cybernews.com Open in urlscan Pro
2606:4700:3108::ac42:283b Public Scan

URL: https://www.facebook.com/cybernewscom/

URL: https://www.youtube.com/c/CyberNews

URL: https://www.linkedin.com/company/cybernews

URL: https://www.tiktok.com/@cybernewscom

URL: https://flipboard.com/@CyberNews_com

URL: https://bi.cybernews.com/totalav/
Title: Get special deal

URL: https://bi.cybernews.com/norton/
Title: Get special deal

URL: https://bi.cybernews.com/bitdefender/
Title: Get special deal

URL: https://careers.cybernews.com/
Title: Careers

ns31533567.ip-162-19-138.eu

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 80

https://ap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID HTTP 302
https://eu-inap.vap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Request Chain 89

https://pixel.adsafeprotected.com/rfw/st/1676726/76805677/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014932963&ias_pubId=pub-5928161074779380&ias_chanId=1&ias_placementId=20797590123&bidurl=https://cybernews.com/security/clash-of-clans-third-party-app-leak/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0j5gBW6RiDLslz6re6BfkfL HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

Request Chain 97

https://pixel.adsafeprotected.com/rfw/st/1676726/76805677/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014932963&ias_pubId=pub-5928161074779380&ias_chanId=1&ias_placementId=20797590123&bidurl=https://cybernews.com/security/clash-of-clans-third-party-app-leak/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0hjZZ8bNeyud4uSyCmys93h HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

Request Chain 114

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENbez_6FOKTFCDhyrdvDqVc&google_cver=1

Request Chain 115

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZY7Fuq.H01XNiRQipO7OIQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESELGZ7mFVx2P22tZSG1rbLZQ&google_cver=1

Request Chain 117

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENEDMi2CFFJ6K-ScQbR2n2A&google_cver=1

Request Chain 126

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEMsxJdB9za0AJwWk_UB0emg&google_cver=1

Request Chain 131

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOxm1R5kpQJFgmR3uWNo0NI&google_cver=1&google_push=AXcoOmRzzcJMnrIvBMT9KPYteDUfiIodYcNHjfBzejXSBaLmLbHix6md2KcP6VC5Y5DQXRLoiWWi0qCRPiLbj4IQb6XfL_g2UYSyv7Vk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjUzMjI5MDczMzY5NjIzNjIyNQ==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBPebgPX9Txj5qnNYVXLizs&google_cver=1

Request Chain 132

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 133

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEC-b91LyQ0ZsYBa9kX-rBjg&google_cver=1&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClwJV4qBaBWF892zLvQW7aWe HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClwJV4qBaBWF892zLvQW7aWe&google_hm=zPtDdVFWRSmy2ZtcHIukPsw

Request Chain 134

https://ads.travelaudience.com/google_pixel?google_gid=CAESEL-3u6-whoWHhW3WzrvGi_0&google_cver=1&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s6WYKqQB_5m6QIHNR HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=3tVxNDrAQdcSr5XAEZyU0A&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s6WYKqQB_5m6QIHNR

Request Chain 135

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJCdtxcSMwnzsrHLimO4738&google_cver=1&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-ZMsqKxdnoT HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-ZMsqKxdnoT&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Request Chain 137

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEM2UBIRRKcgyEqqQQVKiq6k&google_cver=1&google_push=AXcoOmRW1TFFDrAPazivstvEu7DFTmNEEojiZJBX4SVRnF7vUFGN7jHss6dx1JSM0A5ve5Ooj1cXvvtLakMwPexN4mHBBryaFznb6A9-EQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmRW1TFFDrAPazivstvEu7DFTmNEEojiZJBX4SVRnF7vUFGN7jHss6dx1JSM0A5ve5Ooj1cXvvtLakMwPexN4mHBBryaFznb6A9-EQ HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 139

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 158

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8TTRX45vmJw-AvGn0xzE5XNpL-6Jlaz2cKOrO5GcvVrIHKGZxd5CzWwuUY HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8TTRX45vmJw-AvGn0xzE5XNpL-6Jlaz2cKOrO5GcvVrIHKGZxd5CzWwuUY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8TTRX45vmJw-AvGn0xzE5XNpL-6Jlaz2cKOrO5GcvVrIHKGZxd5CzWwuUY

Request Chain 159

https://um.simpli.fi/gp_match?google_gid=CAESEHrAo-rpTnZpM_jp2u0Od44&google_cver=1&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV657sb2LTw20tAOgASM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV657sb2LTw20tAOgASM

Request Chain 161

https://ads.travelaudience.com/google_pixel?google_gid=CAESEO61W7tHTpYnn0uIhg1_6ug&google_cver=1&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQlna51YpR2yPWOs9dY HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jBqPCTOZS10DJKBD9nX3Xw&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQlna51YpR2yPWOs9dY

Request Chain 162

https://d5p.de17a.com/cookies/google?google_gid=CAESEBTaL-SSl-t2vjC-7BavgNw&google_cver=1&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEBTaL-SSl-t2vjC-7BavgNw&google_cver=1&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc

Request Chain 197

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1

Request Chain 198

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZY7Fuq.H01XNiRQipO7OIQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2

Request Chain 199

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEE2HVVOypDyf4LPzAgeM8Yo&google_cver=1

Request Chain 200

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

Request Chain 202

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 203

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmRZjsw4akjm-kzFhb6qY9UTLyhUu9JOs9JViAprDEa6EXULs9_vjG3HPq6XzGWIL3BYo3JkyZiW2knSo_JRKSGDVtPao9SXq_0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_push=AXcoOmRZjsw4akjm-kzFhb6qY9UTLyhUu9JOs9JViAprDEa6EXULs9_vjG3HPq6XzGWIL3BYo3JkyZiW2knSo_JRKSGDVtPao9SXq_0

Request Chain 206

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIUMGCMJ0C48K3FSJntkqUOH2g HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIUMGCMJ0C48K3FSJntkqUOH2g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzgzNzgxMDUyNzgyNTU5MzQ2OA&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIUMGCMJ0C48K3FSJntkqUOH2g

Request Chain 207

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEM2UBIRRKcgyEqqQQVKiq6k&google_cver=1&google_push=AXcoOmS3NETtaYitGiGSlWOY-HaI1qIVTi_kD4JQiQXWYUkNT5DW0n4KdjiRbocUs7h4QDDTCNc80qA38urABpizMb2_UKgQeKHqpeEk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmS3NETtaYitGiGSlWOY-HaI1qIVTi_kD4JQiQXWYUkNT5DW0n4KdjiRbocUs7h4QDDTCNc80qA38urABpizMb2_UKgQeKHqpeEk HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 212

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr_consent=

Request Chain 215

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cver=1&google_push=AXcoOmTsnEBCSmZnWg0yOP-6nt97WV4UIdp3bzDp8-C8VX1cvMR8W6PefxzQvc7cGBz30lhs_lEp5ZsK85mt26nffEH8bLpuXU4Egg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cver=1&google_push=AXcoOmTsnEBCSmZnWg0yOP-6nt97WV4UIdp3bzDp8-C8VX1cvMR8W6PefxzQvc7cGBz30lhs_lEp5ZsK85mt26nffEH8bLpuXU4Egg

Request Chain 216

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 218

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefuIqXW8aOwfzSNUuYGj4sLyuXN20qSMbKcc&google_gid=CAESEGekOBMqIdKwZ8cqpQb3D04&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefuIqXW8aOwfzSNUuYGj4sLyuXN20qSMbKcc&google_gid=CAESEGekOBMqIdKwZ8cqpQb3D04&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMjkxMzEyMjcwMDA1MDYwNTE1OTIyOA%3D%3D&google_push=AXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefuIqXW8aOwfzSNUuYGj4sLyuXN20qSMbKcc

Request Chain 219

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJM3LZuDfsdWfqFh88-FNZQ&google_cver=1&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizatgf1uyrWE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizatgf1uyrWE&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Request Chain 220

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESECA4--6JibRTdaYvRdbKWQ0&google_cver=1&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8mMeWTd4DyFky9VxyI8KfVIpDGY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDEyNTM1NTUwMzYzODIyMDkxOA&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8mMeWTd4DyFky9VxyI8KfVIpDGY

Request Chain 228

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=2787657605&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=2787657605&gdpr=&gdpr_consent=

Request Chain 230

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cver=1&google_push=AXcoOmTvwZ0G6uQ7FE5pJEw31bSph-RWzYjuTmPL6HRdm3kulPszV8WnlR-d6YeL8kCMJWFX8ttFBgxMarYTrhnhtp9Mv4LS4KybJw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cver=1&google_push=AXcoOmTvwZ0G6uQ7FE5pJEw31bSph-RWzYjuTmPL6HRdm3kulPszV8WnlR-d6YeL8kCMJWFX8ttFBgxMarYTrhnhtp9Mv4LS4KybJw

Request Chain 231

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmTw2UEY_GYhuwL4kHZqkVckOHXdrOmqsfpU2jkigqGToXnM3VFkbuuP3alJ26FCkLPsVHhx1DW8-hXS7QhdYiVvnw0fKbJqZw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wlk3RnV3QUtjTFZuNVFBTQ==&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmTw2UEY_GYhuwL4kHZqkVckOHXdrOmqsfpU2jkigqGToXnM3VFkbuuP3alJ26FCkLPsVHhx1DW8-hXS7QhdYiVvnw0fKbJqZw

Request Chain 232

https://um.simpli.fi/gp_match?google_gid=CAESEBN3auvwK0SjPkfbMLrpMsc&google_cver=1&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wlyziexI0WQ3nSHXjQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wlyziexI0WQ3nSHXjQ

Request Chain 233

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEBNWG0jyXxK_gl9jh6Fii6Q&google_cver=1&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYRGhjll69Vi90xaYTw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYRGhjll69Vi90xaYTw

Request Chain 234

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJCdtxcSMwnzsrHLimO4738&google_cver=1&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB0OfXZRA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB0OfXZRA&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Request Chain 236

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuheifY4kDP3eX2v4rhkLLKToh HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjM3NTA3NDI0MTg5MDI4NTg1Mg&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuheifY4kDP3eX2v4rhkLLKToh

Request Chain 241

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 242

https://googleads.g.doubleclick.net/pagead/adview?ai=CK4TLucWOZaPZL7XvmLAPoJOO0AObpc3ndMfL_POFEtiJhZ4LEAEgttfpe2CVkp-CsAegAY_GhKcpyAECqQKONn5tfo2yPqgDAcgDyQSqBKwCT9B8nRd7GDLctTSoWOBUPo24WacnyDNoYG8rJDsanKiL4w1QVvK46GVf1cVSC2ZeORleboVgiEmFDhw_FqsgtjPc4EReJ-KJstI-fyo-fEsAJ98okncLX7T6y5gHoAALnCLIfwIXTyylvFHy51TcQvRXI7PRtTxkmppfCMOGYUmRTiP5lzJ1RQlibyp75FJqIaCwM814Z9jAA4HNi2I6M4H_fDenaSDeXFwGTHhggyvT1cy0lmXqEvDFrGQY78QAGe5pQtrCQ4_8hsIsvtBC3Nr3ykuxcNU3Q8H5mrs2d_12Egu3kXXSDMY6iWwuzGnI5gMnH0x2gtIrGWrByw_wnbUqu8yoCE65PsafrzOmBz7-pZoZRle8YtMxaL9403igBJ8Dlrcg4ymQZWHGwASjop2quwSIBYHKrc5MkgUECAQYAZIFBAgFGASgBgKAB7WWyYAFqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ744I0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOljM47fE3LSDA5oJqAFodHRwczovL2FsbC1kb3dubG9hZHMuY29tLz9mbG93PWYzMTA3JnBpZD04NDEwNDYwOWExYzhlMDBmZmRlZmI0YTJjN2ViNTkxMiZnYV9jb252X2lkPTY2Mjc0MDI2MDgmZ2FfbWNjX2lkPU9GRl84NjgtNTI4LTE1OTAmZ2Ffc2lnY29udl9pZD02NjI3MjI2NTUyJnJ3X3Rva2VuPUVSMmcxTHNGZTCACgHICwGiDBQqEgoQ5LSxAu61sQK1uLECrLqxAtgTDNAVAYAXAbIXHAoaCAASFHB1Yi01OTI4MTYxMDc0Nzc5MzgwGAA&sigh=iO_FSmA0QBw&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSOwAvHhf_gVjVBbmccDtNC_KnV0hi5BVr0l9LNsUQRe6lPrAvWrWir-smteAGpORE3zCW6X5EeAhF3_HZGAE&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223934091204151352491%22,%22debug_reporting%22:true,%22destination%22:%22https://all-downloads.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211087717135%22],%2222%22:[%22true%22],%224%22:[%2212-29%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215903596673284610465%22}&andc=true

Request Chain 265

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cver=1&google_push=AXcoOmTYqNixg3bjqG91cqbMPdvGdZvMW3qG2P8xS78XJgvYnHaH5_fOGIHGy2jpk1DYDoROTGOW8QC0b5HEzF3g94qNgw3WoPwM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cver=1&google_push=AXcoOmTYqNixg3bjqG91cqbMPdvGdZvMW3qG2P8xS78XJgvYnHaH5_fOGIHGy2jpk1DYDoROTGOW8QC0b5HEzF3g94qNgw3WoPwM

Request Chain 266

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEPszK55Cx3ysxm__qD6w6Rk&google_cver=1&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKzreKcCo2nmuvOYnkZ7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKzreKcCo2nmuvOYnkZ7&google_hm=zPtDdVFWRSmy2ZtcHIukPsw

Request Chain 267

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEGhx5tGBaQUV6UlVLQiH2_w&google_cver=1&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_kw-LA-rIqoL5c HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_kw-LA-rIqoL5c

Request Chain 268

https://d5p.de17a.com/cookies/google?google_gid=CAESEJ43a2wPIQYL3zZAPGOXvAA&google_cver=1&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRxWx3oZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRxWx3oZ

Request Chain 271

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_gid=CAESEAy8kKvySdeqJEk0rz3uF8E&google_cver=1&google_push=AXcoOmSYhZNpYnICoi6kxpQEYIFea9sBIx20Iblh3BEA15KexVE57a-ML1y3lI9TreiHljFXLdm8CvEqnPsWYDBJaGuKs4aSUvsuxA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=96d2be99-58cb-4f24-bc80-1cbb1408a1e2&google_cver=1&google_gid=CAESEAy8kKvySdeqJEk0rz3uF8E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmSYhZNpYnICoi6kxpQEYIFea9sBIx20Iblh3BEA15KexVE57a-ML1y3lI9TreiHljFXLdm8CvEqnPsWYDBJaGuKs4aSUvsuxA&gdpr=${GDPR}

Request Chain 286

https://gum.criteo.com/sid/json?origin=publishertag&domain=cybernews.com&sn=ChromeSyncframe&so=0&topUrl=cybernews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=MPKNkXxuWTJyVjFWRnlOZ1ZDWnZFWUtoZm0valN2SU9kMDcwRUVCMFNWOGFEVEdXOEZNMDRtZjF2emRaU0hYRHlIdnZ2SVIybTBUUlZ3YWNHQUZHeTl5Ry9LUW01MVoweTlKbWNMVTJNRDVIWXVCZ3hFeXlYdyt2dWY4ZVk3YXZYYngzc0JzQmxiYzQ0V2RwbHJ3UkpvWVFUTkl0eGxBUzl1MjRCLzgzQlVVZ2JPUUtlczVLekVzOWtlN3RIdU9jNXFCdm5DcXhTcE1oTk9tM0d0UGNYTjFMbHByWGticDlkZ1d5ZWxMZXZLbHRKZlNpQk9DTGJPV2NnY3hGbGJyV1ZaT2J3MlFsRmVrSlppa3hYVSs4NkZYT2NIUT09fA&cppv=2

Request Chain 304

https://ap.lijit.com/beacon?informer=13401985 HTTP 302
https://eu-inap.vap.lijit.com/beacon?informer=13401985

309 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cybernews.com/security/clash-of-clans-third-party-app-leak/ 133 KB
31 KB 184ms
128ms Document
text/html 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c9865446f98272b53fae7fb79d5efe8ead6c7c2eb5af6afeadcd190b4b88b3a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 83
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 83d24b63c8c69ba4-FRA
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: same-site
ct-content-bucket: Security
ct-content-type: Editorial
ct-date-published: 2023-12-28
date: Fri, 29 Dec 2023 13:12:25 GMT
expires: Fri, 29 Dec 2023 17:12:24 GMT
last-modified: Fri, 29 Dec 2023 09:25:10 GMT
permissions-policy: geolocation=(), camera=(), microphone=()
referrer-policy: no-referrer
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 45ms
19ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4191d89ec03bce5dc273716075335e31851031184b0fff0ab9fc900a8442019f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1539
etag: W/"a87c48d211877c49b878679b2e3cdab8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 83d24b64c80b2bc2-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Mon, 01 Jan 2024 13:12:25 GMT

GET
H2 200 clash-of-clans-players.jpg
media.cybernews.com/images/featured-big/2023/12/ 111 KB
112 KB 151ms
93ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/featured-big/2023/12/clash-of-clans-players.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fab4b8f9ff18d6e23b51f772481af17ebd28042e1e793237edc47515486ff5ff

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 bd03106f662746adc3512ff682754ad0.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 113854
cf-resized: internal=ok/m q=0 n=25+915 c=0+0 v=2023.9.8 l=113854
last-modified: Wed, 27 Dec 2023 12:52:29 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cf_5A7ycM2gjF-79TrUyXfUSCqBBDG3-qSyS-DIfI0DQ:8473cd67a70fe1ae5aa28dabe8e6d7ec"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b650f6330d8-FRA

GET
H2 200 base-f66abc99343feb5986aa.js Show response
cybernews.com/js/ 24 KB
10 KB 48ms
46ms Script
application/javascript 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybernews.com/js/base-f66abc99343feb5986aa.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f36d0521480a2b88d4428ba420d0e52741e487c450cdaa07b5f790d9347664f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
age: 873066
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=24590
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer
last-modified: Tue, 19 Dec 2023 10:24:25 GMT
cf-bgj: minify
server: cloudflare
etag: W/"65816f59-600e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
permissions-policy: geolocation=(), camera=(), microphone=()
cf-ray: 83d24b64da3d9ba4-FRA
expires: Fri, 29 Dec 2023 17:12:25 GMT

GET
H2 200 adds-body-f66abc99343feb5986aa.js Show response
cybernews.com/js/ 1 KB
697 B 83ms
82ms Script
application/javascript 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybernews.com/js/adds-body-f66abc99343feb5986aa.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d959f0e60cf01a041df2583fe38ab79a5f0418f513b3512c3f6aa17aec8986

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
age: 872965
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=1262
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer
last-modified: Tue, 19 Dec 2023 10:24:25 GMT
cf-bgj: minify
server: cloudflare
etag: W/"65816f59-4ee"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
permissions-policy: geolocation=(), camera=(), microphone=()
cf-ray: 83d24b64da419ba4-FRA
expires: Fri, 29 Dec 2023 17:12:25 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 246 KB
86 KB 50ms
23ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4ccfa58609922d108ecdc2d06c695cea5baca81f046e65fba77f36a3db041f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87362
x-xss-protection: 0
last-modified: Fri, 29 Dec 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
DATA 200
OK truncated
/ 61 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e138d129f38769d7080ed6ac6519dce8a4d546b7da5709b12aedff39673fa021

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 62 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fcbe29ddadf674b264c84fb8dbe9f5d5e796d1e0c5c239273ff6245e6dda0f69

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 63 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9fca9ae04b4bca7ef7d4f2c43505769b1f03fd173ecf3871dd7b7ee0f115dd48

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 62 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab8f0b6cec3eb6cd02efd0a9324053b868cac7dcda99fc89871b4e87141bdf14

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 hqdefault.jpg
img.youtube.com/vi/WQ47Ued6Q4c/ Frame 32FE 44 KB
45 KB 84ms
10ms Image
image/jpeg 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/WQ47Ued6Q4c/hqdefault.jpg

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80d66714e32967ab0b85d0df9f502f3cfb14af842e223e4f983d14e64dcb6ee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 12:45:16 GMT
x-content-type-options: nosniff
age: 1629
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45141
x-xss-protection: 0
server: sffe
etag: "1703312591"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 29 Dec 2023 14:45:16 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 39ms
37ms Script
application/javascript 2606:4700::6812:d63b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151605

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d63b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebe0f94ca53bc5f7d865f89aec5b0315bca03ace6942d6c1c76d94d5b59d419a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1540
etag: W/"e3be409ac3c100e2a5d3f264ec260551"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 83d24b6578d62bc2-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Mon, 01 Jan 2024 13:12:25 GMT

GET
H2 200 Paulina.jpg
media.cybernews.com/2022/12/ 28 KB
29 KB 54ms
53ms Image
image/jpeg 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/2022/12/Paulina.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfb9d227112112ea799160522621bcd75f35c3e5df888be3298cbfa24d1b9a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 8be4072f43c8c13d02688a798ea634a4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: AMS58-P3
cf-polished: origSize=30591
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 28901
last-modified: Wed, 14 Dec 2022 10:03:02 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "0a6d524cc0d74b82582791ae4959cd2c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b657fed30d8-FRA
x-amz-cf-id: B0VuOSvumig9Fw9CSG6YA_gp65MSp3tQjub-9WaI9EqIlYzrxOpuHQ==
expires: Sat, 29 Jun 2024 04:32:25 GMT

GET
H2 200 podcast-recap.jpg
media.cybernews.com/images/thumbnail/2023/12/ 14 KB
15 KB 50ms
44ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail/2023/12/podcast-recap.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf33fa8eb88a27ee95832b14bf22c73a55cdb9fb44838b79fac666259808f7b2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 f7b7cf90592cf6a380fd34cc45e9c4b4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 14631
cf-resized: internal=ok/h q=0 n=14+244 c=0+0 v=2023.9.8 l=14631
last-modified: Wed, 27 Dec 2023 08:39:06 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cffVNzr4Ro-y3EEBFN6B4zPUCGPri99XVCPD58WiJxDQ:b848a6ccc0b11173ddad6114afd0285a"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b65980b30d8-FRA

GET
H2 200 streaming-2024-one.jpg
media.cybernews.com/images/thumbnail_small/2023/12/ 3 KB
3 KB 44ms
39ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/12/streaming-2024-one.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb176a3cb2159da464b3b351c13287cc96bf6a935b451d548fe7c64c7cedc78

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 3b4d1163775ea43e2848ada2f6a68950.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 2987
cf-resized: internal=ok/h q=0 n=17+0 c=7+69 v=2023.9.8 l=2987
last-modified: Tue, 19 Dec 2023 12:54:19 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cf5MdgVShz3sU1hFVy12CaFV-Y8iFZYhIqdjUqgfspDQ:4ef2dd2aea046244e8c4721ec3ba896d"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b65980d30d8-FRA

GET
H2 200 old-electronic.jpg
media.cybernews.com/images/thumbnail_small/2023/12/ 5 KB
5 KB 43ms
38ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/12/old-electronic.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56bb91149837c4f8f900238ec37b8c0fa98f91b87d9fc13f488dee06f46172b2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 a394c864b23364262af48fed4e7e9fac.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 4917
cf-resized: internal=ok/h q=0 n=23+0 c=17+87 v=2023.9.8 l=4917
last-modified: Wed, 20 Dec 2023 11:37:48 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfMNyFAE79kcKc2ut9DqbXbOAG8iFZYhIqdjUqgfspDQ:9407499d124a6b12736e50377b34dd17"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b65980e30d8-FRA

GET
H2 200 Decentralized-Services-VPN.jpg
media.cybernews.com/images/thumbnail_small/2023/12/ 3 KB
3 KB 41ms
36ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/12/Decentralized-Services-VPN.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1fb7c45bd66ef2142e51995124e4de48a6d68a3ab33d5f7e6e34cb1174e520d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 2644
cf-resized: internal=ok/m q=0 n=38+0 c=5+58 v=2023.9.8 l=2644
last-modified: Mon, 18 Dec 2023 15:36:58 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfGtloPouCLss0CTj-Xol0Alul8iFZYhIqdjUqgfspDQ:7aaddbd6fb61b33a68a24d2477c70cfb"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b65980f30d8-FRA

GET
H2 200 nerd-explaining.jpg
media.cybernews.com/images/thumbnail_small/2023/12/ 4 KB
4 KB 42ms
37ms Image
image/avif 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/12/nerd-explaining.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

