXym7VNVZch_7UU0TIFmSye...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmT1xOPN4g5BTnnUvPQdRjmRhJGzm6P1A5mTkxdEEnNyzBMbHfqiNswxzrXym7VNVZch_7UU0TIFmSyeQnQXJZunb2HvjIc

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmT1xOPN4g5BTnnUvPQdRjmRhJGzm6P1A5mTkxdEEnNyzBMbHfqiNswxzrXym7VNVZch_7UU0TIFmSyeQnQXJZunb2HvjIc

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmT1xOPN4g5BTnnUvPQdRjmRhJGzm6P1A5mTkxdEEnNyzBMbHfqiNswxzrXym7VNVZch_7UU0TIFmSyeQnQXJZunb2HvjIc
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame 0449
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEIga3ZGSnNE7ROjg51m5Mzc&google_cver=1&google_push=AXcoOmSwimRovR20vfWeq5ExSk5CEOCOBCtjzXOjOkmmerQzNLyWkydyqKoFk72vuXYohbR64-8AwyDHH_1TdXaBS9w0tjSlGRk2Bg
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSwimRovR20vfWeq5ExSk5CEOCOBCtjzXOjOkmmerQz...

43 B
1 KB

32ms
16ms

Image
image/gif

141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSwimRovR20vfWeq5ExSk5CEOCOBCtjzXOjOkmmerQzNLyWkydyqKoFk72vuXYohbR64-8AwyDHH_1TdXaBS9w0tjSlGRk2Bg

Protocol

HTTP/1.1

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Thu, 17 Aug 2023 13:01:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmSwimRovR20vfWeq5ExSk5CEOCOBCtjzXOjOkmmerQzNLyWkydyqKoFk72vuXYohbR64-8AwyDHH_1TdXaBS9w0tjSlGRk2Bg
x-download-options: noopen
vary: Accept
content-length: 273
x-xss-protection: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0449 0
12 B 16ms
15ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LT_TxH8BzeHwf2NRaVNw-PreriWToO3xZBPCKqZ7mz766W4fVRstvgpCqg9fZTWSoDEV5u3A

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2611 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=1cdc615f-9e3c-a3b7-1cca-a39a53d420b2&tv=%7Bc:lyzHu4,pingTime:-2,time:1065,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:996,beZ:998,mfA:1000,cmA:1001,inA:1001,inZ:1005,prA:1006,prZ:1013,si:1019,poA:1020,poZ:1044,cmZ:1044,mfZ:1044,loA:1800,loZ:1802,ltA:2061,ltZ:2061%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:1065,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1058~0%5D,as:%5B1058~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d*.990511-61634096%7C1d1%7C1d2%7C1d3%7C1e.990511-61634098%7C1e1%7C1e2%7C1f1%7C1f2%7C1g1%7C1g2%7C1h1%7C1i1%7C1j1%7C1k%7C1l%7C1m,idMap:1d*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,siq:23,sinceFw:1041,readyFired:true%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 5EBE 120 KB
41 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 07:39:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 07:39:37 GMT

GET
H3 200 template-43bf74fd.js Show response
s0.2mdn.net/sadbundle/15874828848628604197/ Frame 5EBE 40 KB
14 KB 12ms
10ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15874828848628604197/template-43bf74fd.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1083d32b6bd31c5bb8b662eb0bd3840484d66a62b699da6acd56b83f7ba05a5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 04:59:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460939
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13999
x-xss-protection: 0
last-modified: Mon, 10 Jul 2023 11:52:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 04:59:14 GMT

GET
H3 200 index-09647504.css
s0.2mdn.net/sadbundle/15874828848628604197/ Frame 5EBE 4 KB
1 KB 15ms
12ms Stylesheet
text/css 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15874828848628604197/index-09647504.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09647504671a7ef9bb925c74c26e6be969edc1ded8ef8a94aa4b1ab1cdfc60af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 10:48:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180771
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1375
x-xss-protection: 0
last-modified: Mon, 10 Jul 2023 11:52:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Aug 2024 10:48:42 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 4374 0
104 B 104ms
19ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEIzH9leY_XylT1NdafnI3kA&google_cver=1&google_push=AXcoOmTIDA5bvOEi5HBDxmcQVU5INUF_P1hTfx3csBPSwfilA1U974z8lwnRZzcPau-LoApGCesrjTA7mFAV2v63WyMM1NUa_UT8
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEB7OFBr6q6VQRldcHPLaVm4&google_cver=1&google_push=AXcoOmQmhFmX5I_603D72DZJot13rVBbmokN0x0UgZbs8W_vqwwC8gysEswbzy3eLuk7qH7O4QVvE2kKEVPIqGPG...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQmhFmX5I_603D72DZJot13rVBbmokN0x0UgZbs8W_vqwwC8gysEswbzy3eLuk7qH7O4QVvE2kKEVPIqGPGJXOyeS5SazTA

170 B
188 B

20ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQmhFmX5I_603D72DZJot13rVBbmokN0x0UgZbs8W_vqwwC8gysEswbzy3eLuk7qH7O4QVvE2kKEVPIqGPGJXOyeS5SazTA

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 17 Aug 2023 13:01:33 GMT
Server: MT3 1031 59fd23a master zrh zrh-pixel-x25 config_version:"1524"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AXcoOmQmhFmX5I_603D72DZJot13rVBbmokN0x0UgZbs8W_vqwwC8gysEswbzy3eLuk7qH7O4QVvE2kKEVPIqGPGJXOyeS5SazTA
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 17 Aug 2023 13:01:32 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENvJHK4HcR8O7rFzmqSMHLg&google_cver=1&google_push=AXcoOmRuzHtX74z7xY5w3Vdu8Q4nQbtFeYXOZMfwNUbWb-eFAyMuV8qQgk7o1UjIy-_6NqiiI3PTssKmiWr...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRuzHtX74z7xY5w3Vdu8Q4nQbtFeYXOZMfwNUbWb-eFAyMuV8qQgk7o1UjIy-_6NqiiI3PTssKmiWrVX4WAGWFhQ-IWFq_K&google_hm=_KKGDkWOTdWx0FgQ7-ZXLyM

170 B
188 B

21ms
20ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRuzHtX74z7xY5w3Vdu8Q4nQbtFeYXOZMfwNUbWb-eFAyMuV8qQgk7o1UjIy-_6NqiiI3PTssKmiWrVX4WAGWFhQ-IWFq_K&google_hm=_KKGDkWOTdWx0FgQ7-ZXLyM

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRuzHtX74z7xY5w3Vdu8Q4nQbtFeYXOZMfwNUbWb-eFAyMuV8qQgk7o1UjIy-_6NqiiI3PTssKmiWrVX4WAGWFhQ-IWFq_K&google_hm=_KKGDkWOTdWx0FgQ7-ZXLyM
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGfEMhLhgbjo3FQBCKOkUFQ&google_cver=1&google_push=AXcoOmT3KXeIkPCFvg3KmfHUtL_usR_ejsd5ZVXL31JyWtrnMFfgupJPVYwkStRlJO6RCHS-COKxCVMLufwkXNwTAwrBC1o...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT3KXeIkPCFvg3KmfHUtL_usR_ejsd5ZVXL31JyWtrnMFfgupJPVYwkStRlJO6RCHS-COKxCVMLufwkXNwTAwrBC1o4si8p&google_hm=eS1PbTBiT1dSRTJwR2QxU1...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT3KXeIkPCFvg3KmfHUtL_usR_ejsd5ZVXL31JyWtrnMFfgupJPVYwkStRlJO6RCHS-COKxCVMLufwkXNwTAwrBC1o4si8p&google_hm=eS1PbTBiT1dSRTJwR2QxU1ExaU5adFp0b1QzUzhDNjd5b35B

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 17 Aug 2023 13:01:33 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT3KXeIkPCFvg3KmfHUtL_usR_ejsd5ZVXL31JyWtrnMFfgupJPVYwkStRlJO6RCHS-COKxCVMLufwkXNwTAwrBC1o4si8p&google_hm=eS1PbTBiT1dSRTJwR2QxU1ExaU5adFp0b1QzUzhDNjd5b35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPVkg56Xa9NPy-1dldJywSk&google_cver=1&google_push=AXcoOmTLb_f_lzo9R7LVR58Xr0s7hcxMKsstPbWk6Sx4ijEgaYpBxmng1E-PWe9v9uQDEzK5WLM2SzLaNpYrMley4NfDJaB...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPVkg56Xa9NPy-1dldJywSk&google_cver=1&google_push=AXcoOmTLb_f_lzo9R7LVR58Xr0s7hcxMKsstPbWk6Sx4ijEgaYpBxmng1E-PWe9v9uQDEzK5WLM2SzLaNpYrMley4NfDJ...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTLb_f_lzo9R7LVR58Xr0s7hcxMKsstPbWk6Sx4ijEgaYpBxmng1E-PWe9v9uQDEzK5WLM2SzLaNpYrMley4NfDJaBp2g9C

170 B
188 B

20ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTLb_f_lzo9R7LVR58Xr0s7hcxMKsstPbWk6Sx4ijEgaYpBxmng1E-PWe9v9uQDEzK5WLM2SzLaNpYrMley4NfDJaBp2g9C

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTLb_f_lzo9R7LVR58Xr0s7hcxMKsstPbWk6Sx4ijEgaYpBxmng1E-PWe9v9uQDEzK5WLM2SzLaNpYrMley4NfDJaBp2g9C
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSm7f...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-gNZ9p1vDsEjspQOxPMAFZ6F90eh7-MypGamLvw&google_push=AXcoOmSm7fy0Q2RZBCaChZkaKQHPt7-zdayJ-9-GbeXRruJHuMfsRSjiztReGEYNpY9hiPNcM37qKNsH0Ml7...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-gNZ9p1vDsEjspQOxPMAFZ6F90eh7-MypGamLvw&google_push=AXcoOmSm7fy0Q2RZBCaChZkaKQHPt7-zdayJ-9-GbeXRruJHuMfsRSjiztReGEYNpY9hiPNcM37qKNsH0Ml7IG6y7YbEeijuF-xK

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-gNZ9p1vDsEjspQOxPMAFZ6F90eh7-MypGamLvw&google_push=AXcoOmSm7fy0Q2RZBCaChZkaKQHPt7-zdayJ-9-GbeXRruJHuMfsRSjiztReGEYNpY9hiPNcM37qKNsH0Ml7IG6y7YbEeijuF-xK
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 763763
content-length: 0
expires: Thu, 17 Aug 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4374
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESED...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmQEQWO5jDKb_7fmSsKM-q0liKWkpnGBHek-Q8C81OPIXhMNP_2ekSsP_cIBAcYVqMI1B0_XvnfBbt6rguXMGrLe1dfriIc&redir=https%3A%2F%2Fcm.g.double...
https://sync.targeting.unrulymedia.com/csync/RX-9143a742-f521-46c8-bfb4-44686c590640-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmQEQWO5jDKb_7fmSsKM-...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmQEQWO5jDKb_7fmSsKM-q0liKWkpnGBHek-Q8C81OPIXhMNP_2ekSsP_cIBAcYVqMI1B0_XvnfBbt6rguXMGrLe1dfriIc&google_hm=A5FDp0L1IUbIv7REaGxZBkA

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmQEQWO5jDKb_7fmSsKM-q0liKWkpnGBHek-Q8C81OPIXhMNP_2ekSsP_cIBAcYVqMI1B0_XvnfBbt6rguXMGrLe1dfriIc&google_hm=A5FDp0L1IUbIv7REaGxZBkA

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmQEQWO5jDKb_7fmSsKM-q0liKWkpnGBHek-Q8C81OPIXhMNP_2ekSsP_cIBAcYVqMI1B0_XvnfBbt6rguXMGrLe1dfriIc&google_hm=A5FDp0L1IUbIv7REaGxZBkA
date: Thu, 17 Aug 2023 13:01:33 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX9143a742f52146c8bfb444686c590640003
content-type: text/html

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4374 0
12 B 19ms
16ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LN_WZlpcCHCs8loKSLZFydSZzGoHcx9AH2DRkHNVO_SYV7hV-RNE2u-zqkG0SKnz7aGJcR

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DAAE 42 B
64 B 119ms
119ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv30IW4nU38ZcgLSkr9W0HzMtn-0a8y50CztARkai2trnx9tDhkOZLpWJa6WR16DhJqTCyO4EoIevgU10ZHqbZqpHO_Ku3Id-7mNIvvUySXFvrSd8oIXpvL6JcKp1u2mIxDmTlOonySuzFw&sai=AMfl-YSrpoo04WLXTJXIziUrKSPnM3jJHL0feVkuuewq1Xi_1gsH0IQbeFOFeHOUKC2fadksvBlBLVSXHAMVQCd-b9LDQG0LP9PKH_EAKB2tBFgXD65gaTML4JbAUkiDdxNW55qk84gCFxfRuTyBMaI&sig=Cg0ArKJSzEqKj2XqSaKoEAE&cid=CAQSTQBpAlJW3Bz4x7GNRcl-UXg6D-yNEyjgZzN7Y_NUs4FCTGbEqDXFnRtKxce1QuD9uc56Q2HrfM_QrMllAtdHhstU01b3Vl5x9e86_tavGAE&id=lidar2&mcvt=1187&p=427,315,677,1285&mtos=1187,1187,1187,1187,1187&tos=1187,0,0,0,0&v=20230816&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=428443499&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1692277291682&rpt=642&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame CE06 64 KB
23 KB 35ms
13ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b765b0cbd95391f6db0b565988eeb70ea68aa77bb9f8f7c8a880d96474c2aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3065946
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 23292
last-modified: Fri, 22 Apr 2022 16:32:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6262d89e-5afc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cXqcEf%2F8kMTU2PhgKK9REvoiMOkZfXPnJegjEtUJiD52AaIAnI8u6SGnjT7QWTTBOZ5J%2BAY%2F2Q%2F5kbhfvP405v8YVZonkzpP%2B7O43Qao0UokNXuInlXGOsk%2Bpy9XA5LCgkn2juT2kbEehQs7wckA%2FdAw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3cfaec9a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H2 200 EasePack.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame CE06 2 KB
1 KB 37ms
15ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/EasePack.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

535520dc8857dfcf9610d361f99e9d419786585dda328a3f6635eba5982803d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5938285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1193
last-modified: Fri, 22 Apr 2022 16:32:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6262d89e-4a9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fBZ%2BreQLnnF3jpNV%2BnSbQbUDVRPVoxWSPTy%2FD1rmDGNlY%2FdxwtTaLVqeXbKmYtkJwcYfYAt2XH7xxaXJn%2Bd%2FMliFrTSxoQwoMk90A2u%2FEF2Dcj69pVZ4qFUz9behWRnLBkdmZa7ysPZyrN9fazmctjT%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3cfaed9a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H2 200 EaselPlugin.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame CE06 5 KB
3 KB 34ms
12ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/EaselPlugin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2eadf86ab162e1d578164338aea12323e59534a9d43fbd526d609a667965003d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 636948
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1914
last-modified: Thu, 22 Jun 2023 11:03:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942a86-77a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzXJWp6zgteMD%2B%2FWugW4Kcy0eKMVa1IbAN07ytZBoiOVdXs86MH%2FiApk3leGFVsU8ZXLd0Um3rjBQZ8k%2FHtrXXTgl9hflt1OSylWfRhrvXz5PECMNe%2FCp9McF7Ch8HIBS4%2BL6XREzJ2pLJ%2BPnuowlOCX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3cfaf09a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H3 200 HYPE-724.thin.min.js Show response
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 55 KB
24 KB 8ms
8ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/HYPE-724.thin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa4ae93330f3a0b8e253e34bc6d66018d996fb5d56ef0802e6def0d91fd035c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 05:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547262
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24394
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Aug 2024 05:00:31 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F484 22 KB
8 KB 10ms
10ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 76F4 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/346383189655976896/ Frame E623 1 KB
767 B 16ms
15ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c36f708542bca1b708ec3db7d82a1a8521966d09a2cc57a0a368f107b05d1da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 13:01:33 GMT
expires: Fri, 16 Aug 2024 13:01:33 GMT
last-modified: Thu, 27 Apr 2023 13:48:41 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7552 0
0 54ms
53ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsseIuRIVdARpBk4ljKU_UVt9-hgoEIZaVB3vHGIyr33xYAyw0_hy9C9Cr0miQO8QwqEyv-7JS3LN2hTPJTKbRxh3NFmjXDM2ooF4vtOe5mQl1ecn1Zi147p5Pk17U57Xuh4W-sFsAfAzE8sb4p1155cWpiD5ca2TkQdLQP4TADdxNhijvEz1aKIik-OUO7b4D9O6XCZBHe2mSBBxq61iiRY6IuORLw1xDXxEZIZowavPp7ErSsIoTDhhI2uINAByN3rXJvwDaZLvCJacJrNeiFKN4O6quDGKMv_LYPl2d_JI7Kz105uhReSSYs5qXE9SFHqnPt_e9k7enINCjLYeI9rOnani3ynewjOmaFwYjxlOmOAUEtWmN9URiYsPw6ioyVlcQgKkVEbLaT07YsHgF-Rm6AKQRpnZGoXTDglDlo87IvKwSN-2wwgeGhhcnCeG5HeYDdUaPKwqiSUO5N5lhY9EIYraJPtFbWSzueIeYcCs95501268gM4qsirH0ddhbdSgyB8rTlPHvn1fkfl2xCD1vf6I84GjMEDLjerly_d8OBYjebjgdwZB7ZziR-V5VBdO3t673FnUh-HqWKkE87i4hlJNBM1yavbDUfSHlLRdJOvLMwIZ6PIutItrGGqivc5DeiXW4N_bvOfLeSt2rTMaUhKDxAPNANI68Kym2lqwxahTF2hruqdtRL5e4_AfTCQHYwM16MMZ7IEG50PA2Mk00m9KblmUe9Y4AHsOFGbgfhnXfrBrOVOJoBqD4qvfF9aVP3-BvKIBbct7Dgiz5bVsimVvw-EX7U7c7wWFI6fwpnwn_HTlJkpM8fIes_VyZG807R0x6yaAgzCQrVxGEUFqpcfg4hYj-AKtcyJCTT5ZnKNkbZtVoIeTjqwKbVLSFUMM0nwfczW8XDhHD8AX3oEn6yX68e448lSn8kC0e-CAUYhvzD_x1AI_VCKsPgVoUjkAwO7AfcwKZgPgGBeHXY-X1uwLFJ00olqRSOkDs55gqRNJGw-EsM35oWs7If2wyex6dbuBz0hMVGLovIY2058zVih9tdpTYo-vtTRAMK_r9EnZIBgLxxOtYO9NGOTk_QlnMGa-Diuzgm7NzldVcs16sq6Luy1I-4_3lsZxRRT9mMEgN37fjGluhZxN5nO6yMRx9Njo45N4GILsYFPnDmsmsrONTxfUUasolDP6pGRBJjUoPniLhdUnOrhrOl670PduPkpOc3aNTNuOwroVP8tL2Sv949Q_ia4xm4mq2NCOCyWQgV1bMw_WQNxGlZbriJUiBqxcglmMfGPL1qhsrQ3-yo-iTtAUQZMdslY528eoRWDSS__75RHH7WtFg&sai=AMfl-YTNmY21Iskm2BdZPBppg1hCC2mhBq7xgMbQxXvxyOXmglQ_Wx1EEw_OBeD7b5XslBycg4draTAj6YuRwJVMh88Omf8Yunb9crtBPp5LQkhLTHmWXKDNC9UyYizOxwkdQ0qUhj8lcJlZHw6oAedrVH_w-nL6GGh0nv9Tdh1UeXrzSHXYo-m9MajrhzjmhrDIAfT9NhIc5Bpit8H3rBLggmF6VOaLItBuFvRjPkh4J8Z23ezsS1HxuLp5ChWjMlgNcZJLVVeoREV527MAsomsguLiGzISO_rqFvn3yOUu0L3_MOkMfy1v7vX9GpRL&sig=Cg0ArKJSzNYPVGBau-cNEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1081&cbvp=1&cstd=1069&cisv=r20230815.29346&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 7552 60 B
60 B 102ms
27ms Image
image/gif 213.202.235.9
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=181030143&extPm=361382287&gdpr_consent=&gdpr=

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.9 Grenzach-Wyhlen, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Thu, 17 Aug 2023 13:01:33 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Do, 17 Aug 2023 01:01:33 GMT
X-ET-Code: 0
Content-Type: image/gif
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp: 1119
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 29 KB
10 KB 10ms
9ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80e2fd0b6d11bfae40318ff8cdbd60de62b1fe1e352f3317a371f1e44c85783b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 523870
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 9953
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 11 Aug 2023 11:30:23 GMT
expires: Sat, 10 Aug 2024 11:30:23 GMT
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A8A0 0
0 78ms
77ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssqj-wcfVBnPERYn6TsJdroh9JA-JyBNCUcpxFiDxA7D28IfRw6v3mGfXeHkVsyg5u66Gz3wEKcVizc9JSQxmwV7UjwBBn1SDbaPjI1Nn-tFj3na0fXM1F8_FIKRmlqCR4IG4AiynRPPltbeX5Y-S7F_HKCpYWiUoC4CO3eOs5ZL3wLhLNbh70Sm0Re6cK7cFdAwW-F2mV69sIXswtVnaVu7bvNp3axet8YIbErP3psv7UbjL3ubFwank_DvfHgj49tECxZbNdl1zpN8fDp-bZZ4iCk0n6LmXIjZiXDsqmPO8Wk4fDjTIxNVgR_g9dtkoOZsxnWR4vYvuEmEy7b4yrxqHxiZtTYqhr-XGlZoemqDTgpbq2Stit-z4-bhDrYr6Rrv8U4SkNB78C4hZM428B3Dbfr0uYCczc__znwmUjd0Z7xXfPXJr9uryIoREiKF125zwNXdFYURRH0eq3B9tiniGpzv4WBXAqY9IsUR4w91ZrWip_SBPAKOl8gQMs4U8u0P3oE2yv9JE0Gr1SRVKRA8GnqyQNFcYZeTaHMQuxYzc0Nyv063R1Ip1_YSlErWShqRLAVU1jjukb-LFDHFap-73ITNCvrljY-8cZd9073pmVUmRGIwe1JbIxFzvPTcdAlWAqhJL8ph9Op6JDSEViiPhQ0oFYZRlGKHQP3txCtWhyy1htzC1XVHd8XN1bVb6-KprF74u3Hr5MRUuqeUK4_R2KzTpjTEHBcaHMCtobNWtsFK3qRSgGp0m5TwRiqom1_vjvmKQsWXRGuTCPxMJeXSInZagG5VmZTKGCTAJa-i1x0wj-hGvxERDEz6d1DuopmFA8RyQnr_hKPUx-Tul0c_uo1NtvOX7gdwM6wqQMMrov-YjWZ4i6011H6i84uHz_cXhXHXDyGZI3mN-k48AcSRu4rRKgY-3_jiaW1ccDYtJk0I8fIHVWiJtBd_i59LnqbwvQsfuV3HgGeyQLI0Lg5U0CYqsku_3vJ8yqJGFBU9mVMtbiXfa5I4PMFK9UWrbhMso0J8t_D94WBVyfNTGMHo7O704TEIJP0wY625NBVrcoQaJM3xGRoiFwTBx_eZVQxSsuSmGIYxhRoKxPq75hx2lO7316kad7rRrnVmYVIUToZGYsRMhzzZ8tXdtdIE5i2u73kDjWVSFqPrPLSWJipHLkQ7F2R2qnBRotsbDBly7iYTl6OOEgtpI05TB20nkzV3PmDjkIBC_mepaUOL4UFk_OIp6x654LZ6zHzLAkGl-Yqs9w&sai=AMfl-YQbT2xuivUoAd1XO3_GaBogd3HRrSpwUMyqczHyHs3pk2fz0XKZOgxg_uvb-nQpAjyCUnKDjCz-yHqmtH6ddpWqmRdCI3dslNjF420OOVJRhX68opRBIf11kuGge0w7qqevapColFI5wN7BYmPlfLHAywmLsBh-Hp-EMzn06GYBSuqYhafyLNbti9t4LfuXSoNvoRwvjohV1oXh9ExwRT-MtGAue-33bi33BhbR_7QthWychNtEjvjXZt8-A1S9f0DO86_BOF-KDPldpj58stsXeQic4d32fPGMKF1G8ByhZD2CxtlES3lDUkMP&sig=Cg0ArKJSzLBVZcGgiEhFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1075&cbvp=1&cstd=1074&cisv=r20230815.41877&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 7CA0 37 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143189
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 7A46
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/990511/61634100/4.js?ias_dspID=3&ias_campId=1013669275&ias_pubId=pub-7983651257838282&ias_chanId=1&ias_placementId=20338656165&bidurl=https://asura.nacm.xyz/&i...
https://static.adsafeprotected.com/4a.js

2 KB
2 KB

16ms
15ms

Script
application/javascript

2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbead98319b2bee5757af35b4eacf615df3e45da2f69cb999cd4694a26bfb90f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: akOqjFMSMxNB2K6FJA8jdyBVXEiL5nl0
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
date: Tue, 15 Aug 2023 19:01:33 GMT
x-amz-cf-pop: AMS1-P1
age: 151201
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 08 Aug 2023 19:01:30 GMT
server: AmazonS3
etag: W/"589d8955c4906ab1b8e63a2f92d932d3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: AIwFB-t4rZQ0vAVRHYkraZFHHDyzVu_WjEAKo5t-fRaF-8JgTeEaVw==

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6D73 91 KB
23 KB 21ms
21ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 29 Mar 2023 13:56:00 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 12179134
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: IasEQsmNcLBtL9xzKg03gMrgMh0IQHrIddU5yfG426FDSUYDkD8MQw==