089f3882ca8ed99068f5221bbed0c0177e41121ade3abd7ab03b3257b2a7f1b6

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 cd89ff2afb5d679fe3dbf35f3872a5b2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 3918
cf-resized: internal=ok/h q=0 n=28+0 c=6+83 v=2023.9.8 l=3918
last-modified: Wed, 13 Dec 2023 12:15:30 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfp7xMHtBnLexnnxhaKXdil7op8iFZYhIqdjUqgfspDQ:3c2a91fcec1afb4fea38a951ed71d3a3"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 83d24b65981130d8-FRA

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 110ms
70ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Requested by

Host: cybernews.com
URL: https://cybernews.com/js/adds-body-f66abc99343feb5986aa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67e2da441c941f8e1971a2278007d100fbbe2309d0258fad1db5644dd05ddea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://cybernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51225
x-xss-protection: 0
server: cafe
etag: 8236653606409482956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 89 KB
29 KB 158ms
118ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/js/adds-body-f66abc99343feb5986aa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

536f0126f25ba7856c9b35d61a3d03e277f217b66b77745be393c1c70e40ea38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29055
x-xss-protection: 0
server: cafe
etag: 462 / 19720 / m202312060101 / config-hash: 17400476758908410755
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
H2 200 5774 Show response
stpd.cloud/saas/ 350 KB
105 KB 114ms
74ms Script
text/javascript 2606:4700::6812:1f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/saas/5774
Requested by: Host: cybernews.com
URL: https://cybernews.com/js/adds-body-f66abc99343feb5986aa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c7405d17b5e748c2a6fceb47d65449c72a1a3560747f46d8cd6163627a09561

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 29 Dec 2023 13:32:25 GMT
date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 29 Dec 2023 13:09:51 GMT
server: cloudflare
age: 154
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
cf-ray: 83d24b65ea6c3650-FRA
stpdhash: cache

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
89 KB 26ms
14ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

43b18bfb91089c9e126d3bff4b32742b2be14f7fd519d19d8cc59612eb03f0ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91011
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 115ms
16ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230119-FRA

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/589784210/ 3 KB
2 KB 138ms
46ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/589784210/?random=1703855545281&cv=11&fst=1703855545281&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v813159125&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&hn=www.googleadservices.com&frm=0&tiba=Clash%20of%20Clans%20gamers%20at%20risk%20while%20using%20third-party%20app%20%7C%20Cybernews&auid=520309099.1703855545&uamb=0&uaw=0&data=contentBucket%3DSecurity%3BcontentType%3DEditorial&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1233d1c1bff70428abcb25a0f95604079e41654dd9f3543926a0e272c956da74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1348
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 102ms
15ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 29 Dec 2023 13:12:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: MjcrJFFVeN6XLuGT69PSJHklrARmM2qbmv5mheZyMGz1KK/0qomkJxAao54WBAgvVYkSYfzGQO3koph6eItfrQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-optimizer: 1
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ 399 KB
135 KB 102ms
70ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5928161074779380&plah=cybernews.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cfee7e20a0b1353637696c6de210e39da7ab4314cbb40a6678cad7148b08150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137961
x-xss-protection: 0
server: cafe
etag: 5737267142289597352
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/ Frame D6B7 9 KB
4 KB 15ms
12ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 23:18:53 GMT
etag: 5585625838579639069
expires: Thu, 11 Jan 2024 23:18:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
252 B 64ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-KT8DKCHF41&gtm=45je3bt0v882489589z8813159125&_p=1703855545085&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=384547006.1703855544&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1703855545&sct=1&seg=0&dl=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&dt=Clash%20of%20Clans%20gamers%20at%20risk%20while%20using%20third-party%20app%20%7C%20Cybernews&en=page_view&_fv=1&_ss=1&ep.contentBucket=Security&ep.pagePostAuthor=Paulina%20Okunyt%C4%97&tfd=644
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
252 B 87ms
19ms Ping
text/plain 2a00:1450:400c:c1d::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KT8DKCHF41&cid=384547006.1703855544&gtm=45je3bt0v882489589z8813159125&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 83ms
35ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KT8DKCHF41&cid=384547006.1703855544&gtm=45je3bt0v882489589z8813159125&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1293407534

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
376 B 167ms
108ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f80b31d4-eb59-49b6-869e-aa9d227a48e5&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=2811a2e0-0433-44a1-8c06-f43b96ffbea9&tw_document_href=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&tw_iframe_status=0&txn_id=o3auk&type=javascript&version=2.3.29

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 102
date: Fri, 29 Dec 2023 13:12:24 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: a2db9225166af886
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 08118ea7fcf034612477a16cd3fc943325596592ac02670313f85d7a48d2eb2e
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
726 B 168ms
104ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=f80b31d4-eb59-49b6-869e-aa9d227a48e5&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=2811a2e0-0433-44a1-8c06-f43b96ffbea9&tw_document_href=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&tw_iframe_status=0&txn_id=o3auk&type=javascript&version=2.3.29

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 101
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: e42c664cd4595487
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 35699c9e332060eab483318dfd6527ddcb6a71daa9440317940fd0c13f51a727
content-length: 43

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/ 431 KB
135 KB 21ms
3ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

108cdb682e1d256ba58174d96775ec12fe2e9515ffa2ca7edfff49343a4d97ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 10:14:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10669
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138180
x-xss-protection: 0
server: cafe
etag: 6854214708762155125
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 28 Dec 2024 10:14:36 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 110 B
95 B 79ms
51ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=cybernews.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c4b51137d2470c66cce501d002d2586501968262bcb3e40f9791ad1267026db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70
x-xss-protection: 0
expires: Fri, 29 Dec 2023 13:12:25 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/589784210/ 42 B
455 B 74ms
18ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/589784210/?random=1703855545281&cv=11&fst=1703854800000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v813159125&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&frm=0&tiba=Clash%20of%20Clans%20gamers%20at%20risk%20while%20using%20third-party%20app%20%7C%20Cybernews&data=contentBucket%3DSecurity%3BcontentType%3DEditorial&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_C9AXooYukCmXUIEt_3ypEpRXpDBf5A&random=3388646086&rmt_tld=0&ipr=y

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/589784210/ 42 B
154 B 30ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/589784210/?random=1703855545281&cv=11&fst=1703854800000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v813159125&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&frm=0&tiba=Clash%20of%20Clans%20gamers%20at%20risk%20while%20using%20third-party%20app%20%7C%20Cybernews&data=contentBucket%3DSecurity%3BcontentType%3DEditorial&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_C9AXooYukCmXUIEt_3ypEpRXpDBf5A&random=3388646086&rmt_tld=1&ipr=y

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1031670724691978 Show response
connect.facebook.net/signals/config/ 135 KB
35 KB 15ms
6ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1031670724691978?v=2.9.138&r=stable&domain=cybernews.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5480cc2b32b1f52f2b7be7b836904e1e4f3741bb0e25f739140bc49709ef584b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 29 Dec 2023 13:12:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 35530
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: vEviz4QoTHOZKAdD9i3NH5cjwCLAjP22RyTYp4eaDoljns66drNguMD/nQnKfkkOmtehQ957I2GxTHmzqWnIfQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5595 295 KB
68 KB 491ms
490ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&adk=1812271804&adf=3025194257&lmt=1703841910&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=164x810_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545402&bpp=5&bdt=342&idt=259&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7989592492653&frm=20&pv=2&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=309

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5928161074779380&plah=cybernews.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80cebe4cdab953e943f74e8f18b957eb0c8336d2ddbcc48dc80d7b4d42844aea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 69889
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Fri, 29 Dec 2023 13:12:26 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9C3A 39 KB
16 KB 799ms
798ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c22fdf6f6f3716b42d4ff100816b7ccdc1c7566c0a61850627df114887f41c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16644
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Fri, 29 Dec 2023 13:12:26 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D0F8 135 KB
43 KB 912ms
910ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43f1039109bf822e410b54fd68826f3a6f763d53a2fdc88b29cf3fd2e6b306bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 44461
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Fri, 29 Dec 2023 13:12:26 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 89ms
13ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcybernews.com%2F&domain=cybernews.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cybernews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 29 Dec 2023 13:12:25 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 230050
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 282 KB
70 KB 86ms
21ms Script
application/javascript 52.84.193.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-215.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4d3c300c1cd89393c7f945c06656981e3ac1c034f59996affcd1062a3092f40c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 12:12:46 GMT
content-encoding: gzip
via: 1.1 9ef1b108656dc6d0707b168b862883dc.cloudfront.net (CloudFront), 1.1 f3a3f62227549dcbb83000c9d8bb826a.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 22:20:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, CDG52-P1
age: 3580
x-amz-server-side-encryption: AES256
etag: W/"d6937d02acbbf691a008906e9d0617e0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: ux11s2gxONh7Gu5EaemJ7EfAQqgmpwroG7SIEMBOVGHlz-pfWJKu2w==

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
414 B 58ms
11ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7c2589f966c01479236dda131a4942c70ba281e3be202cc12d56680f86977a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
372 B 50ms
14ms XHR
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcybernews.com%2F&domain=cybernews.com&cw=1&lsw=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 283703
expires: 0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 57ms
18ms XHR
application/json 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20231229

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f275185c5bb7a1be557a3538a13c74558afc6353afe0ecbd74acaeb93add4900

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 33092
x-jsd-version: 1.0.1918
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21963-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"63b-uUUJg6EqJ+AdUK76javn+W+iLCc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivIQ9gjT5kPT7YCKwzu5KtrhpoCIKxhmGw5bLz37PCv2Peu%2BVOYvTYQhg1yvFW8iGEEzmkIqq%2BHaOi%2BFCqOv4sQJi76xCkssR8uI1EiMljGjWWq8CRz%2FDlOi7QGcPZdiRlcXp7NxzqSVMtdXleI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 83d24b699d6b366b-FRA

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 57ms
7ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1031670724691978&ev=PageView&dl=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&rl=&if=false&ts=1703855545838&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1703855545834.962643510&ler=empty&it=1703855545622&coo=false&rqm=GET

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 29 Dec 2023 13:12:25 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 64DA 722 B
386 B 401ms
400ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545411&bpp=2&bdt=351&idt=429&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=3616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=443

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6decc94417ce0fd16c86648c875739294758135cf41fdcdb06af2689816e8c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 361
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Fri, 29 Dec 2023 13:12:26 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ 2 KB
1 KB 99ms
67ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad47f7fede67d05e8f0f9a784a1def9bef72597864663170f85558ecb9f752a2

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=32xk6QeJ8Mlkkuj%2FRwMTs1KeCu68FKsnN8ycUv94ObNFMeE%2FMMsmi4F1onSqvPctjIDqXq2KfqwGW6UWQC%2FDrxVvxjacSVc3q6JzRM3dvlaYPZ3zdCbo8iYhsAVHqwNXmcakfukHd6xT"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 83d24b69fa192bce-FRA
expires: 0

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ 426 B
622 B 168ms
136ms XHR
application/json 172.67.68.162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.68.162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 814ff86a87326979c91365924a20dd567fdcc36bf46a25e44cb0802f9509eb35

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-prebid: pbs-go/0.259.0
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BWAQSlFLqS7RoSIljVFNaL2Nrpng3rpzj%2FmI56cwh6MRypJmH2qzWjmjPLKtOrgo2z7HgapY9NgHFcTeV%2Bh0VFnivHhJ%2BC8HOhJDF%2B7%2BmizmfsUcScgxyGMb7nTyFYw8mm6drgOg8aQ9"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 83d24b69fa152bce-FRA
expires: 0

POST
H2 200 bid Show response
ap.lijit.com/rtb/ 94 B
367 B 197ms
69ms XHR
application/json 52.211.25.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.0
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.25.171 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-211-25-171.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 87130acddcd3f7111a368f9345f21bc0a3dad7e606109bee73ca77845aa514b3

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
vary: Accept-Encoding, User-Agent
access-control-allow-methods: GET, POST, DELETE, PUT
content-type: application/json
access-control-allow-origin: https://cybernews.com
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
content-length: 99

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
555 B 264ms
114ms XHR
application/json 89.149.192.65
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.65 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cybernews.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
176 B 73ms
18ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Fri, 29 Dec 2023 13:12:25 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
247 B 41ms
16ms XHR
text/plain 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: c2b259275c9a842b21cc3259b4044f1fb91bd123399ed46cf8b94ca1f09efaea

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://cybernews.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
192 B 83ms
13ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.0&cb=10700857970&lsavail=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
273 B 45ms
10ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

0a25d0c7417603b1901d1a904ba2cec9825677676b052e5a4c83eee9d2e3fd93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac Show response
config.aps.amazon-adsystem.com/configs/ 564 B
831 B 64ms
13ms Script
application/javascript 18.238.243.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-122.ams58.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9dcdd4dff6dab5e556d07cf571e17a19ce4c7dba8a9b657bee0b9e68b6d5b018

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 12:48:29 GMT
via: 1.1 551a3a9c2bf1e2158a9f24897afe2b8c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS58-P1
age: 1436
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 564
x-amz-cf-id: RJANP7inJSfIAKtVGYTcsQKSNYXwPHaifX5iR7RTKkKsVwsW3JMS7w==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 17ms
17ms XHR
application/json 52.84.193.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fcybernews.com&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-215.cdg52.r.cloudfront.net
Software: Server /
Resource Hash: 5f27f2d6fd0d7a35050e1868e67548df87f1c88964ee798f826cca6ea1cd747b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 09:02:31 GMT
via: 1.1 f3a3f62227549dcbb83000c9d8bb826a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG52-P1
age: 14994
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://cybernews.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 3623
x-amz-cf-id: i7Vg-Rw3IXx5J4HgF_xdMUbc0XAlqY6Wdl7XBCQpiLZUu7i4JqVIcg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
461 B 169ms
112ms XHR
text/javascript 18.66.96.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&pid=c6CcqhVM61q1b&cb=0&ws=1600x1200&v=23.1211.1645&t=400&slots=%5B%7B%22sd%22%3A%22cybernews_com_300x600_sidebar_1%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21924397842%2Fcybernews.com_300x600_sidebar_1%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.96.174 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-96-174.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P2
x-amz-rid: FWHPME7RM28GAWQN9P2Y
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://cybernews.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: rZ75ugBEgW9-dJdg41qXmiJTfNzvDgvVjg_vKzGArf8O3w8-CDU6eg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 53ms
16ms XHR
application/javascript 52.84.193.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-215.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 b3c499d6bb51c2f743813fea28eaaf30.cloudfront.net (CloudFront)
date: Fri, 29 Dec 2023 06:56:25 GMT
x-amz-cf-pop: CDG52-P1
age: 24632
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: zwiA5T5t0gocU9dGJvMtxjNgWNe2fuD_pSxk-c79n8ltqobScPCm0w==

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ 251 B
530 B 26ms
8ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

5f3fa4f99264d0da64b7cd7d96d2d5872eb5bb71eecce31c105ebe517e8b6a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Fri, 29 Dec 2023 13:12:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 65ms
7ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Fri, 29 Dec 2023 13:27:26 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 39 KB
12 KB 50ms
7ms Script
text/javascript 65.9.66.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 02:57:25 GMT
content-encoding: gzip
via: 1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 36901
x-amz-server-side-encryption: AES256
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: wq3FZ8Izvc4xhO5lBzJyYTmO0KvqSWp77aEBLqnLUhJ5WfXL3fz40g==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 88ms
50ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ref=&_it=amazon&partner_id=533
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 15:31:45 GMT
server: cloudflare
x-amz-request-id: 01CADRK6PEVBEZB5
age: 6195
etag: W/"13043c1bbaf21ccc6e8ed474a744d3f2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 83d24b6a7d1d4d3a-FRA
x-amz-id-2: flKA/w3j/xi2gJ65jogAIT1IJi47Xyyg7sUYQQ2R7nOR/7B5jvPTNgJSLJ3NwqiCDc6W3Pg1WdM=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 151 KB
33 KB 59ms
21ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12ba93db33de679d443dc28aee4a2190b580b8ad3fc53216d5bb2678d4e17f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: AP83Z9WF86487CE4
age: 562
etag: W/"7229163a9092e2cee472ddee92dcb6ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 83d24b6a7a391d8a-FRA
x-amz-id-2: Kf/JkumjpxQ0H8qSS0a6UOJRUJwGlJJVqYA1mzPdZkGWQg/fvg52A50YxtNa6/OFpxRSQOY+jCk=

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 70ms
13ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "38c0-5e92054540ea5-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 5252
expires: Fri, 29 Dec 2023 13:27:26 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/ 0
239 B 74ms
10ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/sync.php?p=prebid
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 9db1556130a9e92b896eecae836f6a70
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
332 B 110ms
31ms XHR
application/json 52.19.8.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.8.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-8-73.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 0a978e7810a2b2331058fc1146182906222f7db2f4dc54a323c5e7c7ec88810c

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://cybernews.com
cache-control: no-cache
x-server: 10.45.12.64
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ 0
45 B 179ms
29ms Image
text/plain 91.134.110.133
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.133 , France, ASN16276 (OVH, FR),
Reverse DNS: ip133.ip-91-134-110.eu
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:25 GMT
content-length: 0

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 9ms
9ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "c4b6-5e920545406d3-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17042
expires: Fri, 29 Dec 2023 13:27:26 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 98 B
289 B 118ms
117ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=cybernews.com&url=https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9e1fdbe390ca698ec512adb41072b1d72e2ee8417250071cada238a8916ac82

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 83d24b6c4f04996c-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 152ms
107ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=cybernews.com&url=https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cybernews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 83d24b6bae83996c-FRA
content-length: 0
content-type: application/json
date: Fri, 29 Dec 2023 13:12:26 GMT
debug: OPTIONS block
expires: Sat, 28 Dec 2024 13:12:26 GMT
server: cloudflare

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
461 B 85ms
20ms XHR
application/json 2a02:fa8:8806:16::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:fa8:8806:16::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
server: nginx
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
vary: Origin
content-type: application/json
access-control-allow-origin: https://cybernews.com
cache-control: max-age=1800
access-control-allow-credentials: true
content-length: 190
expires: Fri, 29 Dec 2023 13:42:26 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
12 KB 486ms
485ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1748640853219426&correlator=1677857350509445&eid=31079956%2C31080129%2C31079239%2C31065644%2C31068897&output=ldjh&gdfp_req=1&vrg=202312060101&ptt=17&impl=fifs&iu_parts=21924397842%2Ccybernews.com_300x600_sidebar_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&ifi=5&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1703855546172&lmt=1703841910&adxs=1023&adys=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&vis=1&psz=350x20&msz=350x0&fws=516&ohw=350&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=true&dlt=1703855545060&idt=712&prev_scp=amznbid%3D2%26amznp%3D2&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=3686707683&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c47e414ef9aa03cd6322e18dd1470a4d8970ed52f65419a23ebe70aad9301e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12266
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 940E 6 KB
3 KB 76ms
14ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Sat, 28 Dec 2024 13:12:26 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 14ms
10ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
server: Apache
etag: "394d0-60864a57eaadc-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 67550
expires: Fri, 29 Dec 2023 13:27:26 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ 160 KB
55 KB 57ms
54ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a02263cf75c29f80fdb1b381769cd5ba8d13287b4c370eacb3bbd6df56a92912

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56007
x-xss-protection: 0
server: cafe
etag: 5399100907576838485
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2 200 cookie
cm.adform.net/ 43 B
106 B 99ms
25ms Image
image/gif 37.157.2.230
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.230 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 87ms
24ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 30 Dec 2023 13:12:26 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 1A00 9 KB
4 KB 15ms
11ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 54902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 21:57:24 GMT
etag: 5585625838579639069
expires: Thu, 11 Jan 2024 21:57:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 068A 9 KB
4 KB 10ms
7ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 54902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 21:57:24 GMT
etag: 5585625838579639069
expires: Thu, 11 Jan 2024 21:57:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 867A 9 KB
4 KB 9ms
7ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 54902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 21:57:24 GMT
etag: 5585625838579639069
expires: Thu, 11 Jan 2024 21:57:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

204
No Content

/
eu-inap.vap.lijit.com/beacon/prebid-server/ Frame 2A22
Redirect Chain

https://ap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%...
https://eu-inap.vap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_si...

0
0

74ms
20ms

Document
text/plain

216.52.2.48
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-inap.vap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Fri, 29 Dec 2023 13:12:26 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap5ams1

Redirect headers

content-length: 110
content-type: text/html
date: Fri, 29 Dec 2023 13:12:26 GMT
location: https://eu-inap.vap.lijit.com:443/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
server: awselb/2.0

GET
H2 200 533 Show response
a.ad.gt/api/v1/u/matches/ 12 KB
4 KB 68ms
20ms Script
application/javascript 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0535e45b39cb532f33acf0b536ab12156a1eac193f11cef1133b12989f358a44

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 29 Dec 2023 13:11:33 GMT
server: cloudflare
age: 53
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 83d24b6d7c556ab8-FRA

GET
H2 200 css2
fonts.googleapis.com/ Frame 1A00 4 KB
1 KB 52ms
24ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 29 Dec 2023 11:52:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1A00 205 B
651 B 42ms
12ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 05:09:21 GMT
x-content-type-options: nosniff
age: 115385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 27 Dec 2024 05:09:21 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1A00 604 B
696 B 42ms
13ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 01:15:38 GMT
x-content-type-options: nosniff
age: 129408
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 27 Dec 2024 01:15:38 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 1A00 16 KB
7 KB 40ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 03:25:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6766
x-xss-protection: 0
server: cafe
etag: 14924840246271906451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 12 Jan 2024 03:25:40 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 1A00 22 KB
9 KB 37ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 02:25:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38810
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9210
x-xss-protection: 0
server: cafe
etag: 13914886398874665762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 12 Jan 2024 02:25:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2FE0 624 B
242 B 57ms
52ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNUIVxvpRCJGwx28fZX8DUx61We76ZSNLEYmj2Q0a9gg8s34QcOWS5P-Py1B2HCSABQhFKRkBwa_IuYrF31CoaTLHg3yeiht6qXw_Iwv3LyZeRwmakU-E9LnPCS7Hmn_xlcIAMXav7tZdcQMEh1MHRxPpZR__lushFk8VdZA7Ws3v44u1ug

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2511 89 KB
31 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 2511
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1676726/76805677/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014932963&ias_pubId=pub-5928161074779380&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

43 B
482 B

29ms
8ms

Image
image/gif

2600:9000:223f:bc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:223f:bc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:29:44 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 1539763
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: k10UkNwwGN_JEXIZ1MeCBcjeHlteYWZ0-QHAidJejWDOftUYhbih2Q==

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: nginx
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 2511 3 KB
1 KB 30ms
15ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 2511 20 KB
8 KB 24ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2511 0
0 18ms
14ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTZOgV9C8_U-xOKiiHzD1IgP8ogiXbIx4M_NJ-sLY-7WzNAcg-pMx-sOeEpZbcYwvFazJz35pKC-TXiyOX_ZDARm6YQIg
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2511 203 KB
65 KB 86ms
49ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2511 42 B
63 B 42ms
40ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CbvAadiPB9ipeEMisgAqOBOVo9muHvCbYWWtQgWJsZJkHSZudzrwhSxd4tbZ5yAR5QP6I311hpzXGdO8BFc5Cd6E2zEwAZ_8a8npTekvsrg2N-hnU

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 372E 640 B
262 B 62ms
55ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNWgd06SuwzGggajPnq_dXKpkyIEvrON6DmGuMlC_6U9TY1WR2phPQUYH7cP6pYEa7o1odhFPwXMpESMEbAWhLPdMdqTiRsOX9Uz9t99FQ0FDQHkXqUKDDMuTBNJAcBu1b5nL1O1BdQeWtBTSyNoQdJ1MMV2VUD1lPlFqOoS_5INvK9gFIw

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5CE2 89 KB
31 KB 156ms
146ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 5CE2
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1676726/76805677/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014932963&ias_pubId=pub-5928161074779380&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

43 B
484 B

59ms
7ms

Image
image/gif

2600:9000:223f:bc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:223f:bc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:29:44 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 1539763
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: Sjgazp9YYsesmlnPQdy6b6lJ1bRjDsCZRZuvdwtSBZyQNVKj7m-OXw==

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: nginx
x-server-name: app02.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5CE2 3 KB
1 KB 19ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 5CE2 20 KB
8 KB 18ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5CE2 0
0 25ms
15ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR1bQgytlg7idoWWpMvkB0NqIFX_um1bSxEt2wV7wpXF25_0Ae__MrR4L6U9JMeMwOY9XFdI19GCSyvbC4QPgQoKC0S3w
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5CE2 203 KB
64 KB 110ms
100ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CE2 42 B
63 B 54ms
46ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C4Pv7M5FlU4Ya64tYe7WOoDFPstOM8jviNrDUBL5nR70Xx_nUgt50dUBJVThhX1Hqk3xsCb9gutmhfMN14ieZirFsHVespLJ0iovKYBRF8EqynEoY

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 61ms
22ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ed3dc50aa8e28ea856d113dfbd2bd12dbb09ceb4381f2bdf8dba7b14b2a00108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 07 Nov 2023 09:08:30 GMT
server: nginx
etag: W/"6549fe8e-17704"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 30 Dec 2023 13:12:26 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0CE6 14 KB
1 KB 22ms
20ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 29 Dec 2023 12:14:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 0CE6 2 KB
822 B 16ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 0CE6 23 KB
9 KB 22ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F21A 143 B
166 B 22ms
16ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2042
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 12:38:24 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 0CE6 3 KB
1 KB 21ms
15ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1F63 1 KB
643 B 22ms
15ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 0CE6 20 KB
8 KB 20ms
15ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0CE6 0
0 31ms
26ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ29fIvcYjw8hDLAtVGrQS7Tmkbn3kJjihTauQ44L-GgFhTGLz0Nsg1qMDwumfwgKbavU-DWXs9q__k0wpHZWnKa8DP_w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0CE6 203 KB
64 KB 69ms
64ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 0CE6 37 KB
15 KB 14ms
10ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187133
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 26 Mar 2024 09:13:33 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 2FE0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENbez_6FOKTFCDhyrdvDqVc&google_cver=1

43 B
344 B

33ms
31ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENbez_6FOKTFCDhyrdvDqVc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNUIVxvpRCJGwx28fZX8DUx61We76ZSNLEYmj2Q0a9gg8s34QcOWS5P-Py1B2HCSABQhFKRkBwa_IuYrF31CoaTLHg3yeiht6qXw_Iwv3LyZeRwmakU-E9LnPCS7Hmn_xlcIAMXav7tZdcQMEh1MHRxPpZR__lushFk8VdZA7Ws3v44u1ug
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4PC5C%2FUPMkQ4%2BjGKdarWiIGfBjfjGc0HZHIb2PO8yrDZxZyRZAZD3EhkVMWi39j8QH4IW%2F3Aqq0CJ%2FQAp%2F1i7%2FX8%2BXLG8ttf2rYhLMb69NClrzxTLuPwfF9qAnDbqZPpvi2Cmpna4crsrg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83d24b6e8e9337e8-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENbez_6FOKTFCDhyrdvDqVc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2FE0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZY7Fuq.H01XNiRQipO7OIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2

43 B
767 B

49ms
48ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNUIVxvpRCJGwx28fZX8DUx61We76ZSNLEYmj2Q0a9gg8s34QcOWS5P-Py1B2HCSABQhFKRkBwa_IuYrF31CoaTLHg3yeiht6qXw_Iwv3LyZeRwmakU-E9LnPCS7Hmn_xlcIAMXav7tZdcQMEh1MHRxPpZR__lushFk8VdZA7Ws3v44u1ug
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yRaORDU5vFumJf81tcFX5sxUBlnUZITW47wJnMY6nkJQkyQecquvyA%2BftctCFdazgIasXEKF28PSp1uyW2jZtje8%2BupOtAOpjCPfUgS0NBXNuHe0gAtAzvQ6imgOapl%2FayPkQ9BdKuzhLA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83d24b6f5eb9bba7-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 2FE0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELGZ7mFVx2P22tZSG1rbLZQ&google_cver=1

43 B
845 B

29ms
26ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELGZ7mFVx2P22tZSG1rbLZQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNUIVxvpRCJGwx28fZX8DUx61We76ZSNLEYmj2Q0a9gg8s34QcOWS5P-Py1B2HCSABQhFKRkBwa_IuYrF31CoaTLHg3yeiht6qXw_Iwv3LyZeRwmakU-E9LnPCS7Hmn_xlcIAMXav7tZdcQMEh1MHRxPpZR__lushFk8VdZA7Ws3v44u1ug

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
an-x-request-uuid: fc25eabb-ead2-46c9-af6f-b0eae413a47a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.204; 80.255.10.204; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELGZ7mFVx2P22tZSG1rbLZQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2FE0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

170 B
188 B

22ms
18ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
an-x-request-uuid: ad22b911-26c6-4517-a08f-1875f3ef1372
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D
x-proxy-origin: 80.255.10.204; 80.255.10.204; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 9C3A 3 KB
1 KB 19ms
11ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 9C3A 20 KB
8 KB 19ms
11ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9C3A 0
0 23ms
15ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTdp3IlDzaNPBxcURi1b8LGdi196JX0Db0GTkoA9HTRvyfGTvXxHrFmcK7cU8k6XrTK2Sf_S4-a39PR6CPBX3X1pBzSvA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9C3A 203 KB
64 KB 88ms
75ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 9B73 142 KB
49 KB 94ms
60ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZY7FuQALi_kABgOfAA6UO7cuZcTPFi9UzLTqBw&u=%7Ct8l7H%2BRql1EhEZF71vlhWRPpJyXFqAAeufOa2iBw8Kg%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANYT9K_uaNZ3Vi0Kkb4z3i7fRyL_Mqtc5pOXSiYA3i5Xe7tMaGYEwKtA-5YGagwwngD2j9vrDfUv2WZlGvRlxeD-5vGanu-3PdjH9Khouubg09e16cuFJY-hyZ3AH5lMlqwxWmGw_E6LyokrNeiKVYPczqXW1_0bVZj3kkoo6atAfZ7PUDlcGdL9-FAmoLRLsdNW16OEo1Ker4zBfL8c9yedPuJqEkOR49ib2-RdOaO0fV-Q3nGv3L4jJoX7FfArYA6Isw9EzT9JcoGYfVAigBuiVTtQfx91UqNPntq5dfAic5mGZxOxaQqo6aTbwaKnEDinzSi8pgMxKDaSfLWGF2ns_oktwhxWkR2l4irnezC80R_ZkySpeBUf_Y5Br-n_GcV6KmNP13RoTIeSR5KZpvEXGkIt1ovdiD3scMmlqgNfOawulZZ1DaHaT3AJw4NE9UGCiU3Za5lfvi5tbsE77ZhE99pG_wBw-8VABqN-ThJVZOkjUeZNfLgze0fuRrDe5pjuYmToBtr94-CmKzfNWSQ1qBXVZnztAUZfw8U7Hh5WFNdytlcJ0Eco&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCbZRNucWOZfmXLp-HmLAPu6i60AfJntKxXPXqoYaIAcCNtwEQASAAYJWSn4KwB4IBF2NhLXB1Yi01OTI4MTYxMDc0Nzc5MzgwyAEJqQKONn5tfo2yPqgDAcgDAqoEpgJP0KyQLuz9ilKMiXdJyI6du2qgehOipstObb7tCl_uqxuSJ8qHL5BraOZD1ba5dxD-rJIVuTh06FkBVXHRaWnPrFf4WQ4goJQNDrkOZB250GQTw4lWEpbMMk4y8txjubeigs3BGsJJu_ftJPvbqIiBO_H5Pw_Rv6xtW5q4TTmYx25gs4gx6mSMaVmOL439O66g30LglAY69Hm3TOrAadL32Tk8rfl8PJevC3PCz00Yy-yb_S5q7I8t49DAYPYqKobxid6fvkEvnXADbypxMnl6-HDu5byao5zwg13JpQYJssUaTFE_3wcyRQcC4I_48_0mUBcoJhIZhYv6uuPNVatIk6L9MY6o84848CJFTRNTBEJB7A9uE7iDX481nxBV4SiFXwkatQyABrmJku6v4baIQ6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAEBABMgKqAjoCgEBIvf3BOliWl7bE3LSDA_oLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1qjAnyhdmhPpBSB39AV-kpNYmdug%26client%3Dca-pub-5928161074779380%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

eefc94e76ca068ffacf7ba105979c84915f11564cbaf7bc23e866c2301bc9232

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=c4dwsAuaHaHt3v9f2xCVjjDB85WNhh2yyMB7Rtf7sUx4iMYcVxZxeqR6ef7NvPgYegkFfsaLEHAX8LvxORbiCCjenykjoSVEemsTU4fQrNXRTGp5xYveZ_R_Ldz8wb9Dl-ZZ36TN91O_3Ryfgit-PvcD_YHZjPFuo0XPqVHQyz9old1lVpwtsLMArhb6KGew7_N23WNrXZ43RUbe_oWaDSlSB1ic0201Pw2ijxXl6DJMzKop8BIRA__Sc6M"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 46364842
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 85C0 1 KB
643 B 11ms
7ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 372E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENEDMi2CFFJ6K-ScQbR2n2A&google_cver=1

43 B
105 B

19ms
16ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENEDMi2CFFJ6K-ScQbR2n2A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNWgd06SuwzGggajPnq_dXKpkyIEvrON6DmGuMlC_6U9TY1WR2phPQUYH7cP6pYEa7o1odhFPwXMpESMEbAWhLPdMdqTiRsOX9Uz9t99FQ0FDQHkXqUKDDMuTBNJAcBu1b5nL1O1BdQeWtBTSyNoQdJ1MMV2VUD1lPlFqOoS_5INvK9gFIw
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENEDMi2CFFJ6K-ScQbR2n2A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 372E 43 B
295 B 46ms
18ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNWgd06SuwzGggajPnq_dXKpkyIEvrON6DmGuMlC_6U9TY1WR2phPQUYH7cP6pYEa7o1odhFPwXMpESMEbAWhLPdMdqTiRsOX9Uz9t99FQ0FDQHkXqUKDDMuTBNJAcBu1b5nL1O1BdQeWtBTSyNoQdJ1MMV2VUD1lPlFqOoS_5INvK9gFIw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 372E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEMsxJdB9za0AJwWk_UB0emg&google_cver=1

23 B
163 B

234ms
37ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEMsxJdB9za0AJwWk_UB0emg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNWgd06SuwzGggajPnq_dXKpkyIEvrON6DmGuMlC_6U9TY1WR2phPQUYH7cP6pYEa7o1odhFPwXMpESMEbAWhLPdMdqTiRsOX9Uz9t99FQ0FDQHkXqUKDDMuTBNJAcBu1b5nL1O1BdQeWtBTSyNoQdJ1MMV2VUD1lPlFqOoS_5INvK9gFIw
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 29 Dec 2023 13:12:26 GMT
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEMsxJdB9za0AJwWk_UB0emg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 372E 23 B
163 B 268ms
38ms Image
image/gif 23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbTh_8BMAE&v=APEucNWgd06SuwzGggajPnq_dXKpkyIEvrON6DmGuMlC_6U9TY1WR2phPQUYH7cP6pYEa7o1odhFPwXMpESMEbAWhLPdMdqTiRsOX9Uz9t99FQ0FDQHkXqUKDDMuTBNJAcBu1b5nL1O1BdQeWtBTSyNoQdJ1MMV2VUD1lPlFqOoS_5INvK9gFIw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 29 Dec 2023 13:12:26 GMT
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2511 0
20 B 47ms
46ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1490921763548&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2511 0
20 B 43ms
41ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1490921763548&version=m202309260101&ct=76&x=1&cor=4642841225209699000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2511 93 KB
38 KB 70ms
65ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZL06dFdIWxkYsXKFPGTNnFVIO6F8BCeBfP-dKXC8ciHmXeP5kK8gTezB8gMZTH_oiwH-fk67ZsqGpRGSB_y0Uuu_p5JPq_EkdLiJDIgGtL8sXzYIbvwyjSTAYfysOCMjTOfCFfIfOBL9znfk1E0LEUntzIJ_Gy3TBSNmttYpfmsiHJbU&dbm_d=AKAmf-CmTTsss7lg7t33HTInYGh2sv2ADLnofFoSlkngdXXhqV4LVgpS8u18C6haBo9aVrM8qpfzNjsKoNKtL6G2mFZlkPZrcR0XdHDYPkNMArfCAgoJpI8AnnMfLNZLhXnqzV2bSrjsVkB7tctfilqZuSGdMMSqOQCn2UHo-Ai56clOf2YhhnNYlVnYMMbGH_ZwsFz0vR94sLFzggeIi9TiZzlAQR4nEC83YfhUW_CY_R-cdD4bLLXNZUS0PQ35p_-O9jBpyXcbO-UoVnqzvR1hObbWU6yqwC115a55x-okiOAAgnzTKqdb_TilGOgI9zJv_T_JFavz3HycyyK5nidL9YE61qlFB6BrEn826PEYCvSei4TZakoGalcWJ6s7MTIavr3fS5-A0xQXiZ9IWGAOkWZwXssUFEIPVLmN99K2oMbxo-NQXGxdL131vvnoLM2d0-3gmYBIL-GsXQQ-H4ov6BSCxmcV6X0krIluzcFot8ZnxcFhQ8Au0K4znoK4AZrjWtMSKSbjr2im0XjTov4PdzTPwgaT2YtXAWmQUDG2xYx1sQhH_KTZcTTLPdDMmz3HX9PtdUnIplQIQSlVhBIMlRQosp_ch891qFOeN2v_qVl2NvNYhrMY2yvnmET5_4uwcE4etROoM7kWPaYQeoh2Cs1TQJVRQJi2oxmlEe77lKaLpMlBUERLEo-I_jzcujAMJq3s4Gbi5oVyMCP8i9hB_Uelc8FwxMO5EipbQ2NsHa8_hL5pXICz0R1BjVNCTEM3DNVRQoNMRHEQCF_NpXpcEmQAzbc1dk2k72YoTRlbDDDfM7XgD2EhXiJkaNKCPGc5UfQea39XtpJL5BKs1UnSSy6tRaK5JP3teBjwXq1NTk0tVwzDV5MCQRaQw0ACdxWS3rXqdOKnpCZY9frWMUCu4185-TEwW6cJxVmFCmqsCctFUWO9cBN7xyMKc897fa7-CLV7UHcpBiCU1FWNM7Mj07rXWM6ePngYQZ5x_K2Z3mNlQDTTySrruxRzWJww4mCWwogUVUZIC3BsnPxar7MHdqVIFUqHaOKRD7-3f3snQY-0C2I_2OEgnZGjxNokEsuTamIVYqBxbwWWOvq6vB3bgvkhKUwivqso_7szj_WIaA-QlhDe0Tdx__9wSngpUCo_t47vwmerIzFWMYWC71IO4HtZry3i2GwWfQ-Nu0tXaTJl819e8MUG1-dk2BNmBVZQk5eqMH6te-kbspAvMyWp0uYlCLO5QdNJTo3pyfwQlvR0XJUIRQeE_ysVk4TI7RO5CeMyhcqM3lG_sM43HIVEd-c4T4L5hqxSSC-E6nqPRguIXvz1W4KcyWHicj6a2nSuIdaZlLw6X7BaQNDrnhnNV6XxjVMA49fULhMVybtBbiEUsIszxz-9DGRlhzrbrR9i8Sp4WI7RAKX3YeUigINJtOHXvoDmxrNhjZ0lpBk00w_gpFSQhXy2TS3lSfFZFVkHICyQcmPVBewa5khG5U_jAzGEybjBg_T-huErjKb1J-1mykanqLDBjIJs2uQmgsEcGgmqhiR_g-cM-0cQihZEBISJ4zIQfTxxY0c1Z1gCm2vyvXwSAxQd7PiLnnjyvVcwOEa7iH9OvdtlzjD8TW16-5SySXIyHbJ2RYHeH7Ta2hxACLkK1qyESNutGPXrZ6NPh3jGVboJvIw3eA5KshT6EX24X84JQK6DIW1E0KjAEysNz0tBJ8pbyL4prkXwL6E_kpfa2f7cap4_XRe3GtmZfgGEA-i-k1rV-Wqu5rAKDis_6omT0pk_8n6c_VCp6VTw3C2higlw_W0-qK22DzflSm7EGt3MsAQ6oGNry5FtpT9ZXm6leo61NdjCNEOOjf2_4Wg-mxIbPmKUWvA-wtYNTF5UTYPdbDiRu3r9epYqChifYVnvp6_oEyxqRTGxZygJ-ymqJhPSx8QOzKam4l7QSIn8fj6uhQtxmm7VywCyq0wGzafOYkFcTsOFVHOEctdei4HhW_SQueDA_w-jH54X-yq4tvf-q5iP4NZGKxuhNviVRIsW48iK5McK7OlPyC5VpoHY3_M_tg2wwALWcNISSEamW7b-77b_0IFchIfjXyTaJN1l9-VHr0NuJuckO6PTbqZN9McwPwAMinDajkt0xijmxJDT6YnY9PrtWoGddW4D5B6VsvpMveDtan84tXTzczFl8rgIpLIUHwjljc_wm7W0Apm43FSXL7DSJSSG33blP9YdphKttdTfrDNDWDYCvHH9C5qc0O_7cY4VB3MGzYXLEYEvteVhxqCh84lwPDDR7ync2L22mtu6DQ0ZWCrE36TNjgpvq3wSczN-hRvYcJ1krsaVZQHC8_edmAZk52ODjUdMCIiqQjuD6kqAQFkR3CEelKtMoE2XLQBBYXvmNwLogj6QjxjOYjsIGGcGJeJSpny73W580aX6wZEBUIszQlf0K5AQJfWsjUA2RQCIegs7englRBZrXtQkqisrfJ0I2VV_IJhygFEIqO2_kle9Us69VE3HT_z6B-dVt1WDISyzePhXywDcYUuuCqBhAGjyGk1BhXo7fLJEqKWBQMGi3kWp1T9Z5xu3rYMqDriIdQtHu63CKFoM7_KrEPjn_vFUUEicsCpYgfnEuGslcucJhY3xlnQ0FqYxBs4_uXGVscEbtqyb8KS6cEObo4qRenDat_hNDKsaLre6sBGasTgBPPPH0GUMtm-GR2yh9k4hnYR0O_uFd5vJNIXUcFAha7m4D3bblf5a2OKSv7MP9aCFp55aEKsEm2Wi6Q1NizSm_aoOVnCnDmMRPQvRkYYFsmQSQqN_8QBKZxpbfUqZuuH3bmLfA4NQlzSORvrSgN00IHoBr07Ow9VTu1itx4-QLeBLDeNZy_Fldw6JCxYXJ8ae3eev6sBKGcnOXDicp3vnxTUavIrrz9lL0x7-EH1vPRupeQ6cK8ldOleJw2_EkYdaIGbS7KQ9Z2ZpJVOFg1PcRDc7rAYLwALXcSGsCUSROqqh2tkUpWEYkPzArojmTmRAC3TecIG5m4INQkJnYMOyy9QbAuQoLMVmtvNHohf2WhyTz44F4Ljs0z2KG8Ilfa8L8nUESBCDrD0bHIbg1M3UZZe--uraZaoKrec-4XZ3bEZOAOwUA31z2mMmfafZb1VgVMVe_lY3u6nFHQquoWwwOAA-G6pMrzrLvKvNnMz-fOoQa9qKOAc8NkWoYk6ou4SRCDjfvJdfhgxVOYh_Pqaa2IgZzS1odcnmpYwbJfY-acWOc6qjAadSb6IVZakqmChnJb6mWmUet-SAPXNg7EfPAPONp71TL0qlQJ5dLQ6q-u1OuiuXjfmB_mWGP0zQNd-DdTLGMIBlAJsw9zFQIMMqdqsxaindtvOgWTv0SBrSR8f5yYwTuP44yPzNpufm63Lgt5lUB7LRKVCN2gJWie_BytAbaMwg6axhIlgUOIGjmLMtAz3lvX-yh39K2hY9usdDQVXIdhpn95JURjvvXjWU_9DOJMf9j6Mhy8Cef3ZGKbF7VjXthXvcU6VAlhxH7tfuFucYy97ZqbXc6XSKein5K0oO9LR8PncdcWV_RX74NnF3KRmeOrN_DBxKRzgoNwSvIIQ-gkQ0_uEOA5XTU3ZzaMqPr7Xpt3B-cYWZxWh7QwXUlTG5QLyFpn4MXUHe5IeHqzpu4qd5L35r54hXTL2CVyIPN4GxSIK9h49oiqTMHGXpgbNUfJaa9QwKVn14bGXG09p4S-37_Dg1TPqa67KGVWxgjRyix6VcXW3omxlSiQkfY79JCwPH1RHoXQs2c8pPjr01HudjLce0DpgaRAuj5Wa9OOSYC-tA9-fDGxU_sghgSwLj1pbIjzewKr3ocUUIrH7iWQveW9Q3aGoylgKIF5Ds_Dlyh1U533J7JidFEkmDEkDyjLcQbe22V9PZAhGCOcMZkmrB&cid=CAQSOwAvHhf_YRexfSYGd4SnWgkhRG9ifT_LCNBpVDKlXfYrdlIww9DYiIVK_SX7A8-EHSoLp4Lp6WaetLzcGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=4642841225209699000&adk=929882888&idt=87&cac=0&dtd=40

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750f058f429cdca153868ade975e38c15e73c605d834d51bbfb1359841ebe665

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39175
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 1F63
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOxm1R5kpQJFgmR3uWNo0NI&google_cver=1&google_push=AXcoOmRzzcJMnrIvBMT9KPYteDUfiIodYcNHjfBzejXSBaLmLbHix6md2KcP6VC5Y5DQXRLoiWWi0qCRPiLbj4IQb6XfL_g2UYSyv7Vk
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjUzMjI5MDczMzY5NjIzNjIyNQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBPebgPX9Txj5qnNYVXLizs&google_cver=1

43 B
398 B

86ms
19ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBPebgPX9Txj5qnNYVXLizs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBPebgPX9Txj5qnNYVXLizs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 1F63
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8Et...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8...

43 B
416 B

190ms
181ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b74aa9439f1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 427
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmRWRjf54-X0xjY4LrQ37-T5d4Ddeu5AeRHE5mdr768ScCNnTjwGkLh5mSH9LysRrldS6UDWx9XyVH9vFA2_YH858Us5FJ8EtzkE%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b702d0839f1-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F63
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEC-b91LyQ0ZsYBa9kX-rBjg&google_cver=1&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClw...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClwJV4qBaBWF892zLvQW7aWe&google_hm=zPtDdVFWRSmy2Ztc...

170 B
188 B

41ms
32ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClwJV4qBaBWF892zLvQW7aWe&google_hm=zPtDdVFWRSmy2ZtcHIukPsw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRmJZLAPnAsu3p1oYYPp6C1ri2G4FsdPh-sTVUWMY_NSt0X5iHLj8elRHsnOL5vs5UAEy3Pb9MSClwJV4qBaBWF892zLvQW7aWe&google_hm=zPtDdVFWRSmy2ZtcHIukPsw
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F63
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEL-3u6-whoWHhW3WzrvGi_0&google_cver=1&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=3tVxNDrAQdcSr5XAEZyU0A&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s6WYKqQB_5m6QIHNR

170 B
188 B

43ms
33ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=3tVxNDrAQdcSr5XAEZyU0A&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s6WYKqQB_5m6QIHNR

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:26 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=3tVxNDrAQdcSr5XAEZyU0A&google_push=AXcoOmRAqBHXWNcL7eVBSKxclFG5i-tpZi1aSZKVbiu4rKTZnI-x_QOwj16Cu0j831RkMGY1d23LwtF9hlfjF89s6WYKqQB_5m6QIHNR
x-host: tde-deliveryengine-production-59dc4ccdb-v7fwh
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F63
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJCdtxcSMwnzsrHLimO4738&google_cver=1&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-Z...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-ZMsqKxdnoT&google_hm=eS05TVNlLnB4RTJwSG...