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 114ms
114ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230815&jk=2304358973609434&bg=!dHeldyPNAAZGPLJIZjw7ADkAdvg8WjUlMYRBaigQecss0e1c5JSIo0jev4mG9Hywwy5vTNOhhQrHsNG24jgtbDUwDktaHXL61OcCAAACm1IAAAAHaAEHCgBP1_uHTeK7mgmz1rmZ0UpirxQSHQdJ7HUSiB_2Y3Yz-OZ26i8qVUSQbxXWRw62rWl887930snzp4r0HAWe93seh_ZqrBMCXXX7PBsxhZRaEZkCx_zeluq6G9W7p3Rb8yETkGZviqRKIMqhF23UDFZ4SkD50W4PUXYxg4tPEUZp4fJFRsvuzP_H_jI6xDoxUxv_6CvyHg9pMeup5XSIGeA_DNWv2uKEvr1EEuKibmHNJsHvH_cu_zM-KPRQlElSOrTrGD1zvxdSrjiRFArsZQ_sg568N-zN3rEoOa-lVe2wUP5Y7ZONxRPAiIvpD-VUTSODqmpgvglicOKEoqVwygSvqEI3CH4l8Crny2J_p3zWaOVyuzZ9AZLW522socdLUJK9G-gEMmEgpun1Cm0XxJeE1j-VtJw6jHn9_rhJTBybFfS3wUz8hKLv2a_ftf8lBcuCF46NkSzNhkDQS3-KZeekqNVk6769yaVyP1BjiZliqiKRfxjdhTh3rpWyOvJi_ob9y1QWjNdPvPOJ91OZl0diGtUnVoETlVqJBx2RerAwcN_O9N9ZLSyOoNJzjHDex4_cqvN6kaeiMBCNtJuB_AnyDGBd1RuOrOPYwql6a6_SHUychGgurzQnutUrDAk7-DZbS2fJDUfUUJbNN_Fcu3So_Hb_qWrXljc1nWoEpM7bmpUNvwe5cy6ffD0UsXgvBNRDurliG8HM8RrCMOKKI3-Ysq6rw0HTI5THxrDzOtdek6HzjBgEqBuZX9eYgUyVavwovL1oPTPVUXFrqW3dM47RJUhTHZKkv5auHssXD7dC0LF4frJQW_BWxhLTfLqKsHjU8_W6Hidd1WpFHlGPn6T4IhXRIGU3Dv1C4Mgu_v4-HOXRR1mt5_wZ7gljGco1jttr2eOmd3e7iX12oiiP0eEffvfBfUgThxAWzNcqa-DzMA0Jqx5vamZPoOmYoYuzBllNnQc1J-owrNhU08CR8KA7CfwwIR10tcPjvBnS3pHqDYe-lzM26xARCMg5mq-rBTQ_ok2nVfCl8DUqWN4pFf7Ata5W-LFr1QjBkQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FB16 0
26 B 64ms
46ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu5X4pWOlUriN3LsCo4HlbrZ2oCeclWOvvmTPHEvpA7U4TPYAr9lhksFKEzqmiIM-Fxfcq7zjx1tEMpBSmC0nsW2AfPOk-AIhPM8V76HF60H5kyRs5HmrvhvAy7pD7ePRmDRkGtDf4Nfc2I3WbBrVg4_ECnm8QbmJlY8e8QOy0&sai=AMfl-YTLtU-_KZJFDmlGGi48s-yF0zVj5JSRPto-WOBkym9e3vyKc5g8kQGcWfWz40Eh5goC0s7Kf4eKD-7G2tteanEvbHg-H5WABc5Q1EnydrfZcigmWsxtJzauixS7LA7A0RhU6C5scrIck9SC_qpqXg&sig=Cg0ArKJSzPW3qZuW7geCEAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 8EF0 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143189
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 6933 0
103 B 14ms
13ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESELBWRa6BxEVUxyfaIR8gDHo&google_cver=1&google_push=AXcoOmQNriuWWvAnTzAgJU0GPpJab3XUGJpCVQxriWkaancs-_voWmepYaD8ZNEBPuveeu7szGnhVB8he1Ak3x0KilxXhDaiuqg
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6933
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

24ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTXI2Y_mm9Ajj8S79ytvYN7yqAlJcNB04Kmgz7hTKiJ6kgoU3kt-SPOMC8nqVl5pZG4CgsxB_f6RhdDg9PFCWIAe7ruxT3v

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cH3f_g-JTHOe-HzvfhJH0A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmTXI2Y_mm9Ajj8S79ytvYN7yqAlJcNB04Kmgz7hTKiJ6kgoU3kt-SPOMC8nqVl5pZG4CgsxB_f6RhdDg9PFCWIAe7ruxT3v
date: Thu, 17 Aug 2023 13:01:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6933
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKJvt7KmVl1iJx9Uv1Tm_ys&google_cver=1&google_push=AXcoOmTb_GwJ5osuJu1fnSj2F4HmcQrMlmN-6P7-Rc0VBDZXa_A5RE7hxXQy9t8Lc5eEm3m9d1l...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDItMUctMURRQQ==&google_push=AXcoOmTb_GwJ5osuJu1fnSj2F4HmcQrMlmN-6P7-Rc0VBDZXa_A5RE7hxXQy9t8Lc5eEm3m9d1lTiBczhDE5CZDe7HlgE74FtE-k

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDItMUctMURRQQ==&google_push=AXcoOmTb_GwJ5osuJu1fnSj2F4HmcQrMlmN-6P7-Rc0VBDZXa_A5RE7hxXQy9t8Lc5eEm3m9d1lTiBczhDE5CZDe7HlgE74FtE-k

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDItMUctMURRQQ==&google_push=AXcoOmTb_GwJ5osuJu1fnSj2F4HmcQrMlmN-6P7-Rc0VBDZXa_A5RE7hxXQy9t8Lc5eEm3m9d1lTiBczhDE5CZDe7HlgE74FtE-k
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6933
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEOLSx8nHQyBqpMplMHNqX4I&google_cver=1&google_push=AXcoOmSluRnnNQvC_t9R710qBL0Nx12-76TSACfMZ_92C5DifRZf9gjUxlTs8XpL0XXFVdebyv5n9_N-gE3tcpIeNZAKP2FhIF1y
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmSluRnnNQvC_t9R710qBL0Nx12-76TSACfMZ_92C5DifRZf9gjUxlTs8XpL0XXFVdebyv5n9_N-gE3tcpIeNZAKP2FhIF1...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTAwOTIxMjgzMDAxNDkzMjE3NzIxMA%3D%3D&google_push=AXcoOmSluRnnNQvC_t9R710qBL0Nx12-76TSACfMZ_92C5DifRZf9gjU...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTAwOTIxMjgzMDAxNDkzMjE3NzIxMA%3D%3D&google_push=AXcoOmSluRnnNQvC_t9R710qBL0Nx12-76TSACfMZ_92C5DifRZf9gjUxlTs8XpL0XXFVdebyv5n9_N-gE3tcpIeNZAKP2FhIF1y

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTAwOTIxMjgzMDAxNDkzMjE3NzIxMA%3D%3D&google_push=AXcoOmSluRnnNQvC_t9R710qBL0Nx12-76TSACfMZ_92C5DifRZf9gjUxlTs8XpL0XXFVdebyv5n9_N-gE3tcpIeNZAKP2FhIF1y
date: Thu, 17 Aug 2023 13:01:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58281/ Frame 6933 0
38 B 13ms
11ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEKzSgjQuPhu-Hy-U82fM0vU&google_cver=1&google_push=AXcoOmSek8ICnbgRfRMfUJaVtnZgtKhJqNm3gbM4bmZB4BC5W-5_e5L47lInt9OGDrVgGtWFEwAqOO8JudMFASuX49JbkbpUXVMrDw

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.75 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.75
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6933
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEJKx2u5_F4L2WHALrlqcHrI&google_cver=1&google_push=AXcoOmRVbLOTggHQq...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D&google_gid=CAESEJKx2u5_F4L2WHALrlqcHrI&google_cver=1&google_push=AXcoOmRVbLOTggHQqajBSfljXHDs1_GGCB...

170 B
188 B

22ms
21ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D&google_gid=CAESEJKx2u5_F4L2WHALrlqcHrI&google_cver=1&google_push=AXcoOmRVbLOTggHQqajBSfljXHDs1_GGCBlEbl9DFoRL4L1rJJRcK0AKBPaz9RyME8HaHA-GHY7KhQ_9Wwh_RJVbzk85HeGXmzJPtQ

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
an-x-request-uuid: 0876862c-7ca3-4e5f-95dd-8f9ea2213905
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTEyNDE3Nzc2OTY3NjE1MzkxOA%3D%3D&google_gid=CAESEJKx2u5_F4L2WHALrlqcHrI&google_cver=1&google_push=AXcoOmRVbLOTggHQqajBSfljXHDs1_GGCBlEbl9DFoRL4L1rJJRcK0AKBPaz9RyME8HaHA-GHY7KhQ_9Wwh_RJVbzk85HeGXmzJPtQ
x-proxy-origin: 81.95.5.35; 81.95.5.35; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 6933 43 B
146 B 215ms
8ms Image
image/gif 3.74.143.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEG6UyUYB7O3DLurCu2WQd2g&google_cver=1&google_push=AXcoOmTuYgEzq_wnJoREgC1qxy8u7d90BL_QxQDIaipgjVaLXDwvgsShRFac1Elvc2ZLrK9b5_tAbALaj7Jc23Yve9WXkskH8pqM8A
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.74.143.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-74-143-72.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6933 0
12 B 17ms
16ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I29huftayNR7BGqR4F0PzLgpLVLrmUakNYIXeWHyuzbno9Zloa9eh8VWJT-GQRBpGDfMmNnxe5

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2611 0
26 B 87ms
81ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcZcL5JY0Ze7PwjYXGHVNoIHttRlBQZXUEcNM0Fz31dHY4KweZ4Z27Fer05pCCrQdekinbTsE3ln7DqPphwj1bytXKG-YbCcw1qjvvLe0O3En2WRS8ESa3IutVnfcslaYDRI_gWQiiFKwlXqTAdnpT-ypUlXlF6oRZNQxV7Zw&sai=AMfl-YQJ6pvtcVC-oEGkEDLrhknVgMxbRDyyRzuvpX4vWJ6Ob_RMQExVCPvFs5UFNPHGenzAJvM3Z90Op3TcGQG5AUDCkkdIA799umx8n0kKmTyfyV0IOamJ_-7KJyFGuB9IkVx3Vy6ZaiEWek5hryxk0w&sig=Cg0ArKJSzGOtMQchFDX1EAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E623 113 KB
38 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame E623 118 KB
40 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:01:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32423
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:01:10 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECMVENW3MaVYDsfM4i6CwcE&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECMVENW3MaVYDsfM4i6CwcE&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bThpYUVwVW8xUXdDRDM1&google_gid=CAESECMVENW3MaVYDsfM4i6CwcE&google_cver=1&google_push=AXcoOmQCiS5Dj8zknUJu-8zfAy135SKGXZ0C-SEl8aI1lKe...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bThpYUVwVW8xUXdDRDM1&google_gid=CAESECMVENW3MaVYDsfM4i6CwcE&google_cver=1&google_push=AXcoOmQCiS5Dj8zknUJu-8zfAy135SKGXZ0C-SEl8aI1lKe1wEtPtILDK90OMe-GczN6NAvllRTVRJBybv2bcx9qfZx-mkFmaJk

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:33 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-788-g55788f4#dev-temp-decrease-retargeting-updates-batch i-0f5e39ca57a5c2bae@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bThpYUVwVW8xUXdDRDM1&google_gid=CAESECMVENW3MaVYDsfM4i6CwcE&google_cver=1&google_push=AXcoOmQCiS5Dj8zknUJu-8zfAy135SKGXZ0C-SEl8aI1lKe1wEtPtILDK90OMe-GczN6NAvllRTVRJBybv2bcx9qfZx-mkFmaJk
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESELRT9u1w3pZSeulhvBnJXsA&google_cver=1&google_push=AXcoOmTnvp27GKMwDqndFVnz_mCmV5A8cDitGmik3VEHgqpx3VfaxfzbyVR6ymRAJlSmDM0l8sV6Cda2N-NVl4HCHB8U7Pk...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnvp27GKMwDqndFVnz_mCmV5A8cDitGmik3VEHgqpx3VfaxfzbyVR6ymRAJlSmDM0l8sV6Cda2N-NVl4HCHB8U7PkbQqn1

170 B
188 B

21ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnvp27GKMwDqndFVnz_mCmV5A8cDitGmik3VEHgqpx3VfaxfzbyVR6ymRAJlSmDM0l8sV6Cda2N-NVl4HCHB8U7PkbQqn1

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnvp27GKMwDqndFVnz_mCmV5A8cDitGmik3VEHgqpx3VfaxfzbyVR6ymRAJlSmDM0l8sV6Cda2N-NVl4HCHB8U7PkbQqn1
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEH286Y_0YyEbh6dgTCsNW-8&google_cver=1&google_push=AXcoOmTO8TDwQBZoFDHK1q3ywChjoao1JZWPUONc61hege7L7qV8Z9LivY5pUESsmH-BdTzCHzM...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDQtWS1KMVJD&google_push=AXcoOmTO8TDwQBZoFDHK1q3ywChjoao1JZWPUONc61hege7L7qV8Z9LivY5pUESsmH-BdTzCHzM6su72RjqoJ_MmJH4gfYEG7njP

170 B
188 B

20ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDQtWS1KMVJD&google_push=AXcoOmTO8TDwQBZoFDHK1q3ywChjoao1JZWPUONc61hege7L7qV8Z9LivY5pUESsmH-BdTzCHzM6su72RjqoJ_MmJH4gfYEG7njP

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVDQtWS1KMVJD&google_push=AXcoOmTO8TDwQBZoFDHK1q3ywChjoao1JZWPUONc61hege7L7qV8Z9LivY5pUESsmH-BdTzCHzM6su72RjqoJ_MmJH4gfYEG7njP
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5b959e9b7aef6dd90a6fa539ca64ac62
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENfGI1tuMw0fBWMn8-hLx_c&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENfGI1tuMw0fBWMn8-hLx_c&google_hm=ZN4aKxo5rluYf4iwTO1hqwAAFFsAAAIB&google_nid=index&google_push=AXcoOmROI6O8xBpmv0IaXlqWwPCGcDplyASUt...