170 B
188 B

21ms
20ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-ZMsqKxdnoT&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT9W2TPVNaD3Eg7d-X5W4xYfXpKnUDkT93Y8oW_QatoJP7Duc6dUuBWE11uViHaCAzl6wXjTyNAZisALw4NHi5xT-ZMsqKxdnoT&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 1F63 43 B
363 B 253ms
13ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSqew8mnDwnNFVZUm6Xi25lTMb7iNR7z74vJtkak-vlp-4ZmBA-dzIA0sRvqPx3q1y8SLTvFynjm_Y_q3emRNlv25DVp7acFOIV&google_gid=CAESEFRXELtIT7MZyHUIyXUU7SY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 274857
expires: Fri, 29 Dec 2023 00:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame 1F63
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEM2UBIRRKcgy...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmRW1TFFDrAPazivstvEu7DFTmNEEojiZJBX4SVRnF7vUFGN7jHss6dx1JSM0A5ve5Ooj1cXvvtLakMwPexN4mHBBryaFznb6A9-EQ
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

37ms
36ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 29 Dec 2023 13:12:27 GMT
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1F63 0
12 B 22ms
19ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JeXVPMoNp3iRKc-5MZSAda5K5zHh9GwnNbKCcocbB9j6dDQKAX2CUXIpGgYL8LxdIAQEesqg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F21A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

35ms
32ms

Document
text/html

2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Fri, 29 Dec 2023 13:12:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 9B73 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZY7FuQALi_kABgOfAA6UO7cuZcTPFi9UzLTqBw&u=%7Ct8l7H%2BRql1EhEZF71vlhWRPpJyXFqAAeufOa2iBw8Kg%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANYT9K_uaNZ3Vi0Kkb4z3i7fRyL_Mqtc5pOXSiYA3i5Xe7tMaGYEwKtA-5YGagwwngD2j9vrDfUv2WZlGvRlxeD-5vGanu-3PdjH9Khouubg09e16cuFJY-hyZ3AH5lMlqwxWmGw_E6LyokrNeiKVYPczqXW1_0bVZj3kkoo6atAfZ7PUDlcGdL9-FAmoLRLsdNW16OEo1Ker4zBfL8c9yedPuJqEkOR49ib2-RdOaO0fV-Q3nGv3L4jJoX7FfArYA6Isw9EzT9JcoGYfVAigBuiVTtQfx91UqNPntq5dfAic5mGZxOxaQqo6aTbwaKnEDinzSi8pgMxKDaSfLWGF2ns_oktwhxWkR2l4irnezC80R_ZkySpeBUf_Y5Br-n_GcV6KmNP13RoTIeSR5KZpvEXGkIt1ovdiD3scMmlqgNfOawulZZ1DaHaT3AJw4NE9UGCiU3Za5lfvi5tbsE77ZhE99pG_wBw-8VABqN-ThJVZOkjUeZNfLgze0fuRrDe5pjuYmToBtr94-CmKzfNWSQ1qBXVZnztAUZfw8U7Hh5WFNdytlcJ0Eco&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCbZRNucWOZfmXLp-HmLAPu6i60AfJntKxXPXqoYaIAcCNtwEQASAAYJWSn4KwB4IBF2NhLXB1Yi01OTI4MTYxMDc0Nzc5MzgwyAEJqQKONn5tfo2yPqgDAcgDAqoEpgJP0KyQLuz9ilKMiXdJyI6du2qgehOipstObb7tCl_uqxuSJ8qHL5BraOZD1ba5dxD-rJIVuTh06FkBVXHRaWnPrFf4WQ4goJQNDrkOZB250GQTw4lWEpbMMk4y8txjubeigs3BGsJJu_ftJPvbqIiBO_H5Pw_Rv6xtW5q4TTmYx25gs4gx6mSMaVmOL439O66g30LglAY69Hm3TOrAadL32Tk8rfl8PJevC3PCz00Yy-yb_S5q7I8t49DAYPYqKobxid6fvkEvnXADbypxMnl6-HDu5byao5zwg13JpQYJssUaTFE_3wcyRQcC4I_48_0mUBcoJhIZhYv6uuPNVatIk6L9MY6o84848CJFTRNTBEJB7A9uE7iDX481nxBV4SiFXwkatQyABrmJku6v4baIQ6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAEBABMgKqAjoCgEBIvf3BOliWl7bE3LSDA_oLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1qjAnyhdmhPpBSB39AV-kpNYmdug%26client%3Dca-pub-5928161074779380%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 9B73 2 KB
1 KB 14ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 9B73 308 B
636 B 25ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 9B73 293 B
621 B 24ms
12ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 9B73 43 B
348 B 145ms
14ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=J0Mh2mmM3SGaLLVP2QNRFiy30BGJBdqMp7CqksLKxoYJVm_Qmhq8DQZtUFBWSBvz_vt5qkVH3vqFeXKdA8zhq8-rPn3OlaHhZXUCOGbdbxwwB-NlmU-bKZdlJK_S_GTHb7X7iv2gDEtQ3RaCXn2wK72ojAtGVyHeNgvPqYfmI-w9thry8PN01IcV3aTN-W7I7VvomHzBZpPfiPeu4pM3dlitaeYKLdKv-WU0iLdSvHnskzsdnd_ZAl3gQpxYGfY0Yk5exE2YSEOlFhv80ce6fiu02K0rJp11vCpiXrIrVIoLgTKJemlEsAiL91dOIgDxsAYJy7phAFBRf1VCXhh7XOhUqn_sfhBXztPadild7qZfiQMWl-rXq8wOL_TUJG7GsyvXYU672Vort9NgkyJAiQ3cRrzkwB9v3_Belo3_2od10IqW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1566862
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 13372690441990075534
tpc.googlesyndication.com/simgad/ Frame D0F8 13 KB
13 KB 13ms
12ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13372690441990075534?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkg5nDSqjytYH43TrjrSMh6AU2iTw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7001aa31edc81d71e20def817d897da52a75362e3f390b3689071e26a7f92b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 23:03:12 GMT
x-content-type-options: nosniff
age: 310154
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13537
x-xss-protection: 0
last-modified: Wed, 20 Sep 2023 13:59:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 24 Dec 2024 23:03:12 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame D0F8 23 KB
9 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D0F8 3 KB
1 KB 29ms
20ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56556
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame D0F8 67 B
91 B 19ms
18ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 04:10:08 GMT
x-content-type-options: nosniff
server: cafe
age: 32538
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67
x-xss-protection: 0
expires: Sat, 30 Dec 2023 04:10:08 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D0F8 20 KB
8 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D0F8 0
0 19ms
17ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRtx1OpUZGTegNyycHk_F1_uGm2bI2QYDg5TnGo4knUPD3ao26ZxfburqA1GLfDg6AgQ2arMg9N3U0xBIpSsRNEBHk_HQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D0F8 203 KB
64 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:26 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D0F8 36 KB
14 KB 30ms
22ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17c51c572c7349afeef2bfedcad431c67244f4a82654b5b8002511fc14346d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 13:49:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14812
x-xss-protection: 0
server: cafe
etag: 15202890134401013038
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 13:49:15 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CE2 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2054797750633&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CE2 0
20 B 44ms
44ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2054797750633&version=m202309260101&ct=76&x=1&cor=15914908870091348000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5CE2 93 KB
39 KB 58ms
55ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWoXR3hEYlQIEjFqOVMbSUe2UI3IYKGO3OcEmKHHogMwIaZfw0Oe92LFu096WM5Exo1rCp9zizgoQn7l4_0n-lp10A9yi0qtrwZ0sesKOe79Urwi32TNT2c5sepLBDxX0yCBEGRDsQArUerANUz6OJhzjKBIkjjdi0P6p5NRqUrLn5jHQ&dbm_d=AKAmf-DMmPxwKjVlOjzeuwxbGQCRCppysfFDkWl04IbC4GaUT1PZvDo0Dy07A_S098h2jzRPnkMX0TTO4kvmpJHCS-7OXg8x7czmaPBR78Ug1Hf-gucGReo9w_nTnmyi4t6UjOCvDMqb1dizx774JuHwCBVPVv3y-YK72HL-iU0TP3f5HEHr1egrWcQ3aXDUCF0KC7Z6p1c-ol4UwBUkjEN-w6U-Fes_d_Lvt6Th0wDieF4m_Y-GaiCkFFnZnt2I3snk-R-KOqRKt3jVucdo6M6e4tHGd46W7zOJwtvvwvorVYBSyErVBshY4VgnKjp1qszIgAHGmzQUnD-8_xP8OXuKjMq0-tZkxEjkeZCxFnwYm9XoDR7O2ZZQVTmVvcROeZPMa3a0tZGplyDiQUO6rIaUrnpkw3KZwwPgSJezE6GbnXySAs8TC9ZF4Qq7ARvOaCuMT1GOV6p_HSTQEiD8JIjIV0XRIysnTHKjqevhxtnJSJE8gjYxDzvUIZTAfzbfXl4OZNNMeWwD4vCTrxFQGoPD1Vhifkn2yRjobzicN5253TUmtm3MKE3IZtahbE2kVgXyEoj9PmDX84X9m_D3m2MNBF5x5IXyYuh9ExQSW0GheCNVKyvG47-K9DFGXL0Q4Q6eEnB5uczL4S-6V8dpxW9oiLqtCMWbpf9RIooJMZmDX-K3J6exhIAhnQ_l_jkhpP7OdUPWWK4Z02DoKAiwS1MNr7jIgFsbO2TZkCipbHCwcQL5lYmHN49PqSRjc8-1VYhYtIUgspL5s0kPkn-C47QRnsWsqE8hmcd8OD--8ezHmLts0Ia2vnaEa5Buq6j_me8ofCI6O8lVhMS4bMG5JaEXq1ojK5Oxbzy4mRCMmGpKMJj4VtPojFQfH2tBd4xS3fRe5obox3M0nLMQplSbRZAIothvKquYaIem2CLw9Fw1-SWdHy4NV5pNVO4N1I3oQDJ-33EuLsHw31QbNNm2cDpGc-do5Soyp_wkw5FH4zG2ZicMH9COeYsk9FzSBjhS-8_aO2gHphgaTEgPVhfrP63F1IEkqHeYxwfLlX6ObkeUi_ZTg5DpL4Dq8pZ4xblFdPvU8UIG8acYAGdqq-xFZIAhfFvv0vGbPyNo-DZqpvbT2KiH_D2N8hwLyGDrejfzWUdzGIeJ5lXVwjyinCd0z1joPV7dbSJ9Ez7Q5sKheuId7hreTs4lA-VYOXOytUdofqJ56iYS1Vw-Vj2Pp6VtOfGpGUbP-iBV4c6C3zgvv_0ca95ZfdR9ffs63612AluoXZUvSrCaNgDQsJHKA2x2w3aJ-mZ7wHjlsL0qPnxnGX0h96omPg96YVbIhaCldJrba-6zznf13Nr8xv5BMKBZVMKYmHvSPgHtdNyRVj59zGKAE2h2aW7JODs6vmeYDK8RoK5SeXYpAuHdy4Yus20qY7rbMUMxRcudoH75nFaUdwtQEFXE236icpJ_4E7hyqlaRmPVz2isD9KWR7_zJkI3vRwcKVyk-QaHoF7c_nE6-SCZlD2e490y5oYYKgA7dNCYtPzpi1EM4ryCMFdah_XZTdkPXJgSa8n5DlIJbwQDxwvfKCfLQZSIivCnMqZpXsF8pWE4XqT1kRI1-2SU5A9-KxYxUCJ_66Z9rNxZndpllIyK3RPWrFX8wN9gh9XdH8TvpLRq-jhuhqSCp1wrsnPU5v303gSJIMI_zMIEL_KXVMpu3ZoOYed7155AWaoii77fkrmMe5eKYCV1CmPTunEYonQ_FGwxbQtBcNGr09kmYycPNZghmkIvJWgbghfzNWWmffB6vz8o3CcHQdwBxgsVhaDDr_ScUz8U3lLkARYURhoSwMKmqcTdPM1-OICEegKWMzWoRoQQNO19RmRRBeNDBBiMSSiOqDhCGDHr7o4b-djgrMMNXQXRMrl5rx37wDJ07S7Ri7xeWV-SW3F-k4yKKgntMTyxeH_qc5NkI_oHb-SZTpO1tfnKdnpAT0WAEl-l7McM-hKGO-r4jAvhxo5MgQ65prGwplWDdCgxAgG5FBZXTp6n96H36JtHeKkk61hjOFCDsHSv2h_xrAmawfRzUSyrybKBqZ-xJcvhLWAWioyI9-VANVvjgGx7c53R9ZQRUnNwYMz4v_vUMyOnIKc1bWUBPDCFLeKJ4awHVZWd-6On4yGvKhyaLLb2EV9nS1UTrFDXnnpUbR_DglB7cvnk03LmhWYXhWzVv5qtvB-tU4M5_JaewwRXXe9y5Lu6hVLq75_OovBOQQNjE-jh4mme9fNFl_-DAnAhsuligwQ0ftVUBT5UQzZRQRDbKrmZs_1Fy1bSYJDK9U2LN8pruf_3m1le2s-kQ6DTGlXR8ruOn2tAP5-muQUMoVkHoAM2FVlBYTYrB9fwQibpmMxfCx0CSg376y_rHD_K0uEVrkPFTJ5HAkpfhmIGqyGd4GN6LhPKOx-5t-bl0O7GQRJkjWpG5BRRRDpvlaqdwaT6ObjCTRv_R7Wcjxnmi9KYnt8JpVs0F8ydVNraaPbV4riPDWicGndydL2tRG0E0kkKqK2qbEkLab5Oqvc92-tr88MexyUM5KIk5FFmM-afrPrGeFpWcAshinLeCl3O1tLMNyB9NZl6m0LbthEx1pY5s_of3uTrC3wbFXyrwdeNaChp-Z-5fRrNm5W3CbLBQLOFgT-5BRLS5_Kl9Ks6lJBfZSvY0elTQve_lVVitgTjmDRBMfp6BDjQwMhKKTNHi3bV5x3cC9QZHhFWOC7wR0auBYZBchL39FVjX4NDjsrVYBofDBv-WzFHn1YmBAyfvP2eLioKQuCrVIn6swrIa3PkbWx2tHsF6-3tnV0urOrOOoFm2zY-FDDpHscCwesqG-MQ9oj-b5SWvGTbTrFxdguLU63sLPdyzUV3e6MuhjYlkI6JkEUogWKRE6flIfxncli4c-w0OthxN7gJVNZfLPj8ifY9kxRf4ystmTWu7_8JuS_iDU7dLF7i5JAo9RPbMvmMgmdo7QPckdMVDWyQ2PpcAcocgE8f641b6N6TmapfRB4xMuG8MFHd6y9aAZQnONGYXTU5t2VRDGwh4JQtGJiTZNDcBVyjthXrR8s7ivuX6qGIZTQlGdNchyO4ys4nVLSrm6uE6OEFzrfFj4chS7UVl8OghGUW37MzcvP5OEAr69A2901C3G-9AHvJwZbAaQSY2KDQe0xAaDW8XJ9MJoajquzCgjo-TtsSHASbn26EhyC4hHkr7w9PPhI95UjbT5syLdLzKjDLcBJcVbbAunv-eqCfXl4U7TLRYQhGmZSl-IGmW3UJhZevHQBlVQAcwDMEgddjD8yArQPfxQO-aQvBAC0fE4nzGd-BUDFnPXCkHHn_TeRLGEJN8Se-DDZD3OcpzfKeQ1dUgjw3EGknYW7s8ItoVN6VAqFozvM9JA0iHXtCQBDiuVOMkva_mImMYBKSyu1asaZ_kFn_Eo0EpxNNt9ktHcL6pEuK26yexT26nxE0-6EMNITmnTI6dLTBpsnB16PHAkM6Sm4lAjuvrGT8wAnrvTP8mEs_g-Hc4JsLZXny_G9F45_JqXhKjESdp_fA_Ac4ihC8mL4n2xDHRMSYnxk62-TFPYrAg1gCRoMLwpXsx3s361u66VCm24eHA48GhVmLMQNzgrERTNlOnUKeHaIU6oQ2M9BXwRiIQ5EX6Xk1AfGDXvdXMMXC_7bXXl93i7c1TrUxYIqQexySpeDroHzuLQ34BHfZ_2UggKCvbukkxf6oDM8OtVB-jxHwiRB4XWyLx83GNPsxAR9bGVwbiBTVM8dYilxnm_TLyudxV46zUIDmP_ksc4Bmm6T2JbnLeeYEA49VKfvyYkimMiMPl71UqstNcDcxa9V5QMIV-vEnm9fUZP-zyY-5VjkcBDaGfu_kb23PqKgBEvFYSY5NgIdPpj3H3opI90FKvFgd&cid=CAQSOwAvHhf_YRexfSYGd4SnWgkhRG9ifT_LCNBpVDKlXfYrdlIww9DYiIVK_SX7A8-EHSoLp4Lp6WaetLzcGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=15914908870091348000&adk=2988274606&idt=190&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

507498f34d4e307fc156a8c4dc7dd12c756f2813adff6be0e31272c83f638b06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39444
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9C3A 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1168a3aa9a883d53bb493120ced8399c29f3192de34b9eb08e65daef84bdc92a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 85C0 0
104 B 119ms
16ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEMiyM3qbGTBIdhQqMUCECTI&google_cver=1&google_push=AXcoOmTz3McPd0VT_1dqaIRuq-0EJj8Cmhx9hOeJel420XNqGnmjSHzFXmvucTLLspgU6hIy8EvNCIex1esSQX7ilJPMAEJ7eN-0fMk
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 85C0
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8T...

170 B
188 B

21ms
19ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8TTRX45vmJw-AvGn0xzE5XNpL-6Jlaz2cKOrO5GcvVrIHKGZxd5CzWwuUY

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 29 Dec 2023 13:12:26 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0f7f5cc7c951f6e61@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEIVrX3GYJR8zfHE1xE90Ibg&google_cver=1&google_push=AXcoOmSQDSxFBlIHK8BYpRdRn39mXQF5hS2d5Gftt1IXa8TTRX45vmJw-AvGn0xzE5XNpL-6Jlaz2cKOrO5GcvVrIHKGZxd5CzWwuUY
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 85C0
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHrAo-rpTnZpM_jp2u0Od44&google_cver=1&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV657sb2LTw20tAOgASM
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV65...

170 B
188 B

41ms
32ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV657sb2LTw20tAOgASM

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSbSSLBc0WoH70osOavyF-j7-ZuL9LmBicCrdlxvm4Fvk96Pta_IPeZKLQGMW9Z-4mD47j8lnEq0GQdV657sb2LTw20tAOgASM
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 28 Dec 2023 13:12:26 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 85C0 70 B
149 B 133ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAc5yPMpnglmBgiImcpiFQw&google_cver=1&google_push=AXcoOmQetOerGs9jkkeG2hNKsQPgVVZ4T3ebuRdtuMPyVDaMgNcLG4JfqGcjHrZpIEI69i871b90JvmImbH4luqHa50sfOKpW6YV3II
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 85C0
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEO61W7tHTpYnn0uIhg1_6ug&google_cver=1&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQln...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jBqPCTOZS10DJKBD9nX3Xw&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQlna51YpR2yPWOs9dY

170 B
188 B

40ms
31ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jBqPCTOZS10DJKBD9nX3Xw&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQlna51YpR2yPWOs9dY

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:26 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jBqPCTOZS10DJKBD9nX3Xw&google_push=AXcoOmQkvhBg9Ma9TQZ6M3tzlReJy-pIH6skwmfr75rhjOM9EEl5Dy2WIJWIcCNh9-_IVlDiiQKRS6Q0hR50aQlna51YpR2yPWOs9dY
x-host: tde-deliveryengine-production-59dc4ccdb-vtzf6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 85C0
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEBTaL-SSl-t2vjC-7BavgNw&google_cver=1&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEBTaL-SSl-t2vjC-7BavgNw&google_cver=1&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINt...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc

170 B
188 B

20ms
20ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQ_yWJI0NlU8suoiYr-Oznruegx2Lv4rCr_KVem3s1vfHzmMwnYzYV-AjPOSZWS4ZnsqKLdPYW3H3XalU8EgWINtY-6CEEA5uc
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 85C0 43 B
362 B 113ms
13ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmS4t-rNB6_Cnc2uqgAikYmhkMvkSaVdKhyHwZXEFKj_8UMDaa1o75LIJEclyqc5BFausIiKOHYfRLYnIHpGVFPFgC_44upEEIE&google_gid=CAESEEFxy11IZi_MVZr80DrbTB8&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 239409
expires: Fri, 29 Dec 2023 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 85C0 0
12 B 19ms
16ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KtEgElcndCEr_BCaj2MusBem3GvS4S-cRhpTLvQMzGfSdGjRH2JywZWt5xCJVfE_JtFThy

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 container.html Show response
a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DB25 6 KB
3 KB 14ms
8ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:26 GMT
expires: Sat, 28 Dec 2024 13:12:26 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 9B73 12 KB
5 KB 106ms
30ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5032381
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7cMZXg4ErBmHXnQV8n0opRs9%2Bby8SKldzOJadeZLbfoB1gFCMzLty3zV3A9drpjuFk00M4MuNcO1ZZK2HNgHtK6UMDrQK6ZVOrJuoWTdhVNyJE41HTJ00wYrM4x5N2pTdqTtXtE5zM3xhVwdnY9Okd8G"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83d24b70accc39d3-FRA
expires: Wed, 18 Dec 2024 13:12:26 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 9B73 12 KB
6 KB 42ms
9ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 57fc69cc3cca4b89ade9c41d08bf92a7_brandon_grotesque-bld.woff
static.criteo.net/design/dt/ Frame 9B73 43 KB
43 KB 49ms
22ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/57fc69cc3cca4b89ade9c41d08bf92a7_brandon_grotesque-bld.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

57043935a3503c7aff7dd3ee5f28f037147ca3f81cc4876f67a33ca14ac45dcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 16 Dec 2021 16:35:44 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61bb6ae0-ac58"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 3154164d2c5c401690a32afc5ebce507_brandon-grotesque-bold-italic-58a8a48221563.woff
static.criteo.net/design/dt/ Frame 9B73 41 KB
41 KB 34ms
9ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/3154164d2c5c401690a32afc5ebce507_brandon-grotesque-bold-italic-58a8a48221563.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

2d9fb017af918459b599da7e62b718250c644cba54ac9c18282a724b0482362b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 19 Jul 2021 14:25:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60f58b58-a344"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:26 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2511 111 KB
39 KB 93ms
8ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 2511 11 KB
4 KB 24ms
19ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CZL06dFdIWxkYsXKFPGTNnFVIO6F8BCeBfP-dKXC8ciHmXeP5kK8gTezB8gMZTH_oiwH-fk67ZsqGpRGSB_y0Uuu_p5JPq_EkdLiJDIgGtL8sXzYIbvwyjSTAYfysOCMjTOfCFfIfOBL9znfk1E0LEUntzIJ_Gy3TBSNmttYpfmsiHJbU&dbm_d=AKAmf-CmTTsss7lg7t33HTInYGh2sv2ADLnofFoSlkngdXXhqV4LVgpS8u18C6haBo9aVrM8qpfzNjsKoNKtL6G2mFZlkPZrcR0XdHDYPkNMArfCAgoJpI8AnnMfLNZLhXnqzV2bSrjsVkB7tctfilqZuSGdMMSqOQCn2UHo-Ai56clOf2YhhnNYlVnYMMbGH_ZwsFz0vR94sLFzggeIi9TiZzlAQR4nEC83YfhUW_CY_R-cdD4bLLXNZUS0PQ35p_-O9jBpyXcbO-UoVnqzvR1hObbWU6yqwC115a55x-okiOAAgnzTKqdb_TilGOgI9zJv_T_JFavz3HycyyK5nidL9YE61qlFB6BrEn826PEYCvSei4TZakoGalcWJ6s7MTIavr3fS5-A0xQXiZ9IWGAOkWZwXssUFEIPVLmN99K2oMbxo-NQXGxdL131vvnoLM2d0-3gmYBIL-GsXQQ-H4ov6BSCxmcV6X0krIluzcFot8ZnxcFhQ8Au0K4znoK4AZrjWtMSKSbjr2im0XjTov4PdzTPwgaT2YtXAWmQUDG2xYx1sQhH_KTZcTTLPdDMmz3HX9PtdUnIplQIQSlVhBIMlRQosp_ch891qFOeN2v_qVl2NvNYhrMY2yvnmET5_4uwcE4etROoM7kWPaYQeoh2Cs1TQJVRQJi2oxmlEe77lKaLpMlBUERLEo-I_jzcujAMJq3s4Gbi5oVyMCP8i9hB_Uelc8FwxMO5EipbQ2NsHa8_hL5pXICz0R1BjVNCTEM3DNVRQoNMRHEQCF_NpXpcEmQAzbc1dk2k72YoTRlbDDDfM7XgD2EhXiJkaNKCPGc5UfQea39XtpJL5BKs1UnSSy6tRaK5JP3teBjwXq1NTk0tVwzDV5MCQRaQw0ACdxWS3rXqdOKnpCZY9frWMUCu4185-TEwW6cJxVmFCmqsCctFUWO9cBN7xyMKc897fa7-CLV7UHcpBiCU1FWNM7Mj07rXWM6ePngYQZ5x_K2Z3mNlQDTTySrruxRzWJww4mCWwogUVUZIC3BsnPxar7MHdqVIFUqHaOKRD7-3f3snQY-0C2I_2OEgnZGjxNokEsuTamIVYqBxbwWWOvq6vB3bgvkhKUwivqso_7szj_WIaA-QlhDe0Tdx__9wSngpUCo_t47vwmerIzFWMYWC71IO4HtZry3i2GwWfQ-Nu0tXaTJl819e8MUG1-dk2BNmBVZQk5eqMH6te-kbspAvMyWp0uYlCLO5QdNJTo3pyfwQlvR0XJUIRQeE_ysVk4TI7RO5CeMyhcqM3lG_sM43HIVEd-c4T4L5hqxSSC-E6nqPRguIXvz1W4KcyWHicj6a2nSuIdaZlLw6X7BaQNDrnhnNV6XxjVMA49fULhMVybtBbiEUsIszxz-9DGRlhzrbrR9i8Sp4WI7RAKX3YeUigINJtOHXvoDmxrNhjZ0lpBk00w_gpFSQhXy2TS3lSfFZFVkHICyQcmPVBewa5khG5U_jAzGEybjBg_T-huErjKb1J-1mykanqLDBjIJs2uQmgsEcGgmqhiR_g-cM-0cQihZEBISJ4zIQfTxxY0c1Z1gCm2vyvXwSAxQd7PiLnnjyvVcwOEa7iH9OvdtlzjD8TW16-5SySXIyHbJ2RYHeH7Ta2hxACLkK1qyESNutGPXrZ6NPh3jGVboJvIw3eA5KshT6EX24X84JQK6DIW1E0KjAEysNz0tBJ8pbyL4prkXwL6E_kpfa2f7cap4_XRe3GtmZfgGEA-i-k1rV-Wqu5rAKDis_6omT0pk_8n6c_VCp6VTw3C2higlw_W0-qK22DzflSm7EGt3MsAQ6oGNry5FtpT9ZXm6leo61NdjCNEOOjf2_4Wg-mxIbPmKUWvA-wtYNTF5UTYPdbDiRu3r9epYqChifYVnvp6_oEyxqRTGxZygJ-ymqJhPSx8QOzKam4l7QSIn8fj6uhQtxmm7VywCyq0wGzafOYkFcTsOFVHOEctdei4HhW_SQueDA_w-jH54X-yq4tvf-q5iP4NZGKxuhNviVRIsW48iK5McK7OlPyC5VpoHY3_M_tg2wwALWcNISSEamW7b-77b_0IFchIfjXyTaJN1l9-VHr0NuJuckO6PTbqZN9McwPwAMinDajkt0xijmxJDT6YnY9PrtWoGddW4D5B6VsvpMveDtan84tXTzczFl8rgIpLIUHwjljc_wm7W0Apm43FSXL7DSJSSG33blP9YdphKttdTfrDNDWDYCvHH9C5qc0O_7cY4VB3MGzYXLEYEvteVhxqCh84lwPDDR7ync2L22mtu6DQ0ZWCrE36TNjgpvq3wSczN-hRvYcJ1krsaVZQHC8_edmAZk52ODjUdMCIiqQjuD6kqAQFkR3CEelKtMoE2XLQBBYXvmNwLogj6QjxjOYjsIGGcGJeJSpny73W580aX6wZEBUIszQlf0K5AQJfWsjUA2RQCIegs7englRBZrXtQkqisrfJ0I2VV_IJhygFEIqO2_kle9Us69VE3HT_z6B-dVt1WDISyzePhXywDcYUuuCqBhAGjyGk1BhXo7fLJEqKWBQMGi3kWp1T9Z5xu3rYMqDriIdQtHu63CKFoM7_KrEPjn_vFUUEicsCpYgfnEuGslcucJhY3xlnQ0FqYxBs4_uXGVscEbtqyb8KS6cEObo4qRenDat_hNDKsaLre6sBGasTgBPPPH0GUMtm-GR2yh9k4hnYR0O_uFd5vJNIXUcFAha7m4D3bblf5a2OKSv7MP9aCFp55aEKsEm2Wi6Q1NizSm_aoOVnCnDmMRPQvRkYYFsmQSQqN_8QBKZxpbfUqZuuH3bmLfA4NQlzSORvrSgN00IHoBr07Ow9VTu1itx4-QLeBLDeNZy_Fldw6JCxYXJ8ae3eev6sBKGcnOXDicp3vnxTUavIrrz9lL0x7-EH1vPRupeQ6cK8ldOleJw2_EkYdaIGbS7KQ9Z2ZpJVOFg1PcRDc7rAYLwALXcSGsCUSROqqh2tkUpWEYkPzArojmTmRAC3TecIG5m4INQkJnYMOyy9QbAuQoLMVmtvNHohf2WhyTz44F4Ljs0z2KG8Ilfa8L8nUESBCDrD0bHIbg1M3UZZe--uraZaoKrec-4XZ3bEZOAOwUA31z2mMmfafZb1VgVMVe_lY3u6nFHQquoWwwOAA-G6pMrzrLvKvNnMz-fOoQa9qKOAc8NkWoYk6ou4SRCDjfvJdfhgxVOYh_Pqaa2IgZzS1odcnmpYwbJfY-acWOc6qjAadSb6IVZakqmChnJb6mWmUet-SAPXNg7EfPAPONp71TL0qlQJ5dLQ6q-u1OuiuXjfmB_mWGP0zQNd-DdTLGMIBlAJsw9zFQIMMqdqsxaindtvOgWTv0SBrSR8f5yYwTuP44yPzNpufm63Lgt5lUB7LRKVCN2gJWie_BytAbaMwg6axhIlgUOIGjmLMtAz3lvX-yh39K2hY9usdDQVXIdhpn95JURjvvXjWU_9DOJMf9j6Mhy8Cef3ZGKbF7VjXthXvcU6VAlhxH7tfuFucYy97ZqbXc6XSKein5K0oO9LR8PncdcWV_RX74NnF3KRmeOrN_DBxKRzgoNwSvIIQ-gkQ0_uEOA5XTU3ZzaMqPr7Xpt3B-cYWZxWh7QwXUlTG5QLyFpn4MXUHe5IeHqzpu4qd5L35r54hXTL2CVyIPN4GxSIK9h49oiqTMHGXpgbNUfJaa9QwKVn14bGXG09p4S-37_Dg1TPqa67KGVWxgjRyix6VcXW3omxlSiQkfY79JCwPH1RHoXQs2c8pPjr01HudjLce0DpgaRAuj5Wa9OOSYC-tA9-fDGxU_sghgSwLj1pbIjzewKr3ocUUIrH7iWQveW9Q3aGoylgKIF5Ds_Dlyh1U533J7JidFEkmDEkDyjLcQbe22V9PZAhGCOcMZkmrB&cid=CAQSOwAvHhf_YRexfSYGd4SnWgkhRG9ifT_LCNBpVDKlXfYrdlIww9DYiIVK_SX7A8-EHSoLp4Lp6WaetLzcGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=4642841225209699000&adk=929882888&idt=87&cac=0&dtd=40

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 03:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34579
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 12 Jan 2024 03:36:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 2511 31 KB
12 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2511 41 KB
14 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 256990
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 31F8 1 KB
643 B 21ms
14ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9B73 5 KB
5 KB 138ms
62ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=556&m=0&partner=100874&q=80&r=0&u=http%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F100874%2F230110%2Fafbb278d35c849b7915159e8a5d5cce3_logo2vertical.png&v=3&w=196&rid=4&s=3lDY96mAmttwUZgh1XlCp5qN

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e8b239f1b5f72bd5c89a8049d75e4f2296cbd496fef014193774ef29bae39721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4959
expires: Fri, 06 Dec 2024 07:36:14 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9B73 96 KB
96 KB 112ms
37ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=100874&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0278%2F0391%2F0197%2Ffiles%2FSU_07NT-STAA.jpg%3Fv%3D1699870223&v=3&w=800&rid=4&s=e4M1HegDKX2T5vudWbt9AoPD&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b1d9f883963d4b565e44fabdb3d8a55d3a56f7bacd41ff07ffce5fe9776ecd4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 97942
expires: Wed, 18 Dec 2024 07:59:55 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9B73 25 KB
26 KB 95ms
21ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=100874&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0278%2F0391%2F0197%2Ffiles%2FHO_08M-A.jpg%3Fv%3D1695970061&v=3&w=800&rid=4&s=h6-1-NLS3mIaE1B0ZQzobRNI&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

433b56563428d05103b7dc7106f7b572daa5d4d35cbf9323e610167cc2bd268c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 26110
expires: Tue, 26 Nov 2024 00:50:53 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9B73 12 KB
12 KB 135ms
61ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=100874&q=80&r=0&u=https%3A%2F%2Fcdn.shopify.com%2Fs%2Ffiles%2F1%2F0278%2F0391%2F0197%2Ffiles%2FAR_06M-A.jpg%3Fv%3D1695227129&v=3&w=800&rid=4&s=FEAz6YBiACziJ__LhdSBIvA8&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

00eb373d0576581f5db8e9b03d1b7951a1f2df8bc46d0c2fb7fcc2436d356e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12442
expires: Mon, 25 Nov 2024 00:12:27 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 9B73 0
128 B 91ms
17ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=c4dwsAuaHaHt3v9f2xCVjjDB85WNhh2yyMB7Rtf7sUx4iMYcVxZxeqR6ef7NvPgYegkFfsaLEHAX8LvxORbiCCjenykjoSVEemsTU4fQrNXRTGp5xYveZ_R_Ldz8wb9Dl-ZZ36TN91O_3Ryfgit-PvcD_YHZjPFuo0XPqVHQyz9old1lVpwtsLMArhb6KGew7_N23WNrXZ43RUbe_oWaDSlSB1ic0201Pw2ijxXl6DJMzKop8BIRA__Sc6M&sds=2&rev=89863&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 9B73 2 KB
1 KB 16ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:27 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 9B73 2 KB
1 KB 15ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 23 Dec 2024 13:12:27 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DE68 143 B
166 B 37ms
30ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2043
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 12:38:24 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 46DF 1 KB
643 B 30ms
12ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59553
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 5CE2 111 KB
39 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 5CE2 11 KB
4 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AWoXR3hEYlQIEjFqOVMbSUe2UI3IYKGO3OcEmKHHogMwIaZfw0Oe92LFu096WM5Exo1rCp9zizgoQn7l4_0n-lp10A9yi0qtrwZ0sesKOe79Urwi32TNT2c5sepLBDxX0yCBEGRDsQArUerANUz6OJhzjKBIkjjdi0P6p5NRqUrLn5jHQ&dbm_d=AKAmf-DMmPxwKjVlOjzeuwxbGQCRCppysfFDkWl04IbC4GaUT1PZvDo0Dy07A_S098h2jzRPnkMX0TTO4kvmpJHCS-7OXg8x7czmaPBR78Ug1Hf-gucGReo9w_nTnmyi4t6UjOCvDMqb1dizx774JuHwCBVPVv3y-YK72HL-iU0TP3f5HEHr1egrWcQ3aXDUCF0KC7Z6p1c-ol4UwBUkjEN-w6U-Fes_d_Lvt6Th0wDieF4m_Y-GaiCkFFnZnt2I3snk-R-KOqRKt3jVucdo6M6e4tHGd46W7zOJwtvvwvorVYBSyErVBshY4VgnKjp1qszIgAHGmzQUnD-8_xP8OXuKjMq0-tZkxEjkeZCxFnwYm9XoDR7O2ZZQVTmVvcROeZPMa3a0tZGplyDiQUO6rIaUrnpkw3KZwwPgSJezE6GbnXySAs8TC9ZF4Qq7ARvOaCuMT1GOV6p_HSTQEiD8JIjIV0XRIysnTHKjqevhxtnJSJE8gjYxDzvUIZTAfzbfXl4OZNNMeWwD4vCTrxFQGoPD1Vhifkn2yRjobzicN5253TUmtm3MKE3IZtahbE2kVgXyEoj9PmDX84X9m_D3m2MNBF5x5IXyYuh9ExQSW0GheCNVKyvG47-K9DFGXL0Q4Q6eEnB5uczL4S-6V8dpxW9oiLqtCMWbpf9RIooJMZmDX-K3J6exhIAhnQ_l_jkhpP7OdUPWWK4Z02DoKAiwS1MNr7jIgFsbO2TZkCipbHCwcQL5lYmHN49PqSRjc8-1VYhYtIUgspL5s0kPkn-C47QRnsWsqE8hmcd8OD--8ezHmLts0Ia2vnaEa5Buq6j_me8ofCI6O8lVhMS4bMG5JaEXq1ojK5Oxbzy4mRCMmGpKMJj4VtPojFQfH2tBd4xS3fRe5obox3M0nLMQplSbRZAIothvKquYaIem2CLw9Fw1-SWdHy4NV5pNVO4N1I3oQDJ-33EuLsHw31QbNNm2cDpGc-do5Soyp_wkw5FH4zG2ZicMH9COeYsk9FzSBjhS-8_aO2gHphgaTEgPVhfrP63F1IEkqHeYxwfLlX6ObkeUi_ZTg5DpL4Dq8pZ4xblFdPvU8UIG8acYAGdqq-xFZIAhfFvv0vGbPyNo-DZqpvbT2KiH_D2N8hwLyGDrejfzWUdzGIeJ5lXVwjyinCd0z1joPV7dbSJ9Ez7Q5sKheuId7hreTs4lA-VYOXOytUdofqJ56iYS1Vw-Vj2Pp6VtOfGpGUbP-iBV4c6C3zgvv_0ca95ZfdR9ffs63612AluoXZUvSrCaNgDQsJHKA2x2w3aJ-mZ7wHjlsL0qPnxnGX0h96omPg96YVbIhaCldJrba-6zznf13Nr8xv5BMKBZVMKYmHvSPgHtdNyRVj59zGKAE2h2aW7JODs6vmeYDK8RoK5SeXYpAuHdy4Yus20qY7rbMUMxRcudoH75nFaUdwtQEFXE236icpJ_4E7hyqlaRmPVz2isD9KWR7_zJkI3vRwcKVyk-QaHoF7c_nE6-SCZlD2e490y5oYYKgA7dNCYtPzpi1EM4ryCMFdah_XZTdkPXJgSa8n5DlIJbwQDxwvfKCfLQZSIivCnMqZpXsF8pWE4XqT1kRI1-2SU5A9-KxYxUCJ_66Z9rNxZndpllIyK3RPWrFX8wN9gh9XdH8TvpLRq-jhuhqSCp1wrsnPU5v303gSJIMI_zMIEL_KXVMpu3ZoOYed7155AWaoii77fkrmMe5eKYCV1CmPTunEYonQ_FGwxbQtBcNGr09kmYycPNZghmkIvJWgbghfzNWWmffB6vz8o3CcHQdwBxgsVhaDDr_ScUz8U3lLkARYURhoSwMKmqcTdPM1-OICEegKWMzWoRoQQNO19RmRRBeNDBBiMSSiOqDhCGDHr7o4b-djgrMMNXQXRMrl5rx37wDJ07S7Ri7xeWV-SW3F-k4yKKgntMTyxeH_qc5NkI_oHb-SZTpO1tfnKdnpAT0WAEl-l7McM-hKGO-r4jAvhxo5MgQ65prGwplWDdCgxAgG5FBZXTp6n96H36JtHeKkk61hjOFCDsHSv2h_xrAmawfRzUSyrybKBqZ-xJcvhLWAWioyI9-VANVvjgGx7c53R9ZQRUnNwYMz4v_vUMyOnIKc1bWUBPDCFLeKJ4awHVZWd-6On4yGvKhyaLLb2EV9nS1UTrFDXnnpUbR_DglB7cvnk03LmhWYXhWzVv5qtvB-tU4M5_JaewwRXXe9y5Lu6hVLq75_OovBOQQNjE-jh4mme9fNFl_-DAnAhsuligwQ0ftVUBT5UQzZRQRDbKrmZs_1Fy1bSYJDK9U2LN8pruf_3m1le2s-kQ6DTGlXR8ruOn2tAP5-muQUMoVkHoAM2FVlBYTYrB9fwQibpmMxfCx0CSg376y_rHD_K0uEVrkPFTJ5HAkpfhmIGqyGd4GN6LhPKOx-5t-bl0O7GQRJkjWpG5BRRRDpvlaqdwaT6ObjCTRv_R7Wcjxnmi9KYnt8JpVs0F8ydVNraaPbV4riPDWicGndydL2tRG0E0kkKqK2qbEkLab5Oqvc92-tr88MexyUM5KIk5FFmM-afrPrGeFpWcAshinLeCl3O1tLMNyB9NZl6m0LbthEx1pY5s_of3uTrC3wbFXyrwdeNaChp-Z-5fRrNm5W3CbLBQLOFgT-5BRLS5_Kl9Ks6lJBfZSvY0elTQve_lVVitgTjmDRBMfp6BDjQwMhKKTNHi3bV5x3cC9QZHhFWOC7wR0auBYZBchL39FVjX4NDjsrVYBofDBv-WzFHn1YmBAyfvP2eLioKQuCrVIn6swrIa3PkbWx2tHsF6-3tnV0urOrOOoFm2zY-FDDpHscCwesqG-MQ9oj-b5SWvGTbTrFxdguLU63sLPdyzUV3e6MuhjYlkI6JkEUogWKRE6flIfxncli4c-w0OthxN7gJVNZfLPj8ifY9kxRf4ystmTWu7_8JuS_iDU7dLF7i5JAo9RPbMvmMgmdo7QPckdMVDWyQ2PpcAcocgE8f641b6N6TmapfRB4xMuG8MFHd6y9aAZQnONGYXTU5t2VRDGwh4JQtGJiTZNDcBVyjthXrR8s7ivuX6qGIZTQlGdNchyO4ys4nVLSrm6uE6OEFzrfFj4chS7UVl8OghGUW37MzcvP5OEAr69A2901C3G-9AHvJwZbAaQSY2KDQe0xAaDW8XJ9MJoajquzCgjo-TtsSHASbn26EhyC4hHkr7w9PPhI95UjbT5syLdLzKjDLcBJcVbbAunv-eqCfXl4U7TLRYQhGmZSl-IGmW3UJhZevHQBlVQAcwDMEgddjD8yArQPfxQO-aQvBAC0fE4nzGd-BUDFnPXCkHHn_TeRLGEJN8Se-DDZD3OcpzfKeQ1dUgjw3EGknYW7s8ItoVN6VAqFozvM9JA0iHXtCQBDiuVOMkva_mImMYBKSyu1asaZ_kFn_Eo0EpxNNt9ktHcL6pEuK26yexT26nxE0-6EMNITmnTI6dLTBpsnB16PHAkM6Sm4lAjuvrGT8wAnrvTP8mEs_g-Hc4JsLZXny_G9F45_JqXhKjESdp_fA_Ac4ihC8mL4n2xDHRMSYnxk62-TFPYrAg1gCRoMLwpXsx3s361u66VCm24eHA48GhVmLMQNzgrERTNlOnUKeHaIU6oQ2M9BXwRiIQ5EX6Xk1AfGDXvdXMMXC_7bXXl93i7c1TrUxYIqQexySpeDroHzuLQ34BHfZ_2UggKCvbukkxf6oDM8OtVB-jxHwiRB4XWyLx83GNPsxAR9bGVwbiBTVM8dYilxnm_TLyudxV46zUIDmP_ksc4Bmm6T2JbnLeeYEA49VKfvyYkimMiMPl71UqstNcDcxa9V5QMIV-vEnm9fUZP-zyY-5VjkcBDaGfu_kb23PqKgBEvFYSY5NgIdPpj3H3opI90FKvFgd&cid=CAQSOwAvHhf_YRexfSYGd4SnWgkhRG9ifT_LCNBpVDKlXfYrdlIww9DYiIVK_SX7A8-EHSoLp4Lp6WaetLzcGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=15914908870091348000&adk=2988274606&idt=190&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 03:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34580
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 12 Jan 2024 03:36:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 5CE2 31 KB
12 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 5CE2 41 KB
14 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 256991
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8550 1 KB
643 B 14ms
11ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59553
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F166 624 B
242 B 55ms
53ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJTDg_MBMAE&v=APEucNU6DacIeRxXyahOV3loFh6LDtNDahR5GRgSj5br5dbQbSSKq4LnxCLRPtx8x7AXnchk87uWAd6A9ANQOxeLptURTWUq3LzDIPpnXoV96O_A1jLTeYGbkxedNXMpuh-W_udRyNbqPx2QxQ0NJvvHnZmPpu5N9krg1ZWjCy4vrzKHZFZLNs0

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DB25 89 KB
31 KB 115ms
112ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:27 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB25 42 B
63 B 50ms
46ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cb6JgIwaTHqqUL8bGH8Bzbs8k6haMitp5AuMyV7zRGgI1Rt0Ma2JU1KYppg1zDkQJ0vQtpCCAiDhfloGiSagthmflQGJIgX9RKfC3Tw4l9_rAN2Ko

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DB25 3 KB
1 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56557
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DB25 20 KB
8 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56558
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 21:29:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DB25 0
0 17ms
14ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTAk1DXih42Y8QpZNi2E7Bu9IDpau-VRp4aaptpIISvh6GdrcwTtNak5WHPRAv96Hjvc-Nv4deIM3LGdCLzu5McM_RK4Q
Requested by: Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DB25 203 KB
64 KB 82ms
80ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 13:12:27 GMT

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame E740 51 KB
19 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 05:12:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 288017
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Dec 2024 05:12:10 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F166
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1

43 B
737 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJTDg_MBMAE&v=APEucNU6DacIeRxXyahOV3loFh6LDtNDahR5GRgSj5br5dbQbSSKq4LnxCLRPtx8x7AXnchk87uWAd6A9ANQOxeLptURTWUq3LzDIPpnXoV96O_A1jLTeYGbkxedNXMpuh-W_udRyNbqPx2QxQ0NJvvHnZmPpu5N9krg1ZWjCy4vrzKHZFZLNs0
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1f3eyC6wcauVtoJPYd4wxmDc2jPFkF3O90NaKTGrb3nwAF1UCbT%2Bwtsquju%2BjQYiqpFJw03PpocA3R2AcpuILJob%2Fp3JsMnBVcGvXpVMX8M3xLiOB6ZnADLCzVJ%2BpFwC7G%2FJuf%2B%2Bi7vyFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83d24b734b68bba7-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F166
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZY7Fuq.H01XNiRQipO7OIQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2

43 B
740 B

27ms
26ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJTDg_MBMAE&v=APEucNU6DacIeRxXyahOV3loFh6LDtNDahR5GRgSj5br5dbQbSSKq4LnxCLRPtx8x7AXnchk87uWAd6A9ANQOxeLptURTWUq3LzDIPpnXoV96O_A1jLTeYGbkxedNXMpuh-W_udRyNbqPx2QxQ0NJvvHnZmPpu5N9krg1ZWjCy4vrzKHZFZLNs0
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3RNBQRYmpnw8OZ%2FW%2FqNTHtqkcsMT%2F7NCVwCGw06wJadC%2F0Lpz%2FZCSwn2GL47x%2BV1Mu1SyzoTooSRjS2Mby7z5KPvTxYc6kY7DbEfV8H9zybvpOyZK7ERU1LnU5KK%2FiN99wspeSTRkykD6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83d24b736ba1bba7-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWu1N5LsGfTn-ALHHK-jQw&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame F166
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEE2HVVOypDyf4LPzAgeM8Yo&google_cver=1

43 B
841 B

34ms
0ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEE2HVVOypDyf4LPzAgeM8Yo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKvU5fQCEMaIsIIEGJTDg_MBMAE&v=APEucNU6DacIeRxXyahOV3loFh6LDtNDahR5GRgSj5br5dbQbSSKq4LnxCLRPtx8x7AXnchk87uWAd6A9ANQOxeLptURTWUq3LzDIPpnXoV96O_A1jLTeYGbkxedNXMpuh-W_udRyNbqPx2QxQ0NJvvHnZmPpu5N9krg1ZWjCy4vrzKHZFZLNs0

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
an-x-request-uuid: 14ce886c-ec0c-4e93-aa72-ff9791e24195
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.204; 80.255.10.204; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEE2HVVOypDyf4LPzAgeM8Yo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F166
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

170 B
188 B

45ms
24ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
an-x-request-uuid: 7d092983-476f-4000-b1a2-127ada3b6beb
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQyNTcyMjM1NTI3MjUyNDUxNg%3D%3D
x-proxy-origin: 80.255.10.204; 80.255.10.204; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 31F8 35 B
464 B 60ms
10ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGoLokuiR9TC-Dn3hrajCoc&google_cver=1&google_push=AXcoOmSAa08v_HnMDhVQ6_KuWMfKEYkJj_imyQAQg5XtJbcZt_gDkcxZLTEyEbOcpc33ZiPJ7cnJokWIUcY1-rBq-XXe9gR-TZuwAEE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 31F8
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bS...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-...