170 B
188 B

21ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENfGI1tuMw0fBWMn8-hLx_c&google_hm=ZN4aKxo5rluYf4iwTO1hqwAAFFsAAAIB&google_nid=index&google_push=AXcoOmROI6O8xBpmv0IaXlqWwPCGcDplyASUt-spdvvTXxzdNhCyQmnS4M49e2QasSjfeyx4AJS0bF-vRBuJZqHAue949P17GBw

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 17 Aug 2023 13:01:33 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENfGI1tuMw0fBWMn8-hLx_c&google_hm=ZN4aKxo5rluYf4iwTO1hqwAAFFsAAAIB&google_nid=index&google_push=AXcoOmROI6O8xBpmv0IaXlqWwPCGcDplyASUt-spdvvTXxzdNhCyQmnS4M49e2QasSjfeyx4AJS0bF-vRBuJZqHAue949P17GBw
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEM0DH5xqvG7A3hl80Zcn6f8&google_cver=1&google_push=AXcoOmRMUFKeL7MPzUfXWWZ3rkj3KmriS32e5fZvfMD6YfMTS9xRPQnjDRJXHnQ48jRMdIfg8aiftHhuLaIQ...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRMUFKeL7MPzUfXWWZ3rkj3KmriS32e5fZvfMD6YfMTS9xRPQnjDRJXHnQ48jRMdIfg8aiftHhuLaIQeZxSo-m4-Ck5pjDe

170 B
188 B

21ms
21ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRMUFKeL7MPzUfXWWZ3rkj3KmriS32e5fZvfMD6YfMTS9xRPQnjDRJXHnQ48jRMdIfg8aiftHhuLaIQeZxSo-m4-Ck5pjDe

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRMUFKeL7MPzUfXWWZ3rkj3KmriS32e5fZvfMD6YfMTS9xRPQnjDRJXHnQ48jRMdIfg8aiftHhuLaIQeZxSo-m4-Ck5pjDe
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD95
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEIYG3yD8_8aBHLDq4dJ7XIk&google_cver=1&google_push=AXcoOmTbxqLuuhZaxkWktsnRtsc8hfeac3bOrjVjUc8PXY1IREmi5fOUk1cQCA-YNwtaOGSMbmdB-soP7IKIerZeQyGIJQ...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEIYG3yD8_8aBHLDq4dJ7XIk&google_cver=1&google_push=AXcoOmTbxqLuuhZaxkWktsnRtsc8hfeac3bOrjVjUc8PXY1IREmi5fOUk1cQCA-YNwtaOGSMbmdB-soP7IKIerZe...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=GE95ofgTSmSUxqltJDd6TA&google_push=AXcoOmTbxqLuuhZaxkWktsnRtsc8hfeac3bOrjVjUc8PXY1IREmi5fOUk1cQCA-YNwtaOGSMbmdB-soP7IKIerZ...

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=GE95ofgTSmSUxqltJDd6TA&google_push=AXcoOmTbxqLuuhZaxkWktsnRtsc8hfeac3bOrjVjUc8PXY1IREmi5fOUk1cQCA-YNwtaOGSMbmdB-soP7IKIerZeQyGIJQQf6mU

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=GE95ofgTSmSUxqltJDd6TA&google_push=AXcoOmTbxqLuuhZaxkWktsnRtsc8hfeac3bOrjVjUc8PXY1IREmi5fOUk1cQCA-YNwtaOGSMbmdB-soP7IKIerZeQyGIJQQf6mU
access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:33 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

report
sync.teads.tv/um/ Frame CD95
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEJgWy8-JPsfS...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmTtmckqpNFS9_TrXsyi3rdiV0W0lAOp6OvWQ20AavrWcTT5rKMiGBhXiJWXXEh_T8YhiArVOPke3VpOQOV_jdZnrCU5xudOlQ
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

338ms
338ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:34 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CD95 0
12 B 18ms
15ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K6AXOTQAu5lAR7YcrEbGZA-VIHvHt-5ELe6Mvar1X-xdIBX_2YbSr-gI-noGkDdtOn8q1K4w

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FB16 42 B
64 B 116ms
114ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssF58Ec43fpr8ROGjsQ191vfoEkSqqzk5t1xeJAsLyIT1kMLY6waqfEoTRISU-bj4dcvGU4dpaWHU1cRuDHlElkQ4l0df4q35N_5-ZDX7ZFe8fkEGr13wprNpOeZZzRZ4tbDpvf6CgQ68GS&sai=AMfl-YSq0PxX5iKb-UJZyDxEaSyOiJIPNCYqgmzOdlRqgiCPbh2oaPUTCy5T5XNHrA4NDeUFnPEDyld9wuDd80fOlvQjgY0ca5U8l8g_D9BaeWiC_7rjEysdJ2yW1JAGUoh8rJclTgkoi5h8xvMVhlKRm1ZhI9TcMWaN6dxcBkMk&sig=Cg0ArKJSzIJVareaghewEAE&cid=CAQSXQBpAlJWIByyRSKku4Xe5Htc3e-YdLt1UNJMcaaBOuKND4xLmdupQ1qtTRAwU_s60duo-nKTNAX-g_mscVsz-oRGWEP70Algv7eWKQb-dMKuvSUq-dfyW6No3nKeABgB&id=lidar2&mcvt=1094&p=80,129,120,170&mtos=1094,1094,1094,1094,1094&tos=1094,0,0,0,0&v=20230816&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1693144458&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1692277291533&rpt=572&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame 8E19 64 KB
23 KB 15ms
14ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b765b0cbd95391f6db0b565988eeb70ea68aa77bb9f8f7c8a880d96474c2aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3065946
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 23292
last-modified: Fri, 22 Apr 2022 16:32:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6262d89e-5afc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F3IsBUkjOfR2lGEYuqF8H%2BDdkts7zNe%2BEu3qBxIRQQJyl4icv%2FqiWTCk8ewUOFGXMX2pgShgwp34AUD2vOcpR6asbFwEoa4yk8js9dajAeWkXhuWTbnsrBY4umrYngPb3B1HNbR22AvPYyf4l5sekPpQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3e1c6d9a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H2 200 EasePack.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame 8E19 2 KB
1 KB 17ms
16ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/EasePack.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

535520dc8857dfcf9610d361f99e9d419786585dda328a3f6635eba5982803d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5938285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1193
last-modified: Fri, 22 Apr 2022 16:32:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6262d89e-4a9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QorzSNUxp%2Bs5SRS%2FiONpZi5UtXZonciF0l%2FprlM09Ql8sYRtoBiOjGn5312Cy7q5OPO9BPJuRYnMkiViCiSgUnwRDagp%2FAWqgJGvcP8besuoYikG3jwIkUfdkwpsNCDoX6akLT%2F7k7Jl7tvKqgOmbf0N"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3e1c6e9a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H2 200 EaselPlugin.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame 8E19 5 KB
2 KB 19ms
18ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/EaselPlugin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2eadf86ab162e1d578164338aea12323e59534a9d43fbd526d609a667965003d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 636948
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1914
last-modified: Thu, 22 Jun 2023 11:03:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942a86-77a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JHBmRCz%2BSHUudpqxh%2FNSV2dtPepjWALjK0gJ6EexE%2BZJAg4fteAyZkKR2G5Ma1dsAZqNPsmIRmiHQiD8nJtuyh7ytXQjv96Gy8wVbdFXMuenlnw0oeLKFhohfhaqt4qaOMuQS6EOaO4pNOuVeKezeShQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7f821b3e1c719a18-FRA
expires: Tue, 06 Aug 2024 13:01:33 GMT

GET
H3 200 HYPE-748.thin.min.js Show response
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 56 KB
24 KB 11ms
10ms Script
application/x-javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/HYPE-748.thin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

850af60bddadc6651fa5acbf1034ae8a9d6941c838d1fcdf79eb046f833e7ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 05:00:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24575
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Aug 2024 05:00:02 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C95F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKM39-9CA8FlVEfxSTrp_fA&google_cver=1&google_push=AXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbpAZ...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKM39-9CA8FlVEfxSTrp_fA&google_cver=1&google_push=AXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbp...

43 B
455 B

196ms
182ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKM39-9CA8FlVEfxSTrp_fA&google_cver=1&google_push=AXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbpAZlmwlqeUkz7dF-XtYH4ETspiHiIMF1l_sKAzajgCN7c&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbpAZlmwlqeUkz7dF-XtYH4ETspiHiIMF1l_sKAzajgCN7c%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7f821b400e8b916b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 217
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKM39-9CA8FlVEfxSTrp_fA&google_cver=1&google_push=AXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbpAZlmwlqeUkz7dF-XtYH4ETspiHiIMF1l_sKAzajgCN7c&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSl4AKyI6th8dP9xtEqZvBISHV3S9BvkYnu8pom6oVm14RcmQnFAdvT8A3YjMGnLiZArGkH-ogCSHUyBPsGkkugxA3pxbpAZlmwlqeUkz7dF-XtYH4ETspiHiIMF1l_sKAzajgCN7c%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7f821b3e6be4916b-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C95F
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESECFS7zfcRqMCl-iq_Z8_1Po&google_cver=1&google_push=AXcoOmS1BX5ES92-NBQR8eXT1Dcu2WlT4Vzjzf7IRz-WM2g_ES6MQUFEdpv4tPni9PMxpVISQJIsDIi6e6EP5swO...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=p6pCLb6CQPKl0uxT2aBzAw2&google_push=AXcoOmS1BX5ES92-NBQR8eXT1Dcu2WlT4Vzjzf7IRz-WM2g_ES6MQUFEdpv4tPni9PMxpVISQJIsDIi6e6EP5swOFYlHOUwis17fkx...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=p6pCLb6CQPKl0uxT2aBzAw2&google_push=AXcoOmS1BX5ES92-NBQR8eXT1Dcu2WlT4Vzjzf7IRz-WM2g_ES6MQUFEdpv4tPni9PMxpVISQJIsDIi6e6EP5swOFYlHOUwis17fkx2988V-16I9_kg7_4AoaTJ_oyNa_LhnFwJ62rP0CWI

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 17 Aug 2023 13:01:33 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=p6pCLb6CQPKl0uxT2aBzAw2&google_push=AXcoOmS1BX5ES92-NBQR8eXT1Dcu2WlT4Vzjzf7IRz-WM2g_ES6MQUFEdpv4tPni9PMxpVISQJIsDIi6e6EP5swOFYlHOUwis17fkx2988V-16I9_kg7_4AoaTJ_oyNa_LhnFwJ62rP0CWI
x-host: tde-deliveryengine-production-6ffbf575ff-w6hdd
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame C95F 43 B
245 B 75ms
16ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEEAgn7ioQD-bMtb0atYablg&google_cver=1&google_push=AXcoOmQe6ybi8fSIAnevY8t7XjYdRLYYRlSxx8ClTzO1YpKaFlo8TEBXoVl_EIyoU638PMb1WVJrz-Yl73zTRl6fVZ6--1R8rFirJKxxmA2FPrgl3wEEZU9OqDS2r93eLiXKeamtoxsKAM4
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C95F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEA2-zcMYLuA0F2WVyf3I-A&google_cver=1&google_push=AXcoOmQg-d_Uuewq_pmln1Nds4ZbwMPyHtKDRQV97txG80Btd4duXrZURBBSY2Wc-7ueRKbJd8h...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVFotMVgtMjFPUQ==&google_push=AXcoOmQg-d_Uuewq_pmln1Nds4ZbwMPyHtKDRQV97txG80Btd4duXrZURBBSY2Wc-7ueRKbJd8hoxTZlytmOxOi8Vh_Ai6UhFccWZ...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVFotMVgtMjFPUQ==&google_push=AXcoOmQg-d_Uuewq_pmln1Nds4ZbwMPyHtKDRQV97txG80Btd4duXrZURBBSY2Wc-7ueRKbJd8hoxTZlytmOxOi8Vh_Ai6UhFccWZI4JUyWiGq13zfByoZiEAcM0uLZBn3SJlcM0Lh7Qi2A

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TExGNjdHVFotMVgtMjFPUQ==&google_push=AXcoOmQg-d_Uuewq_pmln1Nds4ZbwMPyHtKDRQV97txG80Btd4duXrZURBBSY2Wc-7ueRKbJd8hoxTZlytmOxOi8Vh_Ai6UhFccWZI4JUyWiGq13zfByoZiEAcM0uLZBn3SJlcM0Lh7Qi2A
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 5b959e9b7aef6dd90a6fa539ca64ac62
Expires: 0

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame C95F 0
237 B 77ms
29ms Image
text/plain 2600:9000:25e8:4c00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEO2fYS8wpX9H2yVowdjhqIw&google_cver=1&google_push=AXcoOmS_qBTw0oV4zcI7UTtkC0OdtP0fTFxnNW39DsruePkg_iHD16BdaN_vq0Fy3zNwq6IOf_VjBw8hZUTpM7zlxrXTFte50xuvzTfvqQKWO6_rCAhY-97NI8B8ioPctW0e4GL5F9davRg
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25e8:4c00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
cache-control: no-cache, must-revalidate
via: 1.1 af33674114d993e3d216d91a5599afba.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS1-P3
x-amz-cf-id: 3t417YDMbBmd-Tw83m7fkyyC7NPSaWHXkk3VW_GR6NHmQJvzyJIleg==
x-cache: Miss from cloudfront

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame C95F
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESENY9f5sRJlx4LkvdxE1NbwE&google_cver=1&google_push=AXcoOmT1wJNtUGQ0x7C74jTSEDHp4L63Eni-I1EWzeGQjkfCGHkgIoEuh-Jefb6AwG3vq3tKDVDySP7bH2Pz03lfZTtyYxR21sW9pHXV...
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmT1wJNtUGQ0x7C74jTSEDHp4L63Eni-I1EWzeGQjkfC...