43 B
418 B

233ms
185ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b74aa9339f1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 6315
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAICi7AKWE_ACbmLX3O8iec&google_cver=1&google_push=AXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQJ24RouasXFyHQ1KvPeQLK0pa5nHJ8eflth6_szDklmcnMmt2XeX7L49o3pJ9l-QfPqaMkZkNAsJ-NkTFgjP8XL_eK21-bSbY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b73089339f1-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31F8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_push=AXcoOmRZjsw4akjm-kzFhb6qY9UTLyhUu9JOs9JViAprDEa6EXULs9_vjG...

170 B
188 B

54ms
34ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_push=AXcoOmRZjsw4akjm-kzFhb6qY9UTLyhUu9JOs9JViAprDEa6EXULs9_vjG3HPq6XzGWIL3BYo3JkyZiW2knSo_JRKSGDVtPao9SXq_0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220021-FRA
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1703855547.400668,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_push=AXcoOmRZjsw4akjm-kzFhb6qY9UTLyhUu9JOs9JViAprDEa6EXULs9_vjG3HPq6XzGWIL3BYo3JkyZiW2knSo_JRKSGDVtPao9SXq_0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 31F8 70 B
148 B 40ms
34ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFXXkn0QR3psxxr83DUfEwE&google_cver=1&google_push=AXcoOmQNzZ2m3CpDfFYogb_qHY5wXNv5vIr6byF71rDIRJc_P9j0lrcAhhTlqingqgaLyfqrNeD3jKHPPbd0VGk7JxN2qQLdVrs8FQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 sync
x.bidswitch.net/ Frame 31F8 43 B
146 B 209ms
0ms Image
image/gif 3.123.206.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEHPuQag8juO6-TxTf6vhePU&google_cver=1&google_push=AXcoOmRHZGm-mTLlZn01wgSqhsHFbZ5AafKfS_BeZ_VWcZXLrQqrJMpMFRYm92fFOeQMoKUHxY6TKRtw-eFHyanBazUv42VXD0EX7mA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.206.90 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-206-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 31F8
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIU...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzgzNzgxMDUyNzgyNTU5MzQ2OA&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEd...

170 B
188 B

48ms
27ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzgzNzgxMDUyNzgyNTU5MzQ2OA&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIUMGCMJ0C48K3FSJntkqUOH2g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MzgzNzgxMDUyNzgyNTU5MzQ2OA&google_push=AXcoOmQoZRfFwjj3GnHwDm9IVZq_ONgq3hs34E4izmPKmMT_HivLIbIDWm4ROdnoQbouHhFuWk_xEdIUMGCMJ0C48K3FSJntkqUOH2g
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

report
sync.teads.tv/um/ Frame 31F8
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEM2UBIRRKcgy...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmS3NETtaYitGiGSlWOY-HaI1qIVTi_kD4JQiQXWYUkNT5DW0n4KdjiRbocUs7h4QDDTCNc80qA38urABpizMb2_UKgQeKHqpeEk
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

37ms
36ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Fri, 29 Dec 2023 13:12:27 GMT
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 31F8 0
12 B 21ms
19ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IYjeCY5Q4ZIKBbiBFnZZZhouHvTMMXrd1il0mZ-pW4AX2SfEEbsl1zijR-FQYpUJmn1dNplg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame D0F8 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b9b9c19e15148a08a7cc3800a306f925d60373f4f26109baab78af0d9f7f7b0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16530502095010416759/ Frame E490 16 KB
5 KB 45ms
9ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4498ca1278367e6346a6b5b6a4fdc4a537b27d81f29295ce1cddbfb9ba2f1d8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 274687
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5114
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 08:54:20 GMT
expires: Wed, 25 Dec 2024 08:54:20 GMT
last-modified: Mon, 27 Nov 2023 12:28:24 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2511 0
0 114ms
54ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssRLwQoUsPSfeYgJklBby0SzveC7Ed1BZnhP6vaC_UtKF9AiDSz-2QR1lEMMpzaT6-bSIG8flipVOL2dwR8ZXgluJJ-ooZ-bvYfZ452dkWaLrFCRF_-GhOZXGheSjxeRtNgjcK-yc7KURJ0CZNmGzqrasamghdAn3QLvAHrRGRiY4Tt8TPYghQ9RteHdtW4oRepTG5gntfvtoDnn1ee2p-BpuxRYkyWplwdslLI30nQ0tP0rQyAp36qmlawnLSb-b6y5nNnNxkxufW7dt5PY8FuPgKwlFY-b_5OMO88pYre6N9Iza0vxnwhyITLyTL5ENeKcYFBLPwlL2yevZtSzBqVz5s33nT-4wiz7jj8UIF7v24X3FQMYdZJY6YPMBrFA2iepjXOFW0st0n8OWojMcpdGCEwj4VOQ5QyPZqFo7fiocKBCBuRFQ6uBSCClltjwOVOspGA9zM9cK-zTEuuqztkjq2bjmoVsxoUnU2Mh-eLwaPwWssbLMf3P6UVe7CRIal1E3hon4jZl1PTd92xaHYpdt5uEzlyr8beDF1Km8DEfGqoYtk6v5wngdUPnFvw8b00__-F15UmiKLPxiyAqcPQ2JXi5mYbO5uKy-F-Q1mEB69JRF4qwCH8UTz32IEYcVBWNOdJ4aeYIgD-CQfmf3B-2wuBz3-GyiF6BlXwsYuQ97rjanHfvxPB_7YAEI0ECi2PJB4eszj1RKFxfGkrHm6lAwtl9mMs9pibOLxHcFWFbG5XR8OvMj8CvMO2MKXF-f1XlTFbrgvDiNEQ8Tj568Z2_dyc7TzC3p0tz8cpZvggZWa_qqm40rg-nwf5ehdE1AZ21nT1ZdKhJBimToZJ9UNsqvw4FRpCEZMppieMgkdA3--4wGC2SNFCHzWvJV4lQFvahBMiu4yGURZmdbV_Qi1hRMVRruWUOgnnVEyaH9ubrd2MwoAs2Kj2h7mryYrjg0i7A4tjq_2Qkl3ui6OAsMb2IHCcosSBIOlVyicTqQSFtHM2koLBehJRAQKf9iUQDJjLcEEw0Vw-ZRS_g0bsS5mxS74SOMT7omSEFUo7iKDscyv5hlrPRZsCuIqT_GlM1BGx0hjaTTnMbx-gHen2JjksnEcHgXy2BXsAt8ZArMsqOOjAs5w-Z9CGJp-I_NlE8n7FbWYk7t8T0NEDKqis32AjCUP15JytG5LGuG9P6U8KoVWOprAw9lWLi6Bvj3C0mjJFoi3Luec-kU26PCrq2IwULLjWLMKCnwBsDo2HkhBE1_EjUK4bahZA6MKQiRRiiFeBB0HaxUe7mAmUlbI97k3ZjuZFP9IFtU7evCRHpP9uCBTx9mDWisOTYn90c8a0G3V7j_HprDuPk5pIUeTj9phwK_wmvrtwco4urGYkW4-_OoZEbaAgSbHFSTSshCvHvUFJm2VE8Vx_ePTP_SL8z9u7naQImA&sai=AMfl-YQAXgF-KZfk6epAlMu0wiGv7jDb6KhZe2GoVGiiwF2OAqCiobw-hpg03VKUA96qvEvbuU6C4E0IvBYLLiyGQg-SilQwIWpkWnlHpQx97U4txydcGrw7sC4ahCT5oJsoLaBQa19dlb0qhGF50iId4WmCOKNwSdFhPmdnwaIhv4xv-KBGJyqbnqo2Dl7V1S4ilLgIV076Q3aHsdGkhZkzeAn7kEibmk2q158eTCWJi2DcFMLgfU_Qfr14373VzovSon0p&sig=Cg0ArKJSzAL6VFnzAgFUEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=469&cbvp=1&cstd=465&cisv=r20231207.63752&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-77-74-34.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame 2511
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr_cons...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr...

42 B
732 B

39ms
32ms

Image
image/gif

54.77.74.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

54.77.74.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-04590bf15.edge-irl1.demdex.com 4 ms
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: Nz3qi3WFROo=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-02a370a0b.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: vccIV5MDSXQ=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=633957624&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 2511 43 B
1 KB 160ms
28ms Image
image/gif 213.202.235.9
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=1014932963&extPm=534899094&extCr=20797590123&gdpr=&gdpr_consent=&rnd=633957624

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.9 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Fri, 29 Dec 2023 13:12:26 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Fr, 29 Dez 2023 01:12:27 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E317 38 KB
13 KB 20ms
12ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 255108
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 46DF
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cver=1&google_push=AXcoOmTsnEBCSmZnWg0yOP-6nt97WV4UIdp3bzDp8-C8VX1...

170 B
188 B

62ms
38ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cver=1&google_push=AXcoOmTsnEBCSmZnWg0yOP-6nt97WV4UIdp3bzDp8-C8VX1cvMR8W6PefxzQvc7cGBz30lhs_lEp5ZsK85mt26nffEH8bLpuXU4Egg

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 29 Dec 2023 13:12:27 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-006fa252bd7417634@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEM2-_1dOUpKxyXn--ckFEww&google_cver=1&google_push=AXcoOmTsnEBCSmZnWg0yOP-6nt97WV4UIdp3bzDp8-C8VX1cvMR8W6PefxzQvc7cGBz30lhs_lEp5ZsK85mt26nffEH8bLpuXU4Egg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 46DF
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwua...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfw...

43 B
460 B

566ms
566ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b752b4d39f1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 2076
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKYMfJNMSzy9xGEf9Wac-wo&google_cver=1&google_push=AXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQFFtPNDEV0dZNXbpRK9N12DC1c-Tirv8USxzISY4fw4Mqv1ETVPDc9FtAFWEnJjgExefEeKCq2gfFN-vwTbedBGEZvxfwuaA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83d24b73e9b339f1-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 46DF 70 B
148 B 48ms
13ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJU0g5tgSApTfvqv2ScH95c&google_cver=1&google_push=AXcoOmQaNFLp-aEjrTBMeVnghIgnVw4lpuLJzZdBkDyt4ML34undW7RHjzX4J8gqkxNNWuW37V4S4siyi5bFo8C-yql-vCuMO3xVO2Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545410&bpp=1&bdt=351&idt=333&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=350
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 46DF
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQEArtc...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQEArtc...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMjkxMzEyMjcwMDA1MDYwNTE1OTIyOA%3D%3D&google_push=AXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefu...

170 B
188 B

18ms
17ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMjkxMzEyMjcwMDA1MDYwNTE1OTIyOA%3D%3D&google_push=AXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefuIqXW8aOwfzSNUuYGj4sLyuXN20qSMbKcc

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMjkxMzEyMjcwMDA1MDYwNTE1OTIyOA%3D%3D&google_push=AXcoOmQEArtc1NOgTakX6Snr6_0Sitb1l4uq99sHbzH070qX6O0C-FjmQDRmaT3inEyefuIqXW8aOwfzSNUuYGj4sLyuXN20qSMbKcc
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Fri, 29 Dec 2023 13:12:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 46DF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJM3LZuDfsdWfqFh88-FNZQ&google_cver=1&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizat...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizatgf1uyrWE&google_hm=eS05TVNlLnB4RTJwSGE...

170 B
188 B

41ms
24ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizatgf1uyrWE&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR6FTjrCBSUts1qjT7n_vporK8QMYTR8UNV5i7x-2wJthJXiqrxGvP8ONiVCbqmVbBQuSD0YJOtMPO78CGSSoEizatgf1uyrWE&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 46DF
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESECA4--6JibRTdaYvRdbKWQ0&google_cver=1&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8mMe...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDEyNTM1NTUwMzYzODIyMDkxOA&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8m...

170 B
188 B

49ms
28ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDEyNTM1NTUwMzYzODIyMDkxOA&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8mMeWTd4DyFky9VxyI8KfVIpDGY

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDEyNTM1NTUwMzYzODIyMDkxOA&google_push=AXcoOmSkScMkCLbD9Kk51BF6gyl5nPxlXLQwGsJ4AAjFNB6GnuUMmGerRZagn8k2x_89hQJ7WBfP8mMeWTd4DyFky9VxyI8KfVIpDGY
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame 46DF 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 46DF 0
12 B 44ms
37ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K3BdBmvh7lLxaDtKBtze3xT7EbIEQ-5l9kOsggtWve8AM3WjXfxNU7LUaethgkdJDfpA_Pqg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame A271 199 B
213 B 109ms
11ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 151
content-type: text/html
date: Fri, 29 Dec 2023 13:12:27 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9C3A 0
19 B 73ms
68ms Image
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cm1hrucWOZfmXLp-HmLAPu6i60AfJntKxXPXqoYaIAcCNtwEQASAAYJWSn4KwB4IBF2NhLXB1Yi01OTI4MTYxMDc0Nzc5MzgwyAEJqQKONn5tfo2yPqgDAcgDAqoEowJP0KyQLuz9ilKMiXdJyI6du2qgehOipstObb7tCl_uqxuSJ8qHL5BraOZD1ba5dxD-rJIVuTh06FkBVXHRaWnPrFf4WQ4goJQNDrkOZB250GQTw4lWEpbMMk4y8txjubeigs3BGsJJu_ftJPvbqIiBO_H5Pw_Rv6xtW5q4TTmYx25gs4gx6mSMaVmOL439O66g30LglAY69Hm3TOrAadL32Tk8rfl8PJevC3PCz00Yy-yb_S5q7I8t49DAYPYqKobxid6fvkEvnXADbypxMnl6-HDu5byao5zwg13JpQYJssUaTFE_3wcyRQcC4I_48_0mUBcoJhIZhYv6uuPNF6lpASJu4bMOI6jifAKs6R10DvRLwhfsp3C--X2KgTxNeeIRf-CABrmJku6v4baIQ6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB0IgOGAEBABMgKqAjoCgEBIvf3BOliWl7bE3LSDA4AKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi01OTI4MTYxMDc0Nzc5MzgwGAA&sigh=IsOOpn1fnUg&uach_m=%5BUACH%5D&cid=CAQSPAAvHhf_qXGkFxfYS1cOIAFTHt60LUSwE1fWvAtztSl3WBtadwnhflrGr6DyBX4vgAEXFNHJoD87ENgo9BgB&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1703841910&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fsecurity%2Fclash-of-clans-third-party-app-leak%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703855545407&bpp=3&bdt=347&idt=316&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7989592492653&frm=20&pv=1&ga_vid=384547006.1703855544&ga_sid=1703855546&ga_hid=852126509&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1091&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079438%2C95320868%2C95320884&oid=2&pvsid=1748640853219426&tmod=646771765&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=326
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 9C3A 0
126 B 123ms
9ms Image
text/plain 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kujSFcz6RO0FmAKdg2ICAgAAAA8BY2qYFClNgm-CmxC5xY5l2XXzWpg-xCoBAQAAEgAACgpBUVVEQVFFQkFR&wp=ZY7FuQALi_kABgOfAA6UO7cuZcTPFi9UzLTqBw&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:26 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 148108
server: Kestrel
content-length: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16530502095010416759/ Frame E7A6 16 KB
5 KB 40ms
24ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4498ca1278367e6346a6b5b6a4fdc4a537b27d81f29295ce1cddbfb9ba2f1d8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 274687
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5114
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 08:54:20 GMT
expires: Wed, 25 Dec 2024 08:54:20 GMT
last-modified: Mon, 27 Nov 2023 12:28:24 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5CE2 0
0 98ms
36ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst_pwum8FLIrTrYVVUxRnQ4UGXBqgR1rYG5hdJH9arjXViddxSbRaXY7aCJwi64EU3n0Ic2JnLZE8-NHz9T07XvVBT4gl5uHu7pVfvQW8WWfQUhaQbDqYSH9Fd3uGKud5L6iyzhGK1UaNmLwXNQHGJnb98J63h1Wg52uMX7Lpx5QTIaHuSmBC5H9DzEebFP8NiEjwxZAgjW83CGUf_oBUqUCC2ysnVgZxFbFdD_rqN3X01KTB9h1W4Jt9tnaDE4GbLwkWD5kgEWH-Krl4WOMbIyWlcTD9Wr-WUd7e7wxC5LNFzOvujo8BhHFHbDoHHbC9JQ5WJoaKktTaGctCPY27gW5JrEMJZlvaxw9Y2gyGMIEJSKxXSPuRuwrpqYcwZK26SyCCyJJULYLTFFV-jo-s88gGROi0RAmnxR2dHDQXlst3VQqA9dEmnAWFxoY9aYibl0g5v5HJRze8X2sWm4LlyhtK0e_JV4yuSatc4-owczhdVgifTrOaMl227-ahv6KxZHEzGHkNVjL12QgqSGgRaE--8Vr0e8t07pQJ_AmXyiUu5lh3lKoUukdkZZFXqWkn57Vc4T8Zv7_lBcl6HYuZgK1l6M09q9RpKUdD2FcztanwU1TOAVT_HYK7ilG1FthVNboNg75l4kAiyKcrUHUKP6u7kdvE3Lfbxn9vw8hMI_yOUm00vlbhvZAiEva9TW823hWZEIBMUL0ouO3897XM381ydE2dYZ5MUl0M__V0_0P9kMbhMh2OgSJl_CvxW81J-UoD0_dacbY34SuLQ5eESr660sASSyJ5_qP6lygEhl7qusYqomoukKljXqedH5jkvDM23XpshVH6UcsdErZgcqSF1dd1pCjTrnm5lx2EYnGxX-cbjwFnCNFZAYPf7W1qpafosdxGFHUYkJw3IQ_Nvmm3P5AQi_S9yLC6pVRHLLmDaU2toipDEZZGW7TxbYSCK8ffyAZw7dS5Ewn8XqDoGr4PwrAgOsnJr5YxaSqBFRLTp3RU36_jitxKZ-DAM06cFN_yqtFDlfwiHxdbi-jGmi8WW68dV7fxubXWszpuGR3dhOQoHk0YIxR_Fw4Jc8baEPv43oOommZKpDw7A17Uqgu-oMuouZ03F_c7QPmi_XC4DVtnhbgLVnk5sGODQOK3_LHcz8FmefcwpmjCTwtY-0EuW2KbMuv8TJPBRVBxeHWf2zaRG-on7ZdD54gNDVeShuZcGOiLTEbqIexicb3diZO5QEl6Xl-lUxmkAorvFJcC70FnMNnITAMTrKL9GGCYTTJ6nH_7dMOeulJrfDd4jJDCOYph4qiNwLcb9f9sc26ULZsOsLThERyTiQUSTErQiPj61vJNOkuN-mZsFBxB1tEGw5HEioE7wDJ7hqkOe7UW9VaHA944umGBWRsUYYnXNarZO0uhumxwWGYUY3epp2oXoKBg&sai=AMfl-YRGUg8lfzgStPtNVsNmj95Nrkm2dq12BsJ2dsqCi26Lc_ojMpSu9PMw4bcebwbe2jp4j_CRIJOM23C23G0sXiQOXm_muEXLslbFSAVChnyh8UEX2hwg4uTMNknTwvqKqOeHW0gA13aUIvdzr8j-bEfg2baQBW5w1SIARYRpoF3u6CiASwn270kOkgpkSy8a896xb_uq2ZSZ_7zZq9vrca9AaUaDdRdrh6qoCiRhpTrRwdmN0RfioNnkvA5T4OmYNMYD&sig=Cg0ArKJSzG9Yo5ExKn5xEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=338&cbvp=1&cstd=336&cisv=r20231207.23987&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-77-74-34.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame 5CE2
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=2787657605&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=2787657605&gdpr=&gdp...

42 B
733 B

46ms
45ms

Image
image/gif

54.77.74.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

54.77.74.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-072f93fba.edge-irl1.demdex.com 16 ms
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: Rex22cexRCI=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-0c9232abe.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: 36ZnAtVkSgI=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=206088858&d_placement=381661316&d_campaign=31095477&d_bust=2787657605&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 5CE2 60 B
60 B 96ms
18ms Image
image/gif 213.202.235.9
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=1014932963&extPm=534899094&extCr=20797590123&gdpr=&gdpr_consent=&rnd=2787657605

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.9 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Fri, 29 Dec 2023 13:12:27 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Fr, 29 Dez 2023 01:12:27 GMT
X-ET-Code: 0
Content-Type: image/gif
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp: 923
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cver=1&google_push=AXcoOmTvwZ0G6uQ7FE5pJEw31bSph-RWzYjuTmPL6HRdm3k...

170 B
188 B

41ms
19ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cver=1&google_push=AXcoOmTvwZ0G6uQ7FE5pJEw31bSph-RWzYjuTmPL6HRdm3kulPszV8WnlR-d6YeL8kCMJWFX8ttFBgxMarYTrhnhtp9Mv4LS4KybJw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 29 Dec 2023 13:12:27 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0f7f5cc7c951f6e61@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEI7YUwzlBzkAUyfFXsJDxds&google_cver=1&google_push=AXcoOmTvwZ0G6uQ7FE5pJEw31bSph-RWzYjuTmPL6HRdm3kulPszV8WnlR-d6YeL8kCMJWFX8ttFBgxMarYTrhnhtp9Mv4LS4KybJw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wlk3RnV3QUtjTFZuNVFBTQ==&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmTw2UEY_GYhuwL4kHZqkVckOHXdrO...

170 B
188 B

39ms
31ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wlk3RnV3QUtjTFZuNVFBTQ==&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmTw2UEY_GYhuwL4kHZqkVckOHXdrOmqsfpU2jkigqGToXnM3VFkbuuP3alJ26FCkLPsVHhx1DW8-hXS7QhdYiVvnw0fKbJqZw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220021-FRA
pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703855548.552001,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wlk3RnV3QUtjTFZuNVFBTQ==&google_gid=CAESEFoOV2UQqDu9Y24czNOIADk&google_cver=1&google_push=AXcoOmTw2UEY_GYhuwL4kHZqkVckOHXdrOmqsfpU2jkigqGToXnM3VFkbuuP3alJ26FCkLPsVHhx1DW8-hXS7QhdYiVvnw0fKbJqZw
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEBN3auvwK0SjPkfbMLrpMsc&google_cver=1&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wlyziexI0WQ3nSHXjQ
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wly...

170 B
188 B

29ms
21ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wlyziexI0WQ3nSHXjQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4457DB7E7FA34C40A700B1A6F5DD4EA5&google_push=AXcoOmSNH1vcLt0TKUHup6l6qifA7WxfNEqhBvnSz5CqhiGGy7Ihb1GXHc7spDIz4t1H6Uegl9VPjMuVq328wlyziexI0WQ3nSHXjQ
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 28 Dec 2023 13:12:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEBNWG0jyXxK_gl9jh6Fii6Q&google_cver=1&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYR...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYRGhjl...

170 B
188 B

28ms
27ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYRGhjll69Vi90xaYTw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmSXE813_W8NxCISDXHz8KRv1IXUaG5G-NW9reKp1yqJArcNJ83eJaZL1-8RBYAVkXXv77aPukyUym-FYRGhjll69Vi90xaYTw
Date: Fri, 29 Dec 2023 13:12:27 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJCdtxcSMwnzsrHLimO4738&google_cver=1&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB0OfXZRA&google_hm=eS05TVNlLnB4RTJwSGEy...

170 B
188 B

37ms
33ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB0OfXZRA&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRcZhkdeSulffo-HVH_JOInzuNc9ST-lY6r4z7wqHMFEe3V7RLeM0hC2q6upXQCIuUzsKA-0XjG51SS_6YZF030lFB0OfXZRA&google_hm=eS05TVNlLnB4RTJwSGEyTFhfVVM0ZlR5Q0VNT2Jpd2FnUH5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 8550 43 B
362 B 49ms
0ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQz5HGAKt9G-puAMHhK4Wo__KcXewnjdwboaiYg0H0_6KzFOVePM2wQL352SKInTxu4kJiczqIuH1BgWlGNeojrqgF2mvXs&google_gid=CAESEFRXELtIT7MZyHUIyXUU7SY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:26 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 229991
expires: Fri, 29 Dec 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8550
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMTNPsAmVgrgSawiA1r1MZw&google_cver=1&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuheif...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjM3NTA3NDI0MTg5MDI4NTg1Mg&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuhe...