43 B
1 KB

39ms
23ms

Image
image/gif

141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmT1wJNtUGQ0x7C74jTSEDHp4L63Eni-I1EWzeGQjkfCGHkgIoEuh-Jefb6AwG3vq3tKDVDySP7bH2Pz03lfZTtyYxR21sW9pHXV4SuYghgqrqMfy7w5ITOfn4VTqW8wyGnfAdZcEPD_

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Thu, 17 Aug 2023 13:01:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Thu, 17 Aug 2023 13:01:33 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmT1wJNtUGQ0x7C74jTSEDHp4L63Eni-I1EWzeGQjkfCGHkgIoEuh-Jefb6AwG3vq3tKDVDySP7bH2Pz03lfZTtyYxR21sW9pHXV4SuYghgqrqMfy7w5ITOfn4VTqW8wyGnfAdZcEPD_
x-download-options: noopen
vary: Accept
content-length: 315
x-xss-protection: 0

GET
H2

200

report
sync.teads.tv/um/ Frame C95F
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESENDB5zTQM7Wl...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmT8EyimGp042vqAdYwwoR8-RCtBjQieZE6pimIijNJWsySdiogz__5ZfmLsDN53NDDkRMnobIxEDT40uGJ6OTMd7Ua4v1f1XZ5Pj0iIylJI2CUgc...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

626ms
625ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

expires: Thu, 17 Aug 2023 13:01:34 GMT
pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C95F 0
12 B 17ms
16ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KwJEoZoyEXI0Tz3opjvYbT4g6u_YFRdWBCC83nThHbTvkMI-gariS1xwRvjHYq3AIXqeUJ0ow

Requested by

Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7A46 43 B
215 B 94ms
92ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=89314df8-b195-460e-2dac-e1f5e6e1999f&tv=%7Bc:lyzHy5,pingTime:-3,time:137,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:41%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:137,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:41,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B132~0%5D,as:%5B132~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3YM+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d1%7C1d2%7C1d3%7C1d4%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1f2%7C1f3%7C1f4%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.990511-61634100%7C1j1%7C1j2%7C1k%7C1l%7C1m1%7C1m2,idMap:1j*,rmeas:1,rend:0,renddet:svg.us,siq:43%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7A46 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=89314df8-b195-460e-2dac-e1f5e6e1999f&tv=%7Bc:lyzHy6,pingTime:-6,time:138,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:138,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:41,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B133~0%5D,as:%5B133~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3YM+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d1%7C1d2%7C1d3%7C1d4%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1f2%7C1f3%7C1f4%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.990511-61634100%7C1j1%7C1j2%7C1k%7C1l%7C1m1%7C1m2,idMap:1j*,rmeas:1,rend:0,renddet:svg.us,siq:43%7D&tpiLookup=ao:asura.nacm.xyz*&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0451 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 passback_160x600.js Show response
static.adsafeprotected.com/ Frame A181 3 KB
2 KB 15ms
14ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_160x600.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 95e9b520e4fa4708a1c77240f74659b7964412a25f37c656cb1cb05cfed6b324

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: 8Lk6nwqXh6k6nfZmyjbOHVq75QkTtjZi
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
date: Wed, 16 Aug 2023 19:12:45 GMT
x-amz-cf-pop: AMS1-P1
age: 64146
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:36 GMT
server: AmazonS3
etag: W/"e27cc778cdbd4fb2ab2c39d090d5c119"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: 2iKFVHJD7QExWom_8sLxpDxxfvz6v_UaenJDPMVMjR_gXXlmEP84EQ==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 15F9 22 KB
8 KB 13ms
8ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 passback_728x90.js Show response
static.adsafeprotected.com/ Frame 0EB2 3 KB
2 KB 18ms
15ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_728x90.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a579343e48deefeeb438bcb7f6aeb6d37e68102a8299ca47b683991f0af26b28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: BMDmVeG18LcgsgmLJH9yXJDgb3k6n4r4
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
date: Mon, 14 Aug 2023 05:50:59 GMT
x-amz-cf-pop: AMS1-P1
age: 285035
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:52 GMT
server: AmazonS3
etag: W/"696b4c19d35efd706805137a8a4b3831"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: dLooXojjV8fXfDqIMYZo72b4k9IyACS3ZuOY8_VVtLP8o1-B4wdNrg==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 344B 22 KB
8 KB 11ms
8ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32633
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Aug 2023 03:57:40 GMT
expires: Fri, 16 Aug 2024 03:57:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html
s0.2mdn.net/sadbundle/8545329873006492075/ Frame F3A9 142 KB
0 13ms
8ms Document
text/html 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 139642
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22810
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 15 Aug 2023 22:14:11 GMT
expires: Wed, 14 Aug 2024 22:14:11 GMT
last-modified: Wed, 09 Feb 2022 10:36:00 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7A46 0
0 74ms
72ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstElxeTHSNnZPpe75b2oFnomfYB-FsQo819hvfah6xf7Mt0BoFarSgvaRVz9wsaN5CnRW2xPuS_UNdd8ZIlqmIUzmIgH9M_3L8T7wmDxY-y3BDA0AO9pElnxqckomVScntW9j38-CkSDEc_o8QffWnZL9JGPuyNCu__fHRhXPWIbAy9YGM3M9IRpVIQxot6Wx-72e26x59zB5v80f-J6Sw-sN-fN_YTh3HkbOHW-k7L5CfU_jyXC64zx26lEZlwoJ4aIu-LXZG4fSVeP1G4LjA9DwA-xuMb6U9_pxk0QVxSoZc7qG_vPg6VeNKEY0-ZmcVrgKBOrllRu0nQk7kDcmT5AHLo4w2oZH3G-ZmeuO4A6WR3jgEwWaqQR0TGDJdyf1uK0noEmvx_vz79t-9uoVDZTuoDPvlQn-4q70R8MD9J19LRrSb2l8aki6BXEPZnxnqZW7AoEHQXBJl11vn1cAioAiv_eVC4aJN5hvoKtydDA_Z_FQGo3z1jUmw74dqNuy5wuuXMpWFNGiNxX6xm9PtScHKZzCcG8f-4nQmPf80W1aVj3G-St1nOXcEzMJdvfTinqRz_b0VzpyX7iG7CO0nzv42_F2LO_x8mezFw7JvMc8O6QjsMLEE9Cigw828jPaZ9hUzc4PG55sAwQ_Sgen2jIdKiHBKyqp-koAAx2Xe-fzVvxUZdwOU1An7bcoWJozQ1tfmlmYLQoIk1ErJVt4VSvC6LNBkTBofCedJII4oBp9wiaYw3DRBfdQqhjIlnKHhECFM9tSDcXeg_q8Fp3ESLP-nMEAPbiYbIKkzaRJL91C8Y-Ui6bwr6qnLImDX6fTVtvQpF9aWfXF83hMzPmL7OgandtMXMcnYfuVXajFrVrL_fGFwoXrvoLKeLKFrZCjH2zZcJ2WVqNzLwsBIUoow7egD4LnUL8vwoH0uznuGL011AhQZp1i5hhbIR22pIofZX06WJrRMyXZvPy83qoHQ_6Y5z2TkNmfZxZ4ZOsuG5x5fWWezbrmTmpNr_wZ1DL6yilroawikBpjttYIZsjQs6EiIvte3OqX0a6MEghek4Iefyjnq9EP7bLDYgm6nC03Q_d6TL2dMwSfO9Sk5Vij6POmeY62XYuii3lO3uA5NJOCIatwytkF5SuC2Kd2FDwiLdqqyy33ju1HGXsnFYXVDXLh5p6R7RzSDbUjTf26T3fVqK5D_pMAQKN4DUJHZlJnZCl9Vtz3oECbUnQz51sumZMVqC-MBPp8mUCGm5NPJheCSVe3_gVxbYTHrxuhjuqTycBCnFoNZ51-sXcIu9e8hS7GpqRWI7ci3V&sai=AMfl-YRTiV85_xzgAJl8wR9tMFk5KnHGKfETsJuN6xIAabbTwgxgroOWoMDmf3h1QBETROHw017pglZEzQpWFQRLVrQMCKUn3lQ7D4875LLCfcCxsmlCgXPSfAahNyhynMUjvDXf4rJx3yqqs80wz6vqRMJP7-C0eSkperdXK1altkReppl18F9hi8a_NZNiH4vtB0uBH79bgIvw-nRoAaCxsdGy2dFO3Ubv25StqlmdZYoe53LPYfo1pK9yePiswt8sJS5EsCPX8km4tTEoDla2Of0vfz4zZxkr6GUhS8mg8DEGbZuK0jgDMwt-H-Nl&sig=Cg0ArKJSzNT1l_EgaM6EEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1174&cbvp=1&cstd=1173&cisv=r20230815.16753&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H2 200 64d34559e4b0f534035966cc
ng2.virgul.com/tck/imp/ 0
212 B 45ms
41ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/64d34559e4b0f534035966cc?g=1&t=gb&r=158659@site_geneli@asura_gg:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1&info=&mt=1692277290670&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:33 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7A46 43 B
215 B 95ms
92ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=89314df8-b195-460e-2dac-e1f5e6e1999f&tv=%7Bc:lyzHyK,pingTime:-2,time:178,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1814,beZ:1815,mfA:1817,cmA:1818,inA:1818,inZ:1822,prA:1822,prZ:1851,si:1856,poA:1857,poZ:1880,cmZ:1880,mfZ:1880,loA:1952,loZ:1954,ltA:1991,ltZ:1992%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:41%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:178,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:41,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B173~0%5D,as:%5B173~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tNcb3Ep+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d.990511-61634096%7C1d1%7C1d2%7C1d3%7C1d4%7C1e.990511-61634098%7C1e1%7C1e2%7C1e3%7C1e4%7C1f1%7C1f2%7C1f3%7C1f4%7C1g1%7C1g2%7C1g3%7C1g4%7C1h1%7C1h2%7C1h3%7C1i1%7C1i2%7C1i3%7C1j*.990511-61634100%7C1j1%7C1j2%7C1k%7C1l%7C1m1%7C1m2,idMap:1j*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:svg.us,siq:43,sinceFw:134,readyFired:true%7D&br=c
Requested by: Host: dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com
URL: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:33 GMT
server: nginx
x-server-name: dt19.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame F484 37 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143189
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 76F4 37 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143189
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C823 0
0 49ms
48ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvT23qfWc0CGqiZkdvCHR5zEwyo46WCOS0zp7U_7SUIs0bzyYkNBBMA1u2xrmAPt9aV2a--eqMJ52ySFwvUbajAJAAQMMYgVo0Vqk2yjGwcNn90EUPjBoVIb4uXFUNSl-KbeAwTfQTvF3UTYwc9sLwm6hZloo2o6toJrXTyUTgv8gJrT9_5PRFUSGl-V2ao2uUv9xvb-HeaeuThPXJgIb1TRd1Irqp7N7YIZnY_v95-JqTC1eDx5XP5RmBnKZiFIGorargjspsDBMfSME7DLVBdQTwyMMwikhHZF_AE7Xn9Lm1vPD_6x1PxqXQP6ikKUYsP86K5FWQgMNPK26BQqvxLGb27dK0GEOJzxv9G88A4I-OIkgiiGwfQIeosygfOuwkcaxbep6y-JAGqFCnVfbf3B0Qeklck32wOGVpVTivIBc2Td0uYRWr2Fpi4bGQfNdK2-mm6KiL6jZTdI9rvAXR75p2243-ErTRaXsRvdbhHUG1JFV99anecGh7xRdbd7vNAuZApt22gbeu3M35ZShjRirmchGeniq-qGj5kWU0mrpFOGJVpRC_sJA10ql0Q2CG3RA4Kk5Bm7pT2cKO4ovcr8YxkjecrkJri5X-wJtHYsOG022zXvMwIUxQOTahFHbGwboktpBxtwxtzLkBXvUusVdaHvw1faCuvct_4XfFrdfBByDJ8ydBb1glES-cMuvckdqOGWQd8UZqCgJhmlBnk9pq9FEQaAoqt7FugVAGcoacjSWHKXSjpU6Tb0smjRebvQBiR5tg9baOUS8ZmSmq-Vtrxr_WotqGw8JN6uvXhBc42jkSPKWqxzknadggDLoBhZbITQt14B08TJcSr6BKhsdCfQJdivoMndRkBX6qfQ7ctn_yGOXSxJ7_cXbf3spnD2rv6fZ_Jg9SxFUix76Lso-tSw8NdItKEPYjM9pqrm72tFq1t_g6mrj20iiB1M3lNuOPfHRwMjLCV_Kk3L4fUtZ-sLXDxj7e9zgXd5BYcLSyFwMKLf-knCk8H2AL7WwnEqNYxuh04TlQ70MaNZLVBwHwv89-4cQKex4wd0UuLFsMOJLhx_P_egq4jYVqpnM0Yh04Z1hpx23PXoKdt8gRVkvbUzn8xx6RSzzX1ywf2401fXCebgUBkacLwm89hA9RmVLUmdwbGM4bHAM6xMxBiF4MPHjXpgv8jfg7Z18Tv8go3ydg7BRMo3ibTY7SAK7tnwW357TK8BA38zypk5f1R7Nkc9J7uY5ED84jSPNiGIQFJkFxxli4llcTO8fPqJiaIj3wW1rwiwapeTBNDS5r7ISrHeQ&sai=AMfl-YTliQ-8sfMGqwNLsq5CJ-2YotayRC_N-hb9APlQK5FE5LKuvTWnwm-7ZhXHdM-78zAz6atOsORyPfJOgVhTo3ofw-1P1h70qPypR5CduU-KSAdi0En7yNvP7J2KthVGH5mz0zN5xrXFCdNccjVfiFttN4IND6-qny_6v2z3rTGhY9VteL1gpdvLpWGVkDz1JXLYHBYJGATGR7PIS2WTmIab_U9PqQyzKiON_4hLUss_1D91IwK_lcU_G1bGkehZC5SYEsk9ifm79VUmp1hoo5VTFmPq9DjAysPRRITIRy45A0O15zzRlunv5xXy&sig=Cg0ArKJSzBEDROZmdGcsEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1710&vt=11&dtpt=554&dett=3&cstd=1146&cisv=r20230815.22653&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:33 GMT

GET
H3 200 opt300x250_smartside.png
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 63 KB
63 KB 9ms
8ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/opt300x250_smartside.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3862bdb51715ef753153ee06685e9597e4ba02abec0eee1f3cb4d611988fc507

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 11:44:18 GMT
x-content-type-options: nosniff
age: 177435
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64264
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Aug 2024 11:44:18 GMT

GET
H3 200 arrow_black.svg
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 952 B
444 B 11ms
11ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/arrow_black.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6c3c5ac5900e2fdeeea6e3c9514871617b72608b224e33f329b0b4d8e91a85f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:00:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28877
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 407
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Aug 2024 05:00:16 GMT

GET
H3 200 opt3970x250_smartdiagonal.png
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 65 KB
65 KB 12ms
12ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/opt3970x250_smartdiagonal.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

638f18818febfb2e0656e0406b8bad534783e027f966e3ff7a6f0b96341ee20f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 06:00:10 GMT
x-content-type-options: nosniff
age: 457283
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66948
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 06:00:10 GMT

GET
H3 200 info_icon_white%202-1.svg
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 980 B
464 B 11ms
10ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/info_icon_white%202-1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c1cc18e5ab1c34b765f92fe67cc7c73d6f9acf45bc798482d7c32ad0be21696

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 06:44:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 427
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Aug 2024 06:44:13 GMT

GET
H2 200 IAS_PassbackAds_160x600.png
static.adsafeprotected.com/ Frame A181 16 KB
17 KB 14ms
14ms Image
image/png 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_160x600.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 13340dfc25a96d245772fb41c7aa01c32723b80d8dd8240864b747610d2ff745

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sun, 13 Aug 2023 05:19:12 GMT
x-amz-version-id: Ax9g4_p37qT.TuZCPzwZssuxM41dY1J7
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 373342
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 16777
last-modified: Fri, 18 Feb 2022 23:28:48 GMT
server: AmazonS3
etag: "eef84d4a7321b73260b41707db98756f"
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: ppNvKTBZZGc-fpPxXHftThTQtqUiZk0w_zwLGPpfGqvAwuOmAQvQog==

GET
H3 200 DcmEnabler_01_247.js
s0.2mdn.net/879366/ Frame F3A9 29 KB
0 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8545329873006492075/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 05:02:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28717
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 05:02:56 GMT

GET
H2 200 IAS_PassbackAds_728x90.png
static.adsafeprotected.com/ Frame 0EB2 10 KB
10 KB 14ms
14ms Image
image/png 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_728x90.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 319ebf743ce2c07c6bfafd9600a93824aa52b0844fe94e81c014e169564dc7e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: 4DcA1UddzZ2E21bAiUECQTp8M854Vxlu
date: Sun, 13 Aug 2023 04:15:11 GMT
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 377183
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 10216
last-modified: Fri, 18 Feb 2022 23:29:13 GMT
server: AmazonS3
etag: "b1464a7201f691a1e4cf6fc057919d7f"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: Va-VR1-rbOf9Sa8F25mmmme5bphfrlWOdTX3otFHdOjGjbMSSMH32A==

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 5EBE 7 KB
5 KB 52ms
52ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9e22e607ad7dc3b2fb63d23f54f541e910e09b447b9215977a87286047980692

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5603
x-xss-protection: 0

GET
H3 200 06232023-053002206-background_quadratisch.png
s0.2mdn.net/4528404/ Frame 5EBE 28 KB
28 KB 10ms
9ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/06232023-053002206-background_quadratisch.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4338b399e437bda69b997b7de46a7869b9244a1f7cebc91ddaf57329c41e7ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 06:34:41 GMT
x-content-type-options: nosniff
age: 23212
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28774
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 06:34:41 GMT

GET
H3 200 annick_sitzend.png
s0.2mdn.net/4528404/ Frame 5EBE 2 MB
2 MB 15ms
14ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/annick_sitzend.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7327225cdf3eb28cd7f8ed4ab98de9d079fe2f007c3d73fd58dc4c757cf6b4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:18:09 GMT
x-content-type-options: nosniff
age: 31404
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2539328
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:18:09 GMT

GET
H3 200 congstar-stoerer_gb-plus_full.svg
s0.2mdn.net/4528404/1687525202405/ Frame 5EBE 4 KB
2 KB 16ms
15ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202405/congstar-stoerer_gb-plus_full.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd5e51e4be28957472ed34851536685ff162bb43dec37c9a7be46de1c1b72ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 15:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1929
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 15:55:14 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame 5EBE 5 KB
2 KB 16ms
15ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 14:13:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82100
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 14:13:13 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame 5EBE 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 14:43:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80281
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 14:43:32 GMT

GET
H3 200 congstar-stoerer_gb-plus_small.svg
s0.2mdn.net/4528404/1687525202075/ Frame 5EBE 2 KB
1008 B 12ms
12ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202075/congstar-stoerer_gb-plus_small.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

644aace6e359180bf6b29b4a7b172f7b6cb8c937fa531eed22a6447fab6a2c8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 15:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 974
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 15:55:14 GMT

GET
H3 200 logo-d0d80991.svg
s0.2mdn.net/sadbundle/15874828848628604197/ Frame 5EBE 5 KB
2 KB 13ms
13ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15874828848628604197/logo-d0d80991.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 15:26:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 509725
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Mon, 10 Jul 2023 11:52:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 10 Aug 2024 15:26:08 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7552 0
0 51ms
50ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsseIuRIVdARpBk4ljKU_UVt9-hgoEIZaVB3vHGIyr33xYAyw0_hy9C9Cr0miQO8QwqEyv-7JS3LN2hTPJTKbRxh3NFmjXDM2ooF4vtOe5mQl1ecn1Zi147p5Pk17U57Xuh4W-sFsAfAzE8sb4p1155cWpiD5ca2TkQdLQP4TADdxNhijvEz1aKIik-OUO7b4D9O6XCZBHe2mSBBxq61iiRY6IuORLw1xDXxEZIZowavPp7ErSsIoTDhhI2uINAByN3rXJvwDaZLvCJacJrNeiFKN4O6quDGKMv_LYPl2d_JI7Kz105uhReSSYs5qXE9SFHqnPt_e9k7enINCjLYeI9rOnani3ynewjOmaFwYjxlOmOAUEtWmN9URiYsPw6ioyVlcQgKkVEbLaT07YsHgF-Rm6AKQRpnZGoXTDglDlo87IvKwSN-2wwgeGhhcnCeG5HeYDdUaPKwqiSUO5N5lhY9EIYraJPtFbWSzueIeYcCs95501268gM4qsirH0ddhbdSgyB8rTlPHvn1fkfl2xCD1vf6I84GjMEDLjerly_d8OBYjebjgdwZB7ZziR-V5VBdO3t673FnUh-HqWKkE87i4hlJNBM1yavbDUfSHlLRdJOvLMwIZ6PIutItrGGqivc5DeiXW4N_bvOfLeSt2rTMaUhKDxAPNANI68Kym2lqwxahTF2hruqdtRL5e4_AfTCQHYwM16MMZ7IEG50PA2Mk00m9KblmUe9Y4AHsOFGbgfhnXfrBrOVOJoBqD4qvfF9aVP3-BvKIBbct7Dgiz5bVsimVvw-EX7U7c7wWFI6fwpnwn_HTlJkpM8fIes_VyZG807R0x6yaAgzCQrVxGEUFqpcfg4hYj-AKtcyJCTT5ZnKNkbZtVoIeTjqwKbVLSFUMM0nwfczW8XDhHD8AX3oEn6yX68e448lSn8kC0e-CAUYhvzD_x1AI_VCKsPgVoUjkAwO7AfcwKZgPgGBeHXY-X1uwLFJ00olqRSOkDs55gqRNJGw-EsM35oWs7If2wyex6dbuBz0hMVGLovIY2058zVih9tdpTYo-vtTRAMK_r9EnZIBgLxxOtYO9NGOTk_QlnMGa-Diuzgm7NzldVcs16sq6Luy1I-4_3lsZxRRT9mMEgN37fjGluhZxN5nO6yMRx9Njo45N4GILsYFPnDmsmsrONTxfUUasolDP6pGRBJjUoPniLhdUnOrhrOl670PduPkpOc3aNTNuOwroVP8tL2Sv949Q_ia4xm4mq2NCOCyWQgV1bMw_WQNxGlZbriJUiBqxcglmMfGPL1qhsrQ3-yo-iTtAUQZMdslY528eoRWDSS__75RHH7WtFg&sai=AMfl-YTNmY21Iskm2BdZPBppg1hCC2mhBq7xgMbQxXvxyOXmglQ_Wx1EEw_OBeD7b5XslBycg4draTAj6YuRwJVMh88Omf8Yunb9crtBPp5LQkhLTHmWXKDNC9UyYizOxwkdQ0qUhj8lcJlZHw6oAedrVH_w-nL6GGh0nv9Tdh1UeXrzSHXYo-m9MajrhzjmhrDIAfT9NhIc5Bpit8H3rBLggmF6VOaLItBuFvRjPkh4J8Z23ezsS1HxuLp5ChWjMlgNcZJLVVeoREV527MAsomsguLiGzISO_rqFvn3yOUu0L3_MOkMfy1v7vX9GpRL&sig=Cg0ArKJSzNYPVGBau-cNEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1481&vt=11&dtpt=400&dett=3&cstd=1069&cisv=r20230815.29346&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:34 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7A46 0
26 B 53ms
53ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstcQUEaODaHUCvAFEgGMHQxQoQli3MLb8BhMip3d3QbZ10JVmBxZquHnWkJsbDvuT6FNxR4b107DcO0NV2SLdLTmwi6fNSUumkdtNrO4BnudJV40J1T2jHkfkQ85dBjAmMD_XZ1hJZ5QZgzQUK8wCQScgDcGONqDiP3kvFgDks&sai=AMfl-YQ6J2mCl9MWuwe_v6mvjMUy39WK1_RED2nUCmBImuaXDqva3umOcEJEX9aI-BUQXugjbwkecuBkXPFtRkTiKhNvQGNoe5JOovlcOMsOQ9_BE0f82UXxVpzCUub4JZXAJgxPqXTHMFCTrzgc1r5xLw&sig=Cg0ArKJSzJI5NlfsG61AEAE&uach_m=[UACH]&urlfix=1&vt=13&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 opt300x250_smartfront.png
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 42 KB
42 KB 16ms
15ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/opt300x250_smartfront.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30e7f54a4cd98fbcffa6fe5ac3f5136209ebb362e91e4e6828e1b67171440035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 07:28:18 GMT
x-content-type-options: nosniff
age: 451996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43281
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 07:28:18 GMT

GET
H3 200 opt300x250_smartside.png
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 63 KB
63 KB 14ms
13ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/opt300x250_smartside.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3862bdb51715ef753153ee06685e9597e4ba02abec0eee1f3cb4d611988fc507

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 04:43:08 GMT
x-content-type-options: nosniff
age: 461906
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64264
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 04:43:08 GMT

GET
H3 200 arrow_black.svg
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 952 B
445 B 18ms
17ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/arrow_black.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6c3c5ac5900e2fdeeea6e3c9514871617b72608b224e33f329b0b4d8e91a85f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 12:39:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1347
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 407
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Aug 2024 12:39:07 GMT

GET
H3 200 info_icon_white%202-1.svg
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 980 B
465 B 17ms
17ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/info_icon_white%202-1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c1cc18e5ab1c34b765f92fe67cc7c73d6f9acf45bc798482d7c32ad0be21696

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:56:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 183892
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 427
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Aug 2024 09:56:42 GMT

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 0451 37 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H3 200 FORsmartNext-Bold.woff2
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 37 KB
38 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/FORsmartNext-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54b4cb2efd8678526f8d043ea95d86f9231e2e2f98452d8f50e0eb111c0731e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 12:33:03 GMT
x-content-type-options: nosniff
age: 433711
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38364
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 12:33:03 GMT