170 B
188 B

37ms
32ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjM3NTA3NDI0MTg5MDI4NTg1Mg&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuheifY4kDP3eX2v4rhkLLKToh

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjM3NTA3NDI0MTg5MDI4NTg1Mg&google_push=AXcoOmT-LyV5tBmmuzCKPgdOv0suV8DBEIPeT1-PsW5M7V1BuJeg1xQ7rk4TBqm9s9CpcV-BsNYuheifY4kDP3eX2v4rhkLLKToh
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8550 0
12 B 52ms
38ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KtbTGJLlU834kg8ce4HHm3Xby5klyVohePQjNl7J-su1qsHF2dPBj_oplXX1uFu-onKCjJ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E490 236 KB
63 KB 66ms
40ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 13:12:27 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.11.3/ Frame E490 69 KB
25 KB 63ms
0ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.11.3/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

386a292b805ec5376c149711c08d9013658fd08879a7ac9a62a99e14310c397a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1788900
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25150
last-modified: Tue, 04 Oct 2022 19:36:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "633c8b2b-623e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=onWukPBSptwupDcPtJRc4sdOLt2KOfmF7vCgXROy%2BQ1JTG9mTfuS3IDmZSH%2BMHkwvrLROj8YrlrzK%2FDDA0FMjCFqPGfn7b3Usw8wEfElgHCGMuqUvu632VsZ1J3l6q0Ft4mWMZMbO9F0LkNDaDq2cGnH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83d24b74496939d3-FRA
expires: Wed, 18 Dec 2024 13:12:27 GMT

GET
H3 200 snow.js Show response
s0.2mdn.net/sadbundle/16530502095010416759/js/ Frame E490 2 KB
934 B 53ms
26ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16530502095010416759/js/snow.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af937ad852768902bbdb3918052da1553ad921cf5aaab2c9170f8ccb46c5e014

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 24 Dec 2024 20:45:55 GMT
date: Mon, 25 Dec 2023 20:45:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318392
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 904
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 12:28:24 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DE68
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

30ms
25ms

Document
text/html

2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:27 GMT
expires: Fri, 29 Dec 2023 13:12:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 29 Dec 2023 13:12:27 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame D0F8
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CK4TLucWOZaPZL7XvmLAPoJOO0AObpc3ndMfL_POFEtiJhZ4LEAEgttfpe2CVkp-CsAegAY_GhKcpyAECqQKONn5tfo2yPqgDAcgDyQSqBKwCT9B8nRd7GDLctTSoWOBUPo24WacnyDNoYG8...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223934091204151352491%22,%22debug_reporting%22:true,%22destination%22:%22https://all-downloads.com%22,%22event_report_window...

0
0

64ms
41ms

Fetch
text/css

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223934091204151352491%22,%22debug_reporting%22:true,%22destination%22:%22https://all-downloads.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211087717135%22],%2222%22:[%22true%22],%224%22:[%2212-29%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215903596673284610465%22}&andc=true

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:28 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"3934091204151352491","debug_reporting":true,"destination":"https://all-downloads.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11087717135"],"22":["true"],"4":["12-29"],"6":["true"]},"priority":"500","source_event_id":"15903596673284610465"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 29 Dec 2023 13:12:28 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"3934091204151352491","debug_reporting":true,"destination":"https://all-downloads.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11087717135"],"22":["true"],"4":["12-29"],"6":["true"]},"priority":"500","source_event_id":"15903596673284610465"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 85C1 38 KB
13 KB 33ms
11ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 255108
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB25 0
20 B 64ms
42ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3425087385039&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB25 0
20 B 63ms
41ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3425087385039&version=m202309260101&ct=119&x=1&cor=6066719183110550000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DB25 91 KB
38 KB 53ms
48ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DU1tAoKIHoVa_YON_cUS-8K6esgaBAeipNIMB8L2L7xhiesiYPPpQdS6dQHFirHhye4v16IJbg0Mb79TdJg1s5u4lrz-VaEchCw5-NEFoBCUxRbL7SwPtuAz_oIy4X7kLrKKy3brot8nFLXwBomC0VkAbJYz-z8pHN8FWWzKURKlerqlifeRkxdStv05A8yk8nqupr&cry=1&dbm_d=AKAmf-BWKUxYF1JjujkTMtfXE54SqMFJWZguKa3NU_QlvWRXouZ50CVXC4iH2fiQId4Et3TR_8D44Kn7GoYdk13W9HKVdt7O9sJsnpEGdT4OmP_pMO0hELlcxqrYNAcUyJmiMLvwUDBW5t0Jhf5fV55pcLR4g1LyH5KvZPfQYYSKXDOXnGDBNw_ZXo8XZCxhNCuCWCE0dhX3_0xREYUfcTbDm4h02Ad-PKjrNd6eu5W-6aLBVs8gJMEmfKrPCGerEX8v0VEZ8q0RLvsJEzEpxB0d5MMjpH7uxDAPBTQkBfst5Gt9f-PHJNoyfEK-3yfJZ_zvjNLvD9GbUJmsuQFoAp1Wu3sAcChM7xb7fq9nHZkbE6K7MnvCOYsSf4tHRWij5dT3KCxBUArSVXNn5hQcdVQLHYtf-pSIWTCJaNV1spqPp_-zXXS5ESmSjDCTEZXsWy5hBSf3i2pB-kgPIP6Y2A2JXXNX03Tmb4Yu2lO8QbvlPsVgI6UvxvV6z6l_KOUFVHHdvSKPogvQqI-FzjZiIer7kyM2aQb_yHcE-EuNXhNHNQrMBkbdU0FeTRn5eItBeAOvffNephjx6uN5eNoBDhXJTUVEkemLj-JfsjoKzcv_G7iDGm7Evv3xvW1ufoQTwD0kT9k4mcV6GsCAr6YVqI25vxOIP3vTUdtELW3faTaTYrqY8dm59BoN3QV5znK-HtQdGflkM1SrnYboaCRotpo-WUnc9AoOX6d0y9roYO-7Etd5o1sweGPDquuu6vIABNrJZA8yKHEedolnk8dk-_k7gxPqHxKzYBXStEncUQTCQswpnGOjYCCHnjXL_Y6eATd1oTCO6ibccT5jBGEXO8vxVUusemqbo94oUASocraeiYJ_t-ac-raRo1o1HZbARk9j7xqDmmwwbGfIxB8nGfMx3tQmPQehiCgKJCNosKpQXeMokNF4iv-r8dwi-z6rKccqUpuWEQmKs3dVUYaiLdYTtPWLEisjV54ct_SBmDbFTYLEOk-U6TyLRdN8UMWJRUs0AiRRfod23Wg4hJYi8Vywj2-thPcvCS0k7AY2yw-BzcOpswHNtik9Pr-Edf18VZ4wQAE0wp_1gOu4wTJ8MxL9P523O5B_6cZ7A4-VrYCzLoDXf5x4i5BTr6us1fPczt3PujFOmzgU0M6ARECYdUmQec1aWNbY7FYTNiL0OSAZ4zUEqVbCVgMJndM9dZy-pbkNLiPiKAOOzHeqeEXHEJ6QaOYcb2Pn1bJYCi6QIstlVi6hr2zkP_pZMwAIBRyLHRpKbZSJSj5fFSg3iaFjuvWpyB6Z67rp_ydzxvZs8BeCTqKFflSlVAQNAOoz7mluSeJ9p7bCVasUYIkUKGDmb1hqsbYlBfQekZnKr38MtGzYT4TOgUssVnqN6RUrwQFnMpDlajU8OUVaeWts1r9tw4v8iZvuzEVJg-0wNm4CP9wrBIVvaW-53NvLhhyASTIm1Rm8kSp0YoZKLkVrZcM83PXMvK_-PkQLPyjFGw7qBHiTdFSViBu1MiYWh15ytzpJYJ0M4Ik6GTABlDnv1o4rR32Ns6_cu9NCi323_Tw-lLjr_RHoDjXFNnXoGtYNOJUSs503772m_A9FOwsfHkgXaoREiKDe4RJVHwN1GLuPu5veqTYFQJUCZQFj45Hx2uHPYCqjUt9iWagX_qTXewbvd10cMOgD7hB0XmxsdV6UWuEUHYQ18OlZ0MLA307MhGNaSATYWKQFkmM8PCdhGqZ5ZwCOTTNZhL_SPwB4k2CphRYlslvhRlAio1BwJDGFp0HR9nfGFdTuRD9wvaqslfFbM7y-0dU-Fx1YuQ2GeiTZQQXS-m-R09lml3DPI54Xku-Uq_p7kvCe3cXsuTLvS4ELIxZ-RxXDMDAD2bYaqvalIsSBus2jv_cTGq4yp-aTVohofk1Tfkgdd15bJ_wKEQYMI4iiUD6Bu_BNJ7-K43Y5xON2GZymYqf01AReuCJAzzjED3UA_vO7fFArhH0bEOtpwh9tBLKSqSJ1lUd-u1pqOiDr_PU_sqBpqmmMGgP-1CvwUQGnzHPEadD2TOhAWE_wV0aCpd_0_ZVPE7HNydGGs9cwh7rbCwQI12zBgu0aUZMKzi_VgIxPG2i1PiWE1WLjlljDiY-SZbjJjn_3KwzZpB6zQVWx9lrH5lKAgIAaAuh5L62Zjbn1hdHjhVZYPB9lp_GksxHBhTmuJ-HLg5AI5jeHx5VdwZdU7UNthOqR_vGx6oNVhDATuas2nffP06yjyTYaV1L2cEdQF6ND81VWUDc_VamalUJ92pNFbhCdZkva8b-UruPSgssY1DNDNTP22B3Unmu3rkupS226VhewgNtOSQHXRKyjUwJev9DJRsikz8z_AiVQi7yzfA6ov6UYIMNGkZ6q79pPcZKJjEVkWJ2U6bKGcgdoMAeqUxlpn-7euM3RVWipFy91Zb-GXsS36xvD8dGJTf9TR0L7rEjCiWnCFVjU-I2TzdrrXAZc04_V6JHmuweOlB7aCvBT4RnKM9inn91zosJKYTY9oe5mgDEVCUKdAi7_1B9GdTwDdKpS0VdmJ7L6mz44R-56fu3v9xt4loXSFYzguunlC0z-KTKBk1VnXZF63OGXyvYGUxdiNi1dUgONBeWP9KaOJSRw6OHF1guxggJdHmYCraJJQlKv2xJnUOyB1l3oM3nz-8z7fhD3VJidBLdeGIvbN_jgM_uFvsgh_h6n8YOCgA8ODy10zEIuJNvn_bt4qrpHOnIqdc8eyqE02WGkZdNpR4U7sHxfWTrpUcPZCH1WXsV-I7CrFB53UdoH2kGZyrC0Ww8YqikWxOIbaOLPlyoxLWLlBiUpcf2XpTbYcmW-Di2jv5aj4johXAHzQiSvIPtAl6jUHQZ_Hb8_Aas4M4yXM3KE4UoGO9evdgcp83f0eNo3tUMvr0tCUiaxn2Ps3zp5PwpxB6my3krj7aadl_bpz8bYhcrlavUW0i4UmfpW_fGCAwyvYSWaAeodcndRL2Oh-MYuUXi_KhCYA7hQkP114-ao3qFPvul8Bpg7iNUQ5A2tNH-C3n8mTGzw9r-uX_7phj1dzatdOWZRT7Dq9RsqUrPKEZUmp3lQzVVGwMJP1ELGzUTucLkw__ayCFeWdmopNxfhhBNHzHfKIMAvk_p_aNYbkx7xh4GjxDgeSuQCO21akt_Oa49vCAPcyU8avm6pKoFBztUiRoBcbFR_gb5jdjpdeaWIrX4hBeySVtipvMUR5i8HIAGtGmmTseTp7OgnWWCx8MuT_0SqzoMLkRoIXJbEtL3elpFP5jYz1htVY6QhRB50aniiVv69eDTMorTmQUiehTLImENpceH7I8V_N_8VpgdIKaM9iNeUuG5o2NUUuenXUM-vIrjdLBgarRWhpeL1Msja0ZM6WVNEYJn5Xzi4jw8igjzla2ymYxdJvXtm8iC3869yEOlQNnG-g1YU68rMl31sextUiyFKw-YF5AqCFnxFj-4pkk1aBFc4gI0mxmbGqnTKbwsj9pbK47J0jBa1ACjySu-WTcsnhw-19fTZV5ACx0ao8FTDmyn2yO1TELkwCBDcOa6Kb0ICFm8oS6giN2tJybJqrueEdOi7tgdzK89Hx5Ws9PxEDzH8XlDts2Y1O49ysZPd1E0pxOrDzdH_VtVcD8KEZcauKdKd5iHhJngagmitf-X2CV0DV5uGbZamfW2SIqkOExYswNNzLXiXvmU8xwr5586Wd7vD8juxe_R3l0dug71eR2ClqRSyKvz0-7nFr_4WFSa-W7mB6ovQgxvk5T_4Gn1OFqRfAbBF5R-PLKgGup8u6fP2e-KNlcxNKt3muYbCcsklNmzhxEHq3FbbS-t71mWk0y46rnGfxu-1ZZ3t5dKoMRz4RyWzjzr2q8ntglVFnLy76bvoWlZaFDKm3DQpq5TWGS5Xg7RSUzMdjJ1bxGoUtqIlYWduH74kZN_dE6khZ0RqJdQ2sa4okeGvACwFa3jo1Og_Um8ARFsCmrvEZ2vnr8dlWYq9e3Q7GvHQ5dRP_bXK1lvL7H_ftu-jKo-V5XmIa_DdgIeyBPyXSphXxrpPupU-jaKh0vocejHO6ONVUeJDp_xrFb4O7HP1oQ9D18IbW5aGUbojAXaeqYr9-uyFYrUxKonHsFxGIJtZana9Phcn6J8Qy2mAqsNlqxmXySPbPOrYb3-LFgSHYX9biuchFRun7l8zC6ObuwfIK2tPFR0kv-XpAo9e4r5L8q2FZI9gopXX2rieomiHRzoS1-1gfg&cid=CAQSOwAvHhf_DVzZZ7v0MZNIruzQk8S7nIEQHRr7INuh-PPeCTEVYM6P7S_VlHR8ACPn5rge1eBYjEHuDEzWGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=6066719183110550000&adk=3690638928&idt=126&cac=0&dtd=35

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d75bb752582941bb230a51941b4efa0e9cafe308d99d3a6673b9b7a9f4183de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38893
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame E7A6 236 KB
63 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 13:12:27 GMT

GET
H3 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.11.3/ Frame E7A6 69 KB
25 KB 21ms
20ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.11.3/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

386a292b805ec5376c149711c08d9013658fd08879a7ac9a62a99e14310c397a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4009376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25150
last-modified: Tue, 04 Oct 2022 19:36:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "633c8b2b-623e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BtCPZWupYKcM3j1GtWCv2N67P5MrPUg4O9LmxuMXevyXq391%2F%2BX8DeuLwzZ%2Fwdkx%2BOXp4DJ2lq1tA53Tnm%2FWpYFfTRoW4C8okDis8XyCxzvVnx8FiP%2FKstpJpEcXTk8fIX%2BeBF2sbIEntYFFMDc%2FlApz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83d24b75389e6928-FRA
expires: Wed, 18 Dec 2024 13:12:27 GMT

GET
H3 200 snow.js Show response
s0.2mdn.net/sadbundle/16530502095010416759/js/ Frame E7A6 2 KB
934 B 8ms
7ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16530502095010416759/js/snow.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af937ad852768902bbdb3918052da1553ad921cf5aaab2c9170f8ccb46c5e014

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16530502095010416759/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 24 Dec 2024 20:45:55 GMT
date: Mon, 25 Dec 2023 20:45:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318392
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 904
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 12:28:24 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 277ms
40ms Preflight
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 29 Dec 2023 13:12:28 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DB25 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
Origin: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59149
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 20:46:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame DB25 11 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DU1tAoKIHoVa_YON_cUS-8K6esgaBAeipNIMB8L2L7xhiesiYPPpQdS6dQHFirHhye4v16IJbg0Mb79TdJg1s5u4lrz-VaEchCw5-NEFoBCUxRbL7SwPtuAz_oIy4X7kLrKKy3brot8nFLXwBomC0VkAbJYz-z8pHN8FWWzKURKlerqlifeRkxdStv05A8yk8nqupr&cry=1&dbm_d=AKAmf-BWKUxYF1JjujkTMtfXE54SqMFJWZguKa3NU_QlvWRXouZ50CVXC4iH2fiQId4Et3TR_8D44Kn7GoYdk13W9HKVdt7O9sJsnpEGdT4OmP_pMO0hELlcxqrYNAcUyJmiMLvwUDBW5t0Jhf5fV55pcLR4g1LyH5KvZPfQYYSKXDOXnGDBNw_ZXo8XZCxhNCuCWCE0dhX3_0xREYUfcTbDm4h02Ad-PKjrNd6eu5W-6aLBVs8gJMEmfKrPCGerEX8v0VEZ8q0RLvsJEzEpxB0d5MMjpH7uxDAPBTQkBfst5Gt9f-PHJNoyfEK-3yfJZ_zvjNLvD9GbUJmsuQFoAp1Wu3sAcChM7xb7fq9nHZkbE6K7MnvCOYsSf4tHRWij5dT3KCxBUArSVXNn5hQcdVQLHYtf-pSIWTCJaNV1spqPp_-zXXS5ESmSjDCTEZXsWy5hBSf3i2pB-kgPIP6Y2A2JXXNX03Tmb4Yu2lO8QbvlPsVgI6UvxvV6z6l_KOUFVHHdvSKPogvQqI-FzjZiIer7kyM2aQb_yHcE-EuNXhNHNQrMBkbdU0FeTRn5eItBeAOvffNephjx6uN5eNoBDhXJTUVEkemLj-JfsjoKzcv_G7iDGm7Evv3xvW1ufoQTwD0kT9k4mcV6GsCAr6YVqI25vxOIP3vTUdtELW3faTaTYrqY8dm59BoN3QV5znK-HtQdGflkM1SrnYboaCRotpo-WUnc9AoOX6d0y9roYO-7Etd5o1sweGPDquuu6vIABNrJZA8yKHEedolnk8dk-_k7gxPqHxKzYBXStEncUQTCQswpnGOjYCCHnjXL_Y6eATd1oTCO6ibccT5jBGEXO8vxVUusemqbo94oUASocraeiYJ_t-ac-raRo1o1HZbARk9j7xqDmmwwbGfIxB8nGfMx3tQmPQehiCgKJCNosKpQXeMokNF4iv-r8dwi-z6rKccqUpuWEQmKs3dVUYaiLdYTtPWLEisjV54ct_SBmDbFTYLEOk-U6TyLRdN8UMWJRUs0AiRRfod23Wg4hJYi8Vywj2-thPcvCS0k7AY2yw-BzcOpswHNtik9Pr-Edf18VZ4wQAE0wp_1gOu4wTJ8MxL9P523O5B_6cZ7A4-VrYCzLoDXf5x4i5BTr6us1fPczt3PujFOmzgU0M6ARECYdUmQec1aWNbY7FYTNiL0OSAZ4zUEqVbCVgMJndM9dZy-pbkNLiPiKAOOzHeqeEXHEJ6QaOYcb2Pn1bJYCi6QIstlVi6hr2zkP_pZMwAIBRyLHRpKbZSJSj5fFSg3iaFjuvWpyB6Z67rp_ydzxvZs8BeCTqKFflSlVAQNAOoz7mluSeJ9p7bCVasUYIkUKGDmb1hqsbYlBfQekZnKr38MtGzYT4TOgUssVnqN6RUrwQFnMpDlajU8OUVaeWts1r9tw4v8iZvuzEVJg-0wNm4CP9wrBIVvaW-53NvLhhyASTIm1Rm8kSp0YoZKLkVrZcM83PXMvK_-PkQLPyjFGw7qBHiTdFSViBu1MiYWh15ytzpJYJ0M4Ik6GTABlDnv1o4rR32Ns6_cu9NCi323_Tw-lLjr_RHoDjXFNnXoGtYNOJUSs503772m_A9FOwsfHkgXaoREiKDe4RJVHwN1GLuPu5veqTYFQJUCZQFj45Hx2uHPYCqjUt9iWagX_qTXewbvd10cMOgD7hB0XmxsdV6UWuEUHYQ18OlZ0MLA307MhGNaSATYWKQFkmM8PCdhGqZ5ZwCOTTNZhL_SPwB4k2CphRYlslvhRlAio1BwJDGFp0HR9nfGFdTuRD9wvaqslfFbM7y-0dU-Fx1YuQ2GeiTZQQXS-m-R09lml3DPI54Xku-Uq_p7kvCe3cXsuTLvS4ELIxZ-RxXDMDAD2bYaqvalIsSBus2jv_cTGq4yp-aTVohofk1Tfkgdd15bJ_wKEQYMI4iiUD6Bu_BNJ7-K43Y5xON2GZymYqf01AReuCJAzzjED3UA_vO7fFArhH0bEOtpwh9tBLKSqSJ1lUd-u1pqOiDr_PU_sqBpqmmMGgP-1CvwUQGnzHPEadD2TOhAWE_wV0aCpd_0_ZVPE7HNydGGs9cwh7rbCwQI12zBgu0aUZMKzi_VgIxPG2i1PiWE1WLjlljDiY-SZbjJjn_3KwzZpB6zQVWx9lrH5lKAgIAaAuh5L62Zjbn1hdHjhVZYPB9lp_GksxHBhTmuJ-HLg5AI5jeHx5VdwZdU7UNthOqR_vGx6oNVhDATuas2nffP06yjyTYaV1L2cEdQF6ND81VWUDc_VamalUJ92pNFbhCdZkva8b-UruPSgssY1DNDNTP22B3Unmu3rkupS226VhewgNtOSQHXRKyjUwJev9DJRsikz8z_AiVQi7yzfA6ov6UYIMNGkZ6q79pPcZKJjEVkWJ2U6bKGcgdoMAeqUxlpn-7euM3RVWipFy91Zb-GXsS36xvD8dGJTf9TR0L7rEjCiWnCFVjU-I2TzdrrXAZc04_V6JHmuweOlB7aCvBT4RnKM9inn91zosJKYTY9oe5mgDEVCUKdAi7_1B9GdTwDdKpS0VdmJ7L6mz44R-56fu3v9xt4loXSFYzguunlC0z-KTKBk1VnXZF63OGXyvYGUxdiNi1dUgONBeWP9KaOJSRw6OHF1guxggJdHmYCraJJQlKv2xJnUOyB1l3oM3nz-8z7fhD3VJidBLdeGIvbN_jgM_uFvsgh_h6n8YOCgA8ODy10zEIuJNvn_bt4qrpHOnIqdc8eyqE02WGkZdNpR4U7sHxfWTrpUcPZCH1WXsV-I7CrFB53UdoH2kGZyrC0Ww8YqikWxOIbaOLPlyoxLWLlBiUpcf2XpTbYcmW-Di2jv5aj4johXAHzQiSvIPtAl6jUHQZ_Hb8_Aas4M4yXM3KE4UoGO9evdgcp83f0eNo3tUMvr0tCUiaxn2Ps3zp5PwpxB6my3krj7aadl_bpz8bYhcrlavUW0i4UmfpW_fGCAwyvYSWaAeodcndRL2Oh-MYuUXi_KhCYA7hQkP114-ao3qFPvul8Bpg7iNUQ5A2tNH-C3n8mTGzw9r-uX_7phj1dzatdOWZRT7Dq9RsqUrPKEZUmp3lQzVVGwMJP1ELGzUTucLkw__ayCFeWdmopNxfhhBNHzHfKIMAvk_p_aNYbkx7xh4GjxDgeSuQCO21akt_Oa49vCAPcyU8avm6pKoFBztUiRoBcbFR_gb5jdjpdeaWIrX4hBeySVtipvMUR5i8HIAGtGmmTseTp7OgnWWCx8MuT_0SqzoMLkRoIXJbEtL3elpFP5jYz1htVY6QhRB50aniiVv69eDTMorTmQUiehTLImENpceH7I8V_N_8VpgdIKaM9iNeUuG5o2NUUuenXUM-vIrjdLBgarRWhpeL1Msja0ZM6WVNEYJn5Xzi4jw8igjzla2ymYxdJvXtm8iC3869yEOlQNnG-g1YU68rMl31sextUiyFKw-YF5AqCFnxFj-4pkk1aBFc4gI0mxmbGqnTKbwsj9pbK47J0jBa1ACjySu-WTcsnhw-19fTZV5ACx0ao8FTDmyn2yO1TELkwCBDcOa6Kb0ICFm8oS6giN2tJybJqrueEdOi7tgdzK89Hx5Ws9PxEDzH8XlDts2Y1O49ysZPd1E0pxOrDzdH_VtVcD8KEZcauKdKd5iHhJngagmitf-X2CV0DV5uGbZamfW2SIqkOExYswNNzLXiXvmU8xwr5586Wd7vD8juxe_R3l0dug71eR2ClqRSyKvz0-7nFr_4WFSa-W7mB6ovQgxvk5T_4Gn1OFqRfAbBF5R-PLKgGup8u6fP2e-KNlcxNKt3muYbCcsklNmzhxEHq3FbbS-t71mWk0y46rnGfxu-1ZZ3t5dKoMRz4RyWzjzr2q8ntglVFnLy76bvoWlZaFDKm3DQpq5TWGS5Xg7RSUzMdjJ1bxGoUtqIlYWduH74kZN_dE6khZ0RqJdQ2sa4okeGvACwFa3jo1Og_Um8ARFsCmrvEZ2vnr8dlWYq9e3Q7GvHQ5dRP_bXK1lvL7H_ftu-jKo-V5XmIa_DdgIeyBPyXSphXxrpPupU-jaKh0vocejHO6ONVUeJDp_xrFb4O7HP1oQ9D18IbW5aGUbojAXaeqYr9-uyFYrUxKonHsFxGIJtZana9Phcn6J8Qy2mAqsNlqxmXySPbPOrYb3-LFgSHYX9biuchFRun7l8zC6ObuwfIK2tPFR0kv-XpAo9e4r5L8q2FZI9gopXX2rieomiHRzoS1-1gfg&cid=CAQSOwAvHhf_DVzZZ7v0MZNIruzQk8S7nIEQHRr7INuh-PPeCTEVYM6P7S_VlHR8ACPn5rge1eBYjEHuDEzWGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=6066719183110550000&adk=3690638928&idt=126&cac=0&dtd=35