GET
H3 200 FORsmartSans-Regular.woff2
s0.2mdn.net/sadbundle/17935346092343648567/ Frame CE06 25 KB
25 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17935346092343648567/FORsmartSans-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dab71602cde92e74163199fe6c7bba70b3c7810ad8453130968c729844b0824c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17935346092343648567/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:58:05 GMT
x-content-type-options: nosniff
age: 183809
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25336
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 10:05:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 14 Aug 2024 09:58:05 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FB16 0
0 48ms
47ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuhr8y0i52kxcKoS4JJwelfDJNncJviws1Hap_DidZOc2X1AUQTeozG2goPWUCDIrJMOAAtHdvpw6LlF37swVaG7Vr1sJRhyfJfXRPuUlEwRtx9tnFY91XXmQNnt-ozorJKSdA2yDuuOXsqn9LGIK74VIr5eFsTDmZfvVr_JAA1nX6xcvxcRhHawU4CZKLF_M3cicqNPEoNWlrqL3EqxRzhsjHwyA0LWgQgxFWfQIvr7iq8T87QnhvrAlprZlWAhkz7MrehxvmxSEpWvQhkFBCtMeoVByST3344Ts-rbF1J1FxYsDckt5P8fqQnlt3X3dQ4xA6Oot5QpI8ytVXZklaHpKRwDyYnv4-kRB0xj4A6pi6QoOyUUjZIoyGpF5RycfPFZ3PlGza9orTeuaYXCvBMRT87O8oF6iI4pqA42LrCvXQHtUUKurAyBTMhLnYzwp6yji_L63m58haA5Pw3kOywkAJAbztkNm3HMRJ5D4AZ6xJmLr7DvrIkjZ_SNxrZzfPrioct5g7sGUPMeyjRwnkDNKuY7Twv29OWfhAwcI6Qb0MsM6Ta-wMbdJymG5vuYNcBm70KQAifhGv2FDYtLw1PqFu2CGdp--pgTc6P_YKAI1cw5tT1o-wmi0KiuctYke24PDt6JTk-mzDgZMNvcu1-pyJmeAUiecM8gRI5N-8Al_qJ7CrSykfuVNAHkjER1C9ByWxWpTdRd_n-4zwaPw3_8r1HevdD5RY-2PeRYlCbydb1caJo_qwCRFTAG9CZfgBZZ1s7p_y8hX1lIV58r6t_1fexHJ9ciKNkD6tl95VJlml0gwg9bv-Q4P1vXii1jWZ4ujTHVTBNob4dJvohPQBO0GzTdrAWFp9HOEh4tWV4gHhSL2UTvJo7Rxajwz5Lr87hdqQSVF2zxhqOr72ui9JbaLzIUx2S-Vf-rqKHMEC2w2PLXn8J-h7Eb1oKXlmlYNc5H7LQDiSA_406belAcEk3WU4A0s0SubCuHIsr0768amaGIskWd5_ccqCX0HYrk5Oa-tTaHYQHcp18mG8A03i2XktGjn5XmJ7lFiS55eQrwBKMkSZgYm1bGqY4SCPXouNLgrNXORHHcJF7z4J9dGVNnbSRigsQxuYBIa_KTpT98MAs2GamDFbHH7YVQBQ3OEyzyZUbUZbtSHguZWxY7R2C8JHbachAJyljPYdtkjnDSrYBG6giMu5F8XkY9TtB3LlTAATWiWmqRE743wulWz8EhJY0ne7qJ3pD-L0bNDSVJuAzpod4fxx6TK9sjth1aUYt2DWuKw&sai=AMfl-YRAMXQnAcKU6oG_qBdEE9SjclBzxeniPJw3U6uJeOqrythgrif5Aq6o0NgdyPt0vJWOjFWcXTa8U2Uht2NdDx22OBm2p4UH2HHNwG9eTYXHtTtLAuMUMxjygdgsUQfa878Wu1kFL8nmng0qCAX_qoZCwkQJYjjn3crCehPNIuIonhCgmj5yRi2shT90nt5oYgqy_9hgjqP017vxdE8f5ZSa2rsVIrUn-pcMUtmNk9iH9GOZNoqONUazQ1Na7GU9-r1W-p8Hq-n3v9MWjRjDVdJjpZeDKa_VZeDAjeO22Ju7SLOonGtcMSg6L_ncsGbT1OfvyKIWZ2ng8-lD7WF_NeRtNo9WPg&sig=Cg0ArKJSzLEk_6l-snUTEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2067&vt=11&dtpt=1550&dett=4&cstd=515&cisv=r20230815.96657&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:34 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FB16 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=990511&asId=c6e1b6bd-775d-2585-bdd6-d242562229b3&tv=%7Bc:lyzHD0,pingTime:-10,time:1705,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE2LjAuNTg0NS45NiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1692277294086%7C%7C1f2a483a9d5be644ae904dbceb13ca44%7C%7Ccb248b5d7f94b197f4c81a7a58714f7d%7C%7C96d877ac05ab63de5c938d7fb4919c69%7C%7C49e8a72c4f0791f4da5e07074ff8392e%7C%7C80c42e1a53eeca42457e258e102628ca%7C%7C94bda182a00028eafe6c9e3b25a21aa2%7C%7C9d72d9c659b56c63ae3ff8a898469c7f%7C%7C1663701684,im:%7Bpci:%7Btdr:1646%7D%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:b84e:36fe:3ec:c6af Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 15F9 37 KB
14 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H2 200 passback_300x250.js Show response
static.adsafeprotected.com/ Frame A507 3 KB
2 KB 13ms
13ms Script
application/javascript 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_300x250.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6005e56ab3043d83726d25b0d17458e35b72355a81ca3230cc9de9058ee8b1f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 14:24:44 GMT
x-amz-version-id: vr1Fa3eAVtG7AGe6kPa1Y0WAZAHvQkII
content-encoding: gzip
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 254210
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:42 GMT
server: AmazonS3
etag: W/"44f0ac540dc9c11f94344414c879b658"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: qLOGkfpVy_yeHMvY3HeWCV-s7H7xxsopXeJcPOxhTEbpiEY9Sr-fkg==

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 5EBE 17 KB
6 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 17 Aug 2023 13:01:34 GMT

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 344B 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2611 0
0 49ms
49ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstSK5E8Qnq2oBgsTqyqMb1gJvJdGlF9kgONdZJov9QY9xtOZWww4g80o32ZmTc5a8pZyJg8zknYv7JWd-IgQrIcE5Eueu0_q67tmszwRnPknpjJ-DglyL9WfojDlJyYwLTOVd_5rN7DAcAvDQfxKiWHphJYymkjt9oUaz9IXStTd2TJitDkcEG8aynYsSYK3aM6163TUtP-WcpDtzQUVmaosK0gLhBkznIwbxVusWjb7teAtkeBHDP2V19kFJ0OnRWgNqdu-LuvSfIsahmtxVQlYz9msOEqgckEs8YmTSmWTXvzP_LmQGeWaCdz5txMWo03DCkbKxSmVVgkhuRda9O62XsUuIYbg8zpZ8YDFJZQkDb63O6eU4Og55jxD18JLic0kwlVPvlmhDo2gqe8qI4R95zrRytY7fDAEz5vsSfyogEFpPa7xYwlgbvdJgpz2js9iHFFmH_8Sx4ZqtKJVCo0QqAMzxhJz0U5wxgbimaMToVlOC6kAiZKxwv6noB3zC9AbjTBmx7FbUo3WVh1V4znrSC1VwHP9Vha0TRjHY88pRONus5caaCzynvLfx_sWY1Cj55P6tF4t0wapH6S4CgyaXyF98tpvFLeMtXvk_jGe9ta4xsN1qVGyDObt8HblUbIxS0iGwVVAMzW3C4zp_4eRN6Mi4tkb4JJcuNXMi86XjfNeW9vWUTDtAJM883iDmg8fnynJ1bmd2zhQNfigHqxSUAa15TE9Of_b1ZQ4QcJGkCtdGHCLVboeA7yuQ6haShnyKscPLS318ak6EuXehtnKI7pJphadQDoWAfyh0mwYrszwNESAiF8mmZTnJa3UeEN4WLht0QWgWCoKz8miGF95FHA2WpIo2OTOFUK4Rg2ymqtYLhvuEFClmbNuKn0TzspTy-jmgzBTr_sWKSbZw0R3cW_qQ-sk9zVwHrIMQeHVHo7-qNDWPwrWkO3l3_-w1ELCt0wHoyd3-c6IHEEzkTzweRD3n7bA8AkCW_m3Q-ZfVQKRjZbxEmBHZOZzd_wXgfpTuvi5aSTStCpYeLpBCE6vOrR1v7qlfSxfBEC3bZ6NZ1dR9RDhPZHfk1fAl5oX2GgcoSh7FQvGCGufFMDc42clGO7CD_uTlpYjsy82WY8nia-YHT-U4lktjwVTOBwfdZDnawA30FAPROMF2nOYjYx_wSCRJ--lGyfkRr_2bDH4zRe5cidU2KnChQokk9vhIBkjU9CosY40Sq9uy__1LthZWwCTJGYHKzJIBmodR29QTK8c7V1HAC3IM7fevqIcRAUpuUPMXcX3pBQdq1f&sai=AMfl-YSdwSh-9kT9NjPWObLsfOFhypgLffZKnOW-1Y0WmZM8uDmyw_B7PW8D67QqqAVEW4El1Tik61twoAF3M1JMY--mXNpxNkOL-02V_oI38mdNZ4q68bAdU6O6xtmXF8VLGe_V7MPcPZpUsV2fQcNM5hKoRz0p8EgHdAjJu-cAwCRnsmQSesIegY0qFfBcEuIqdIK_CwrHCYz2YUkt3w3ETLkhCd4QdcaYBMGK-BtTUgovcJAqwS5bX1aTljBqetpOYEwORw5WP5tQBb0tM_NttJKbDsCzFA6BLDRMlHSu-cgeRtLZumw8A3J-F1NZXiPh7x4NidoBC3is8pNEmQJr_cseI5yy4Q&sig=Cg0ArKJSzCnu_St62fsGEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2192&vt=11&dtpt=1788&dett=4&cstd=400&cisv=r20230815.46139&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:34 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DAAE 0
0 76ms
76ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvVyAZQA5enlbzwXHv_84AjzrAvXz-JVPx1I-3vS2-4fQe0fJf-789LIPmiTU0VbmKm-JNah-6nYbTYxn0XeU5kttllvIuY8L1fKIYX2mn3kJHz-8C8duKDdvIpz3GB8x784w06d1fsW9Vs4WeOZ1Csmo7Ex2M5JUJi7xjOxfVGEY-b9VwIctFcZkweku4D4vnlmibcMnnD8f-avaZBszrQgXFIDgHoSu-eiQaeDEIqcd8kq4WMd7l9qQ6Z_5y8UkY1e27YwiBmG5sy-GLf9GXl598Qy6Pawg549_-4TQzJnzh4pvcRjqEsiA_3et4qZ5Cm7HIc7QrERaO6l1tgcQu4SvgtHnBB4ZP9d86ZZFcbcRSXTYQxMiyRbOZ4WXj8ly770ms5wOR1J5b9Pv0F-N7B1RuGG5XBGL_YgwP0j_d1EQAy2fTXuJtn8kqFQFnTJ28siwVYibSF2NkxeWNXuDOHjedAL-6abZRMT4PeDchEi4xERDpBJvslV7XTijvr-ZKkUjIt9ZEm1vc08pAKVoq0lfvfQpBnDSo1gX6K9jCHRIZ8T6LVOoLzKt73LH8dA2Hj0jcge8cshV310eOuTNNHaJukxaILfu_-3p1YkukW-8HNcNKSLEnRkhtfYI9WxV6Z7-sEL45CCS2_dW9RJZ63mcOfLp1Hz-0qfi4VxCIQYmz1jgUTvEkAefPHqRWq_rp-0ba3EEmhyRzOJNSg-kY9IFOv68iPKusK0gLwHnk5mwQKOtpvSmStMQwSsqCbZFddmw6jp69x523P9yfQ2ZpUOlLg88MVydb1ttejXw6xmbVByPKj2oipcnfcQuJedKQth2l3LuneOqdkSU5_hE0vkMJCmQBaR__JcQoDAM3HjWt4nmZ_U19NtKLKS7TyGCits0JRHaRTW5qyxGVr9XxuTwUR_3UFe_t-qOY7AJd1vi1B75HTT_kVZ8wuqPu-2hMaJsR2fAFXCdnwdPnadrRB6_Tm7_s75jrJFJ0oY_lA0uYfIvGQZ48RCZyLOIdfhA_iCkIKu5dhEMhydg6LABaudwTy2JWkwOlCRzsXJ6fn_VY0kSMhqILhTQYQIF_o1mh-Z3R038v7WYQ11F6KtS6EkI_he2yLK3jFSkY1hQHRD4WvCeBEP2dAMj6TJq4bVLxz708FgNtSb-6g5fdEZqQVPdVm_Qdgv-dvtyvyBMN0BggA8Fn5eaSD8aFJTjVgipWv2zIxKbBCGDCSaCmo9hEVrqa17bCjCNnGbj-IDUevIHVJcpMZmJFQ&sai=AMfl-YT58EDxO_HqB6sBs88YXy-veqA8QR5jlFjMm4-YQr4OhKJ0lSCdaXSVZXYCWba3za48Ke6zjyQIc0yIfX8dhmDg440MFnS8hwMF5D0BCvSHJiXYHlr8OLsMdB0sSqdi7dhMLZEto-QPjPMRVEoTFkfikpCD4nlMDfqcVO7wozSk77sPqbzQN6MxpEcivH7ZUkfJc9JxB_2k5_VjF91XiOEvRsFN09XVFYb9HVJR6CgeIiGqee_ZCVexxoM8BHmolVGHrddd9uUqW-ygO2gPmWEE0fSfZJMFSQ8BllUk37x_tkX9jJhqKlege254&sig=Cg0ArKJSzI1wj2d_en2HEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1965&vt=11&dtpt=771&dett=3&cstd=1192&cisv=r20230815.85325&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:34 GMT

GET
H2 200 64d34b57e4b0f53403597f52
ng.virgul.com/tck/i_vb2/ 0
212 B 44ms
43ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/64d34b57e4b0f53403597f52?l=&r=158661@site_geneli@asura_gg:site_geneli&cs=1692277294172&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:34 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 64de041ae4b0c680301de150
ng.virgul.com/tck/i_vb2/ 0
212 B 43ms
43ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/64de041ae4b0c680301de150?l=&r=158681@site_geneli@asura_gg:site_geneli&cs=1692277294172&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:34 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 64c8fd65e4b0833d96e5f865
ng.virgul.com/tck/i_vb2/ 0
212 B 44ms
44ms Image
text/plain 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/64c8fd65e4b0833d96e5f865?l=&r=158640@site_geneli@asura_gg:site_geneli&cs=1692277294172&userId=vnet391e7226-65d8-4598-874d-43f080f02c8a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: https://asura.nacm.xyz
date: Thu, 17 Aug 2023 13:01:34 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 FORsmartNext-Bold.woff2
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 37 KB
38 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/FORsmartNext-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54b4cb2efd8678526f8d043ea95d86f9231e2e2f98452d8f50e0eb111c0731e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 12 Aug 2023 06:00:04 GMT
x-content-type-options: nosniff
age: 457290
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38364
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 11 Aug 2024 06:00:04 GMT

GET
H3 200 FORsmartSans-Regular.woff2
s0.2mdn.net/sadbundle/1884079031435570523/ Frame 8E19 25 KB
25 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1884079031435570523/FORsmartSans-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dab71602cde92e74163199fe6c7bba70b3c7810ad8453130968c729844b0824c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1884079031435570523/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 10 Aug 2023 21:38:51 GMT
x-content-type-options: nosniff
age: 573763
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25336
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 07:49:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 09 Aug 2024 21:38:51 GMT

GET
H2 200 IAS_PassbackAds_300x250.png
static.adsafeprotected.com/ Frame A507 14 KB
14 KB 13ms
13ms Image
image/png 2600:9000:238d:fe00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_300x250.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:238d:fe00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f6adb794eda0e31a163ed517d8e63d388dbb762031a189349c72af2bc37bb4f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-amz-version-id: 5gVOAFoF.BCvnrybv6D.a4lGJXzJNSyO
date: Tue, 15 Aug 2023 18:04:21 GMT
via: 1.1 b0062bb33b961b53be87d688f2bdd9f8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P1
age: 154634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 14233
last-modified: Fri, 18 Feb 2022 23:28:59 GMT
server: AmazonS3
etag: "65a8b98b798ce416d94c2847aca40c71"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: -arLQLDKw-MP8G1zMueL3PWfDf418mrCFaBJnAhddtAHNXaBo8H8uw==

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A8A0 0
0 48ms
48ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssqj-wcfVBnPERYn6TsJdroh9JA-JyBNCUcpxFiDxA7D28IfRw6v3mGfXeHkVsyg5u66Gz3wEKcVizc9JSQxmwV7UjwBBn1SDbaPjI1Nn-tFj3na0fXM1F8_FIKRmlqCR4IG4AiynRPPltbeX5Y-S7F_HKCpYWiUoC4CO3eOs5ZL3wLhLNbh70Sm0Re6cK7cFdAwW-F2mV69sIXswtVnaVu7bvNp3axet8YIbErP3psv7UbjL3ubFwank_DvfHgj49tECxZbNdl1zpN8fDp-bZZ4iCk0n6LmXIjZiXDsqmPO8Wk4fDjTIxNVgR_g9dtkoOZsxnWR4vYvuEmEy7b4yrxqHxiZtTYqhr-XGlZoemqDTgpbq2Stit-z4-bhDrYr6Rrv8U4SkNB78C4hZM428B3Dbfr0uYCczc__znwmUjd0Z7xXfPXJr9uryIoREiKF125zwNXdFYURRH0eq3B9tiniGpzv4WBXAqY9IsUR4w91ZrWip_SBPAKOl8gQMs4U8u0P3oE2yv9JE0Gr1SRVKRA8GnqyQNFcYZeTaHMQuxYzc0Nyv063R1Ip1_YSlErWShqRLAVU1jjukb-LFDHFap-73ITNCvrljY-8cZd9073pmVUmRGIwe1JbIxFzvPTcdAlWAqhJL8ph9Op6JDSEViiPhQ0oFYZRlGKHQP3txCtWhyy1htzC1XVHd8XN1bVb6-KprF74u3Hr5MRUuqeUK4_R2KzTpjTEHBcaHMCtobNWtsFK3qRSgGp0m5TwRiqom1_vjvmKQsWXRGuTCPxMJeXSInZagG5VmZTKGCTAJa-i1x0wj-hGvxERDEz6d1DuopmFA8RyQnr_hKPUx-Tul0c_uo1NtvOX7gdwM6wqQMMrov-YjWZ4i6011H6i84uHz_cXhXHXDyGZI3mN-k48AcSRu4rRKgY-3_jiaW1ccDYtJk0I8fIHVWiJtBd_i59LnqbwvQsfuV3HgGeyQLI0Lg5U0CYqsku_3vJ8yqJGFBU9mVMtbiXfa5I4PMFK9UWrbhMso0J8t_D94WBVyfNTGMHo7O704TEIJP0wY625NBVrcoQaJM3xGRoiFwTBx_eZVQxSsuSmGIYxhRoKxPq75hx2lO7316kad7rRrnVmYVIUToZGYsRMhzzZ8tXdtdIE5i2u73kDjWVSFqPrPLSWJipHLkQ7F2R2qnBRotsbDBly7iYTl6OOEgtpI05TB20nkzV3PmDjkIBC_mepaUOL4UFk_OIp6x654LZ6zHzLAkGl-Yqs9w&sai=AMfl-YQbT2xuivUoAd1XO3_GaBogd3HRrSpwUMyqczHyHs3pk2fz0XKZOgxg_uvb-nQpAjyCUnKDjCz-yHqmtH6ddpWqmRdCI3dslNjF420OOVJRhX68opRBIf11kuGge0w7qqevapColFI5wN7BYmPlfLHAywmLsBh-Hp-EMzn06GYBSuqYhafyLNbti9t4LfuXSoNvoRwvjohV1oXh9ExwRT-MtGAue-33bi33BhbR_7QthWychNtEjvjXZt8-A1S9f0DO86_BOF-KDPldpj58stsXeQic4d32fPGMKF1G8ByhZD2CxtlES3lDUkMP&sig=Cg0ArKJSzLBVZcGgiEhFEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1732&vt=11&dtpt=657&dett=3&cstd=1074&cisv=r20230815.41877&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 17 Aug 2023 13:01:34 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame E623 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/346383189655976896/index.html?e=69&leftOffset=0&topOffset=0&c=jXOwK3CKXL&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:00:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1100
x-xss-protection: 0
last-modified: Fri, 05 May 2023 10:07:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 13:15:21 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E623 7 KB
6 KB 92ms
91ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

91071f44543d6cc78f2133879782c0e8b4176685addca7d2d459d56fc707b5d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5742
x-xss-protection: 0

GET
H3 200 InterstateCondensedBlack.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 5EBE 14 KB
14 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensedBlack.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15874828848628604197/index-09647504.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b7bf416424abed17314649bb71a1de7a3afc6af66840d04b730e69652e27ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index-09647504.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 12:54:10 GMT
x-content-type-options: nosniff
age: 444
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 13:09:10 GMT

GET
H3 200 InterstateCondensed.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 5EBE 28 KB
28 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensed.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15874828848628604197/index-09647504.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

241bb801b29748e542884f7b902c02f12f6a318ba97f70224986634926dbc433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index-09647504.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 12:59:44 GMT
x-content-type-options: nosniff
age: 110
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28596
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 13:14:44 GMT

GET
H3 200 06232023-053002206-background_quadratisch.png
s0.2mdn.net/4528404/ Frame 5EBE 28 KB
28 KB 11ms
9ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/06232023-053002206-background_quadratisch.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4338b399e437bda69b997b7de46a7869b9244a1f7cebc91ddaf57329c41e7ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 06:34:41 GMT
x-content-type-options: nosniff
age: 23213
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28774
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 06:34:41 GMT

GET
H3 200 annick_sitzend.png
s0.2mdn.net/4528404/ Frame 5EBE 2 MB
2 MB 13ms
11ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/annick_sitzend.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7327225cdf3eb28cd7f8ed4ab98de9d079fe2f007c3d73fd58dc4c757cf6b4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 04:18:09 GMT
x-content-type-options: nosniff
age: 31405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2539328
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 18 Aug 2023 04:18:09 GMT

GET
H3 200 congstar-stoerer_gb-plus_full.svg
s0.2mdn.net/4528404/1687525202405/ Frame 5EBE 4 KB
2 KB 15ms
14ms Image
image/svg+xml 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202405/congstar-stoerer_gb-plus_full.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd5e51e4be28957472ed34851536685ff162bb43dec37c9a7be46de1c1b72ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15874828848628604197/index.html?e=69&leftOffset=0&topOffset=0&c=K2wgpv1Ab2&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Wed, 16 Aug 2023 15:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75980
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1929
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Aug 2023 15:55:14 GMT

POST
H2 200 count
logger.virgul.com/ 0
116 B 44ms
41ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=initBufferFull&g=h&r=npm_asura_gg::&o=&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:34 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

POST
H2 200 count
logger.virgul.com/ 0
116 B 45ms
42ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=start&g=m&r=npm_asura_gg::::&o=vnet391e7226-65d8-4598-874d-43f080f02c8a:59:1700-1800::&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:34 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

POST
H2 200 count
logger.virgul.com/ 0
116 B 44ms
42ms Ping
image/jpeg 185.7.176.222
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.virgul.com/count?m=adRequest&g=m&r=npm_asura_gg:preroll&o=&iv=&wVID=&info=&os=windows&dt=desktop
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=8/17/2023
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.222 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Aug 2023 13:01:34 GMT
server: openresty/1.15.8.3
content-length: 0
access-control-allow-methods: GET, POST
content-type: image/jpeg

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 53ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=asura.nacm.xyz

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://asura.nacm.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Thu, 17 Aug 2023 13:01:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 985 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6efe7e4964448fbdd5349e5116703648d6692fc191736eb19b62515e21a7a3d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js Show response
pagead2.googlesyndication.com/bg/ Frame 7D53 37 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/H7NiGUBWITXDbUXvzcl9NdwFkmo5ojjKC-Hhm2BY16o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fb3621940562135c36d45efcdc97d35dc05926a39a238ca0be1e19b6058d7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 21:15:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 143190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14718
x-xss-protection: 0
last-modified: Mon, 14 Aug 2023 12:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Aug 2024 21:15:04 GMT

GET
H2 200 dc_oe=ChMIwLHpluDjgAMVf9gRCB1wFgxwEAAYACC3mOVcQhMIjNq9luDjgAMVYnzTCh2LqwyD;stragg=1;&timestamp=1692277294428;str=nextSlide;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame C823 42 B
401 B 149ms
112ms Image
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIwLHpluDjgAMVf9gRCB1wFgxwEAAYACC3mOVcQhMIjNq9luDjgAMVYnzTCh2LqwyD;stragg=1;&timestamp=1692277294428;str=nextSlide;strtype=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dcf07f5a2b18e2428e298afc070f7b9f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Aug 2023 13:01:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7A46 0
0 48ms
48ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstElxeTHSNnZPpe75b2oFnomfYB-FsQo819hvfah6xf7Mt0BoFarSgvaRVz9wsaN5CnRW2xPuS_UNdd8ZIlqmIUzmIgH9M_3L8T7wmDxY-y3BDA0AO9pElnxqckomVScntW9j38-CkSDEc_o8QffWnZL9JGPuyNCu__fHRhXPWIbAy9YGM3M9IRpVIQxot6Wx-72e26x59zB5v80f-J6Sw-sN-fN_YTh3HkbOHW-k7L5CfU_jyXC64zx26lEZlwoJ4aIu-LXZG4fSVeP1G4LjA9DwA-xuMb6U9_pxk0QVxSoZc7qG_vPg6VeNKEY0-ZmcVrgKBOrllRu0nQk7kDcmT5AHLo4w2oZH3G-ZmeuO4A6WR3jgEwWaqQR0TGDJdyf1uK0noEmvx_vz79t-9uoVDZTuoDPvlQn-4q70R8MD9J19LRrSb2l8aki6BXEPZnxnqZW7AoEHQXBJl11vn1cAioAiv_eVC4aJN5hvoKtydDA_Z_FQGo3z1jUmw74dqNuy5wuuXMpWFNGiNxX6xm9PtScHKZzCcG8f-4nQmPf80W1aVj3G-St1nOXcEzMJdvfTinqRz_b0VzpyX7iG7CO0nzv42_F2LO_x8mezFw7JvMc8O6QjsMLEE9Cigw828jPaZ9hUzc4PG55sAwQ_Sgen2jIdKiHBKyqp-koAAx2Xe-fzVvxUZdwOU1An7bcoWJozQ1tfmlmYLQoIk1ErJVt4VSvC6LNBkTBofCedJII4oBp9wiaYw3DRBfdQqhjIlnKHhECFM9tSDcXeg_q8Fp3ESLP-nMEAPbiYbIKkzaRJL91C8Y-Ui6bwr6qnLImDX6fTVtvQpF9aWfXF83hMzPmL7OgandtMXMcnYfuVXajFrVrL_fGFwoXrvoLKeLKFrZCjH2zZcJ2WVqNzLwsBIUoow7egD4LnUL8vwoH0uznuGL011AhQZp1i5hhbIR22pIofZX06WJrRMyXZvPy83qoHQ_6Y5z2TkNmfZxZ4ZOsuG5x5fWWezbrmTmpNr_wZ1DL6yilroawikBpjttYIZsjQs6EiIvte3OqX0a6MEghek4Iefyjnq9EP7bLDYgm6nC03Q_d6TL2dMwSfO9Sk5Vij6POmeY62XYuii3lO3uA5NJOCIatwytkF5SuC2Kd2FDwiLdqqyy33ju1HGXsnFYXVDXLh5p6R7RzSDbUjTf26T3fVqK5D_pMAQKN4DUJHZlJnZCl9Vtz3oECbUnQz51sumZMVqC-MBPp8mUCGm5NPJheCSVe3_gVxbYTHrxuhjuqTycBCnFoNZ51-sXcIu9e8hS7GpqRWI7ci3V&sai=AMfl-YRTiV85_xzgAJl8wR9tMFk5KnHGKfETsJuN6xIAabbTwgxgroOWoMDmf3h1QBETROHw017pglZEzQpWFQRLVrQMCKUn3lQ7D4875LLCfcCxsmlCgXPSfAahNyhynMUjvDXf4rJx3yqqs80wz6vqRMJP7-C0eSkperdXK1altkReppl18F9hi8a_NZNiH4vtB0uBH79bgIvw-nRoAaCxsdGy2dFO3Ubv25StqlmdZYoe53LPYfo1pK9yePiswt8sJS5EsCPX8km4tTEoDla2Of0vfz4zZxkr6GUhS8mg8DEGbZuK0jgDMwt-H-Nl&sig=Cg0ArKJSzNT1l_EgaM6EEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1812&vt=11&dtpt=638&dett=4&cstd=1173&cisv=r20230815.16753&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: asura.nacm.xyz
URL: https://asura.nacm.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 Grosse Pointe, United States, ASN15169 (GOOGLE, US),

Reverse DNS