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 03:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34580
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 12 Jan 2024 03:36:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame DB25 31 KB
12 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59400
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DB25 41 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 256991
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D3F5 16 KB
6 KB 60ms
10ms Document
text/html 2.19.244.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.244.232 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-244-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=88902
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Fri, 29 Dec 2023 13:12:28 GMT
expires: Sat, 30 Dec 2023 13:54:10 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame E317 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 09:53:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 28 Dec 2024 09:53:59 GMT

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame F32B 51 KB
19 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 05:12:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 288017
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Dec 2024 05:12:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 697F 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59553
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 28 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Fri, 29 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DB25 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90c32192da3969b916abfa618bfbac852976a22b1d721fbaa9b09badeaf2cf55

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2511 0
0 46ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssRLwQoUsPSfeYgJklBby0SzveC7Ed1BZnhP6vaC_UtKF9AiDSz-2QR1lEMMpzaT6-bSIG8flipVOL2dwR8ZXgluJJ-ooZ-bvYfZ452dkWaLrFCRF_-GhOZXGheSjxeRtNgjcK-yc7KURJ0CZNmGzqrasamghdAn3QLvAHrRGRiY4Tt8TPYghQ9RteHdtW4oRepTG5gntfvtoDnn1ee2p-BpuxRYkyWplwdslLI30nQ0tP0rQyAp36qmlawnLSb-b6y5nNnNxkxufW7dt5PY8FuPgKwlFY-b_5OMO88pYre6N9Iza0vxnwhyITLyTL5ENeKcYFBLPwlL2yevZtSzBqVz5s33nT-4wiz7jj8UIF7v24X3FQMYdZJY6YPMBrFA2iepjXOFW0st0n8OWojMcpdGCEwj4VOQ5QyPZqFo7fiocKBCBuRFQ6uBSCClltjwOVOspGA9zM9cK-zTEuuqztkjq2bjmoVsxoUnU2Mh-eLwaPwWssbLMf3P6UVe7CRIal1E3hon4jZl1PTd92xaHYpdt5uEzlyr8beDF1Km8DEfGqoYtk6v5wngdUPnFvw8b00__-F15UmiKLPxiyAqcPQ2JXi5mYbO5uKy-F-Q1mEB69JRF4qwCH8UTz32IEYcVBWNOdJ4aeYIgD-CQfmf3B-2wuBz3-GyiF6BlXwsYuQ97rjanHfvxPB_7YAEI0ECi2PJB4eszj1RKFxfGkrHm6lAwtl9mMs9pibOLxHcFWFbG5XR8OvMj8CvMO2MKXF-f1XlTFbrgvDiNEQ8Tj568Z2_dyc7TzC3p0tz8cpZvggZWa_qqm40rg-nwf5ehdE1AZ21nT1ZdKhJBimToZJ9UNsqvw4FRpCEZMppieMgkdA3--4wGC2SNFCHzWvJV4lQFvahBMiu4yGURZmdbV_Qi1hRMVRruWUOgnnVEyaH9ubrd2MwoAs2Kj2h7mryYrjg0i7A4tjq_2Qkl3ui6OAsMb2IHCcosSBIOlVyicTqQSFtHM2koLBehJRAQKf9iUQDJjLcEEw0Vw-ZRS_g0bsS5mxS74SOMT7omSEFUo7iKDscyv5hlrPRZsCuIqT_GlM1BGx0hjaTTnMbx-gHen2JjksnEcHgXy2BXsAt8ZArMsqOOjAs5w-Z9CGJp-I_NlE8n7FbWYk7t8T0NEDKqis32AjCUP15JytG5LGuG9P6U8KoVWOprAw9lWLi6Bvj3C0mjJFoi3Luec-kU26PCrq2IwULLjWLMKCnwBsDo2HkhBE1_EjUK4bahZA6MKQiRRiiFeBB0HaxUe7mAmUlbI97k3ZjuZFP9IFtU7evCRHpP9uCBTx9mDWisOTYn90c8a0G3V7j_HprDuPk5pIUeTj9phwK_wmvrtwco4urGYkW4-_OoZEbaAgSbHFSTSshCvHvUFJm2VE8Vx_ePTP_SL8z9u7naQImA&sai=AMfl-YQAXgF-KZfk6epAlMu0wiGv7jDb6KhZe2GoVGiiwF2OAqCiobw-hpg03VKUA96qvEvbuU6C4E0IvBYLLiyGQg-SilQwIWpkWnlHpQx97U4txydcGrw7sC4ahCT5oJsoLaBQa19dlb0qhGF50iId4WmCOKNwSdFhPmdnwaIhv4xv-KBGJyqbnqo2Dl7V1S4ilLgIV076Q3aHsdGkhZkzeAn7kEibmk2q158eTCWJi2DcFMLgfU_Qfr14373VzovSon0p&sig=Cg0ArKJSzAL6VFnzAgFUEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=894&vt=11&dtpt=425&dett=3&cstd=465&cisv=r20231207.63752&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 85C1 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 09:53:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 28 Dec 2024 09:53:59 GMT

GET
DATA 200
OK truncated
/ Frame 2511 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd45cd408e1a85b14c90d9a1296bbb204d658885816e4c1d7427e3b9c5e00aaf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7767053680059827245/ Frame 5E67 79 KB
20 KB 9ms
7ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7767053680059827245/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfd9f6a9a843989168bacd471b39283276b11f104e4d4a382076f61e1d32a973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 274581
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 20396
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 08:56:07 GMT
expires: Wed, 25 Dec 2024 08:56:07 GMT
last-modified: Wed, 09 Aug 2023 13:02:53 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DB25 0
0 54ms
53ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvbSVBDRtRfpcTFBSPw34-91YaiGj8ZRvOT7c95dWNDG_PYYXXuhpt8kR428qFpV8p9fdsy0U14f1q119mmzJqh49ehBlZhRy6heP5upZWXSe6IMoR6IUO8fzcQ0Lvh5ojYXd8zRXeUXCqCWbTLqGCYYbMSTkvAGk93lEhFmXvOXO1pjb87v5i-ByEYVv0_wZBJcya9YBZmPclzfBCPUnC9HV06WvRqjOqJjdxe-D1qeG9zuj_Y8t8VmTFfYmezRe57hJSyDlrtq9SHgY9f5aPuEchoFiQi84H6nl_M7F48HiqHtjuJYtU0qoo4SqEkLSvjNWzeN7y6L4Wq4BXBXmVl7Q5r7XW-nN9r4eWkphkVj_mCn1kZw4UHDUX6GTzOGhszg32RwioyD738yCBQGL-hq-eYxESzfpw9Bexsp1n7w9367fegTiPZ20gPx_GQNZ4RJm5Og3qKspIN6N0-bxCerwp4Vueem4pLZjEI7Lkjm9dt0cugnVkkHAV2wnwbMi09ZuDiDQY-mFqrdARPKHUgv7zKBuPAfdcfZ898hcsljaYd_P5Zw1p1YtWGngzImXijaqa_k_vct7ZZviQ_DyODviYbcw7Jr3jr_DBJrgok21EA_soD_AKFFvZZAc91Uhy6dFzEFlijQYYUGWT76hzMjpf7VIIoKDRoQgFomhs7HoU9lT2Eoos32yGm-97KEieiCf5XX7X60jxY-oLenpKfu69TKkfOnR109KVXRDvsomv4buexdRs6KDzF4WJmk_0hzjxGDrXhwKgVjkKip-g1dFq3_HtxQfUCXJA4fJ37LdOwc2XlZUAhzZM8G40EDfLxtgmVzVozr9O9GIHJJt6VGRhyNRqKCUv0ak7gTz4rG7iPl9OG5tl6Sakh-_lYFTkA4ntfBxTcEoB7ivtU4_ZX2WOi9N9Qqe0sQhmTOHwMEendSRHexO6xvxQVZ-76xK6hdKZjb0Rsoud09oc41FVA5jpLlmkncDAT18Z2_Eyuj00_zXHjwVff-Hj4YHE7zmSdgbGygRxYdV3JkXlMBZKmlECT4IrzGAvYxkR6vwJkrv-gRvnbqvvGTvgIgRxRkRF8yX5pPbROICqExu_83M8JgJYpGOkbyRcqZZWVKeWWM5CLW2A90UXHOkP0CHOmzp393c4xxa0VhmQKmWJ-656zNEwbCq4EJk4nf0Fj5LjPP9UmfeCxryIavehdOVvaNfIJB7Lfg2d395UZSpi9sMmrjSy6-HfPZdiE7m-CJO4hFEZ8JzNKVYQcmzryyW8vViNhiL96DVnazl6YAKfFX-csEiFvegpu2oXC19MqFru7RsQDm5KhJhC0dr6HBc6PzKRh4LpkOFVBtRXZc7SJAT0I6jtqBjDYxrGncjGbWnoBuos5ByEkM7CuNRK3B3PkMDnMmTPfERkZdJQ_7NcUnIeul_IPb9O-LVmWKdjs&sai=AMfl-YRFVJ5-_TvKO8rjMr8JoSthUpkKLaXFfclkrs_xtw4flkDTPmHwCxhGPFtBKudACMEb_B_nd6folKFYA2j745radHg1WLe1-at7wKQyfwUgoTcsTFwhEV1dzG86_Qw6MxDr1Efxn0GRKa60DVbrNSJ6hTr34TIT8uQ7Nv_05YlOFWLalW8NqDhun8ITuR-sBL_x1cTZX3FdaeSZScS5L3Dytow2KYAIFHUpYEVnJJMaB0psPZGYteHBBVujMoq5ReM0&sig=Cg0ArKJSzF-I0sQJ_Kx1EAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=296&cbvp=1&cstd=294&cisv=r20231207.86706&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 29 Dec 2023 13:12:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 697F
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cver=1&google_push=AXcoOmTYqNixg3bjqG91cqbMPdvGdZvMW3qG2P8xS78XJgv...

170 B
188 B

21ms
20ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cver=1&google_push=AXcoOmTYqNixg3bjqG91cqbMPdvGdZvMW3qG2P8xS78XJgvYnHaH5_fOGIHGy2jpk1DYDoROTGOW8QC0b5HEzF3g94qNgw3WoPwM

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 29 Dec 2023 13:12:27 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-091a6d662d9a132c7@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Q0ZucmdKUGgxUmpjRjQ1&google_gid=CAESEBCl118uYpCH9SG2JZPa_MI&google_cver=1&google_push=AXcoOmTYqNixg3bjqG91cqbMPdvGdZvMW3qG2P8xS78XJgvYnHaH5_fOGIHGy2jpk1DYDoROTGOW8QC0b5HEzF3g94qNgw3WoPwM
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 697F
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEPszK55Cx3ysxm__qD6w6Rk&google_cver=1&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKz...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKzreKcCo2nmuvOYnkZ7&google_hm=zPtDdVFWRSmy2ZtcHIukPsw

170 B
188 B

22ms
22ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKzreKcCo2nmuvOYnkZ7&google_hm=zPtDdVFWRSmy2ZtcHIukPsw

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmT94xQIo9Ha9OQWELG6FWcDWAGSvy-TBAOhZLobU_azNFiTRI71Dd3iToxUXL3ay6ONdSj2_hwfdKzreKcCo2nmuvOYnkZ7&google_hm=zPtDdVFWRSmy2ZtcHIukPsw
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 697F
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEGhx5tGBaQUV6UlVLQiH2_w&google_cver=1&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_kw-L...

170 B
188 B

18ms
17ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_kw-LA-rIqoL5c

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMxODAwMzg1MTQ5MTgwMTI0Mw%3D%3D&google_push=AXcoOmTFLYd4J2Em4WWKgPrWQw65ABcMCuCRspeBEl5vsKWJhcCRfguygSxtHp48BH5NCLKbtJtKQStNt4__x_kw-LA-rIqoL5c
Date: Fri, 29 Dec 2023 13:12:28 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 697F
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEJ43a2wPIQYL3zZAPGOXvAA&google_cver=1&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRx...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRxWx3oZ

170 B
188 B

18ms
18ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRxWx3oZ

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmT06KAioVfwK-tg6ef3J7Y-mWU01_MDaPnq1HwVLbIh-9RLNU1hnPslmdkWtEPWJf9PkHBHByNMiLj9L-UO8iKxPRxWx3oZ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 ebda
match.360yield.com/match/ Frame 697F 43 B
199 B 125ms
30ms Image
image/gif 52.49.101.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.360yield.com/match/ebda?google_gid=CAESELGbQCV-9uAWZsQPNzLUmms&google_cver=1&google_push=AXcoOmQ7qjUTM3rD7-VZ8qgH-dvc3D4oqHllVV4AEBvk6ZqOywIZTZA_w3aV6Gl5ljvX39DRO2Qr5Jyla25D1QkDkX3n3alq78HX
Requested by: Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.49.101.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-101-133.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 29 Dec 2023 13:12:28 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 697F 43 B
145 B 9ms
8ms Image
image/gif 3.123.206.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEPsbrhOuSKCqUBKHhuVfIy8&google_cver=1&google_push=AXcoOmR3RydMf_xsZ9ab3JrFuEzFxv0pU0Rfb6oIC-2FWKJFsYqsse2FwLUKwDN9Y2AoAv-VB9jYusW8_50qJtGnSpG3omoa3dV3
Requested by: Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.206.90 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-206-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 697F
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=96d2be99-58cb-4f24-bc80-1cbb1408a1e2&google_cver=1&google_gid=CAESEAy8kKvySdeqJEk0rz3uF8E&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

20ms
20ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=96d2be99-58cb-4f24-bc80-1cbb1408a1e2&google_cver=1&google_gid=CAESEAy8kKvySdeqJEk0rz3uF8E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmSYhZNpYnICoi6kxpQEYIFea9sBIx20Iblh3BEA15KexVE57a-ML1y3lI9TreiHljFXLdm8CvEqnPsWYDBJaGuKs4aSUvsuxA&gdpr=${GDPR}

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=96d2be99-58cb-4f24-bc80-1cbb1408a1e2&google_cver=1&google_gid=CAESEAy8kKvySdeqJEk0rz3uF8E&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmSYhZNpYnICoi6kxpQEYIFea9sBIx20Iblh3BEA15KexVE57a-ML1y3lI9TreiHljFXLdm8CvEqnPsWYDBJaGuKs4aSUvsuxA&gdpr=${GDPR}
date: Fri, 29 Dec 2023 13:12:28 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 697F 0
12 B 19ms
18ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LdJweSiUryAsbqqfTzUBHckr7f_CqtRdo9PwR5uEw0lazp-k5gTNgWjzpNOc2ZvvHwjiPEPV8

Requested by

Host: a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com
URL: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:28 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3BEB 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a6477ee454d3ca137ec936ea446d615d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 255109
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5CE2 0
0 49ms
48ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst_pwum8FLIrTrYVVUxRnQ4UGXBqgR1rYG5hdJH9arjXViddxSbRaXY7aCJwi64EU3n0Ic2JnLZE8-NHz9T07XvVBT4gl5uHu7pVfvQW8WWfQUhaQbDqYSH9Fd3uGKud5L6iyzhGK1UaNmLwXNQHGJnb98J63h1Wg52uMX7Lpx5QTIaHuSmBC5H9DzEebFP8NiEjwxZAgjW83CGUf_oBUqUCC2ysnVgZxFbFdD_rqN3X01KTB9h1W4Jt9tnaDE4GbLwkWD5kgEWH-Krl4WOMbIyWlcTD9Wr-WUd7e7wxC5LNFzOvujo8BhHFHbDoHHbC9JQ5WJoaKktTaGctCPY27gW5JrEMJZlvaxw9Y2gyGMIEJSKxXSPuRuwrpqYcwZK26SyCCyJJULYLTFFV-jo-s88gGROi0RAmnxR2dHDQXlst3VQqA9dEmnAWFxoY9aYibl0g5v5HJRze8X2sWm4LlyhtK0e_JV4yuSatc4-owczhdVgifTrOaMl227-ahv6KxZHEzGHkNVjL12QgqSGgRaE--8Vr0e8t07pQJ_AmXyiUu5lh3lKoUukdkZZFXqWkn57Vc4T8Zv7_lBcl6HYuZgK1l6M09q9RpKUdD2FcztanwU1TOAVT_HYK7ilG1FthVNboNg75l4kAiyKcrUHUKP6u7kdvE3Lfbxn9vw8hMI_yOUm00vlbhvZAiEva9TW823hWZEIBMUL0ouO3897XM381ydE2dYZ5MUl0M__V0_0P9kMbhMh2OgSJl_CvxW81J-UoD0_dacbY34SuLQ5eESr660sASSyJ5_qP6lygEhl7qusYqomoukKljXqedH5jkvDM23XpshVH6UcsdErZgcqSF1dd1pCjTrnm5lx2EYnGxX-cbjwFnCNFZAYPf7W1qpafosdxGFHUYkJw3IQ_Nvmm3P5AQi_S9yLC6pVRHLLmDaU2toipDEZZGW7TxbYSCK8ffyAZw7dS5Ewn8XqDoGr4PwrAgOsnJr5YxaSqBFRLTp3RU36_jitxKZ-DAM06cFN_yqtFDlfwiHxdbi-jGmi8WW68dV7fxubXWszpuGR3dhOQoHk0YIxR_Fw4Jc8baEPv43oOommZKpDw7A17Uqgu-oMuouZ03F_c7QPmi_XC4DVtnhbgLVnk5sGODQOK3_LHcz8FmefcwpmjCTwtY-0EuW2KbMuv8TJPBRVBxeHWf2zaRG-on7ZdD54gNDVeShuZcGOiLTEbqIexicb3diZO5QEl6Xl-lUxmkAorvFJcC70FnMNnITAMTrKL9GGCYTTJ6nH_7dMOeulJrfDd4jJDCOYph4qiNwLcb9f9sc26ULZsOsLThERyTiQUSTErQiPj61vJNOkuN-mZsFBxB1tEGw5HEioE7wDJ7hqkOe7UW9VaHA944umGBWRsUYYnXNarZO0uhumxwWGYUY3epp2oXoKBg&sai=AMfl-YRGUg8lfzgStPtNVsNmj95Nrkm2dq12BsJ2dsqCi26Lc_ojMpSu9PMw4bcebwbe2jp4j_CRIJOM23C23G0sXiQOXm_muEXLslbFSAVChnyh8UEX2hwg4uTMNknTwvqKqOeHW0gA13aUIvdzr8j-bEfg2baQBW5w1SIARYRpoF3u6CiASwn270kOkgpkSy8a896xb_uq2ZSZ_7zZq9vrca9AaUaDdRdrh6qoCiRhpTrRwdmN0RfioNnkvA5T4OmYNMYD&sig=Cg0ArKJSzG9Yo5ExKn5xEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1023&vt=11&dtpt=685&dett=3&cstd=336&cisv=r20231207.23987&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 5E67 32 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7767053680059827245/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7767053680059827245/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 28 Dec 2023 23:49:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48199
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Dec 2023 23:49:09 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame D3F5 0
42 B 59ms
12ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=3379454&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 13:12:27 GMT
content-length: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 3BEB 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 09:53:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11909
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 28 Dec 2024 09:53:59 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DB25 0
0 45ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvbSVBDRtRfpcTFBSPw34-91YaiGj8ZRvOT7c95dWNDG_PYYXXuhpt8kR428qFpV8p9fdsy0U14f1q119mmzJqh49ehBlZhRy6heP5upZWXSe6IMoR6IUO8fzcQ0Lvh5ojYXd8zRXeUXCqCWbTLqGCYYbMSTkvAGk93lEhFmXvOXO1pjb87v5i-ByEYVv0_wZBJcya9YBZmPclzfBCPUnC9HV06WvRqjOqJjdxe-D1qeG9zuj_Y8t8VmTFfYmezRe57hJSyDlrtq9SHgY9f5aPuEchoFiQi84H6nl_M7F48HiqHtjuJYtU0qoo4SqEkLSvjNWzeN7y6L4Wq4BXBXmVl7Q5r7XW-nN9r4eWkphkVj_mCn1kZw4UHDUX6GTzOGhszg32RwioyD738yCBQGL-hq-eYxESzfpw9Bexsp1n7w9367fegTiPZ20gPx_GQNZ4RJm5Og3qKspIN6N0-bxCerwp4Vueem4pLZjEI7Lkjm9dt0cugnVkkHAV2wnwbMi09ZuDiDQY-mFqrdARPKHUgv7zKBuPAfdcfZ898hcsljaYd_P5Zw1p1YtWGngzImXijaqa_k_vct7ZZviQ_DyODviYbcw7Jr3jr_DBJrgok21EA_soD_AKFFvZZAc91Uhy6dFzEFlijQYYUGWT76hzMjpf7VIIoKDRoQgFomhs7HoU9lT2Eoos32yGm-97KEieiCf5XX7X60jxY-oLenpKfu69TKkfOnR109KVXRDvsomv4buexdRs6KDzF4WJmk_0hzjxGDrXhwKgVjkKip-g1dFq3_HtxQfUCXJA4fJ37LdOwc2XlZUAhzZM8G40EDfLxtgmVzVozr9O9GIHJJt6VGRhyNRqKCUv0ak7gTz4rG7iPl9OG5tl6Sakh-_lYFTkA4ntfBxTcEoB7ivtU4_ZX2WOi9N9Qqe0sQhmTOHwMEendSRHexO6xvxQVZ-76xK6hdKZjb0Rsoud09oc41FVA5jpLlmkncDAT18Z2_Eyuj00_zXHjwVff-Hj4YHE7zmSdgbGygRxYdV3JkXlMBZKmlECT4IrzGAvYxkR6vwJkrv-gRvnbqvvGTvgIgRxRkRF8yX5pPbROICqExu_83M8JgJYpGOkbyRcqZZWVKeWWM5CLW2A90UXHOkP0CHOmzp393c4xxa0VhmQKmWJ-656zNEwbCq4EJk4nf0Fj5LjPP9UmfeCxryIavehdOVvaNfIJB7Lfg2d395UZSpi9sMmrjSy6-HfPZdiE7m-CJO4hFEZ8JzNKVYQcmzryyW8vViNhiL96DVnazl6YAKfFX-csEiFvegpu2oXC19MqFru7RsQDm5KhJhC0dr6HBc6PzKRh4LpkOFVBtRXZc7SJAT0I6jtqBjDYxrGncjGbWnoBuos5ByEkM7CuNRK3B3PkMDnMmTPfERkZdJQ_7NcUnIeul_IPb9O-LVmWKdjs&sai=AMfl-YRFVJ5-_TvKO8rjMr8JoSthUpkKLaXFfclkrs_xtw4flkDTPmHwCxhGPFtBKudACMEb_B_nd6folKFYA2j745radHg1WLe1-at7wKQyfwUgoTcsTFwhEV1dzG86_Qw6MxDr1Efxn0GRKa60DVbrNSJ6hTr34TIT8uQ7Nv_05YlOFWLalW8NqDhun8ITuR-sBL_x1cTZX3FdaeSZScS5L3Dytow2KYAIFHUpYEVnJJMaB0psPZGYteHBBVujMoq5ReM0&sig=Cg0ArKJSzF-I0sQJ_Kx1EAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=509&vt=11&dtpt=213&dett=3&cstd=294&cisv=r20231207.86706&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: cybernews.com
URL: https://cybernews.com/security/clash-of-clans-third-party-app-leak/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS