zvon.octo.net Open in urlscan Pro
104.21.234.132 Public Scan

Software

sffe /

Resource Hash

0d9e575113cd46216339bdf2532375afbc228c0f70095d889b0b17080fd8af9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26997
x-xss-protection: 0
server: sffe
etag: "1106 / 994 of 1000 / last-modified: 1642591733"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 19 Jan 2022 11:51:04 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 151ms
65ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8a6d29f6bac85b33427fc9a5d48ca59801164b3460b961530eb3d1dfe37c620

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52002
x-xss-protection: 0
server: cafe
etag: 2955346761143883514
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 11:51:04 GMT

GET
H3 200 pubads_impl_2022011002.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
118 KB 86ms
38ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:23:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1677
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121009
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 21:10:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 19 Jan 2023 11:23:07 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 107 B
119 B 96ms
48ms XHR
application/json 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=zvon.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7af2162f82279d397cc7b153921061855d999815be7050d2be50ecaf0ff059e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94
x-xss-protection: 0
expires: Wed, 19 Jan 2022 11:51:04 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/ 284 KB
102 KB 116ms
68ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvon.octo.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef979ae41636bb1112445e7c404cc3a34ccf4b32e7b9b556d6bdc7f464009d01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104506
x-xss-protection: 0
server: cafe
etag: 5387996186767430246
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 11:51:04 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220113/r20190131/ Frame FCF8 11 KB
5 KB 127ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220113/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Tue, 18 Jan 2022 19:09:26 GMT
expires: Tue, 01 Feb 2022 19:09:26 GMT
cache-control: public, max-age=1209600
age: 60098
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 137ms
47ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvon.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 136ms
50ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvon.octo.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
12 KB 818ms
818ms XHR
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=317451230437942&correlator=3740012233596994&output=ldjh&impl=fifs&eid=31061814%2C31063378%2C21068767%2C31063247&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220119&iu_parts=209694548%2Czvonki_top&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1642593064&dt=1642593064743&dlt=1642593064319&idt=405&frm=20&biw=1600&bih=1200&oid=2&adxs=277&adys=193&adks=4116272111&ucis=1&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fzvon.octo.net%2F&vis=1&scr_x=0&scr_y=0&psz=760x-1&msz=728x-1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=false&fws=4&ohw=760&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5619ed2afffc76a9d66b9a9850f8f1f37ca43f3c982ee6f88e7cbdbd78bfcea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12126
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvon.octo.net
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 1380ms
1380ms XHR
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=317451230437942&correlator=3740012233596994&output=ldjh&impl=fifs&eid=31061814%2C31063378%2C21068767%2C31063247&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220119&iu_parts=209694548%2Czvonki_side_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1642593064&dt=1642593064747&dlt=1642593064319&idt=405&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=541&adks=1556906017&ucis=2&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fzvon.octo.net%2F&vis=1&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=false&fws=4&ohw=300&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64b1fa75bb11e6d8401b24d2c600aa50cf3095da448cb8fc1b9da7a2cf9c8439

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9698
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvon.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 21 KB
10 KB 948ms
947ms XHR
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=317451230437942&correlator=3740012233596994&output=ldjh&impl=fifs&eid=31061814%2C31063378%2C21068767%2C31063247&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220119&iu_parts=209694548%2Czvonki_side_300x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cookie_enabled=1&bc=31&abxe=1&lmt=1642593064&dt=1642593064748&dlt=1642593064319&idt=405&frm=20&biw=1600&bih=1200&oid=2&adxs=1039&adys=1914&adks=3260532487&ucis=3&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fzvon.octo.net%2F&vis=1&scr_x=0&scr_y=0&psz=300x-1&msz=300x-1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=false&fws=4&ohw=300&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5b0d5d68eb2185a8e1c416205a059267a7c4b6f4565bf8c5697f018dfc53df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10049
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://zvon.octo.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012111152338000/ Frame F544 190 KB
54 KB 151ms
46ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b52d5e44212b22f6de0be5caeeb5bba561a29fd91bf6076bf1ad6d45ecae6f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 262415
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55581
x-xss-protection: 0
server: sffe
date: Sun, 16 Jan 2022 10:57:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8559bae154d80579"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 16 Jan 2023 10:57:33 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012111152338000/v0/ Frame F544 13 KB
5 KB 147ms
42ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e46e56dce46d21c527e164d6749fb5ff0101f400aede06a8711196da9e5c619

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 262415
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4994
x-xss-protection: 0
server: sffe
date: Sun, 16 Jan 2022 10:57:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b314c3eb801664ba"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 16 Jan 2023 10:57:33 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012111152338000/v0/ Frame F544 89 KB
28 KB 211ms
106ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

279249ed963fcd87e6321b024c0194248dd1b44af5353e134071cdfff953967b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 262415
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28443
x-xss-protection: 0
server: sffe
date: Sun, 16 Jan 2022 10:57:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "976e6f5df80f4e35"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 16 Jan 2023 10:57:33 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012111152338000/v0/ Frame F544 5 KB
3 KB 145ms
41ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63697d88ab7b6e34e76e5990b867c706cb4346c27ec1c5a034c4d91dfb136778

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 262415
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1727
x-xss-protection: 0
server: sffe
date: Sun, 16 Jan 2022 10:57:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "423ab13fb6ff63c9"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 16 Jan 2023 10:57:33 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012111152338000/v0/ Frame F544 40 KB
13 KB 231ms
127ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012111152338000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffd015b1bb0125d07c39cbfcdee6a8e2b604b55ea1936cf550fe1f9fbdbf2ae4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 262415
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12843
x-xss-protection: 0
server: sffe
date: Sun, 16 Jan 2022 10:57:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "08cf721d9e54e414"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 16 Jan 2023 10:57:33 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F544 8 KB
1 KB 134ms
45ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 19 Jan 2022 10:31:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 19 Jan 2022 11:51:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H2 200 container.html Show response
18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7190 6 KB
4 KB 188ms
45ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 19 Jan 2022 11:51:08 GMT
expires: Thu, 19 Jan 2023 11:51:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 15AA 6 KB
3 KB 186ms
46ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 11:51:08 GMT
expires: Thu, 19 Jan 2023 11:51:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ru.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F544 3 KB
3 KB 128ms
43ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ru.png

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fed2d61088cba54be39b2069add7103160e31f07c950c0e2e7706d6d6dc9ebf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 05:59:37 GMT
x-content-type-options: nosniff
server: cafe
age: 21091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 6726277462267614359
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3041
x-xss-protection: 0
expires: Thu, 20 Jan 2022 05:59:37 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame F544 344 B
582 B 128ms
43ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 06:46:14 GMT
x-content-type-options: nosniff
server: cafe
age: 18294
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 6766994032117382215
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Thu, 20 Jan 2022 06:46:14 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F544 0
0 133ms
47ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ-llhIgUlcjSRnGVRAJ4c7FaMQD4QytqfpLxykMHoy_ltXyl1jB-E3yUWTtB6BELsnEyIxKfNSqC2RiUqvH1cIPgHgcg
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F544 0
0 82ms
81ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C_lGYKPvnYbbdMLaT7_UP--KpgAHlm8-mY8_q963IDJ66i63HHBABIMS02jlgleKQgqAHoAHAgvajAsgBCakCYerlVc3DkD7gAgCoAwHIAwqqBPoBT9B-lAspdLr8hO7934TTIAcHhkbF4hUqXoDUsG3NpX4rDlHBvuHrPkgb9bPpxrr3x82rmxUEVRAtrHaDTkhRqB7E2oRilpXhAfUDNS1lPKrF0j_-3gBPslTYhQ0bwb_rD18SQTMMqrG-EUDoQFxpQhnDaTlLLFmqmRC-cYrRBvnkQkx79HfEP-V9-gWyPwI6cQHpxgrnLcSQxi3NF_EVOw7H4xhHq2C1hGDNodNThIBpahcxYsSMtaNAtt8veqwLbh42fsYqTN3Gt1msuLYKu6v6OEXX9Pjv4WXwm-5EoGwjGOSpkwwVJs51yfzKvQmvdyhVBrY7f1N3tsAEpdneo50D4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB6j9idwBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQy-sH0ggJCIjhgBAQARgdgAoByAsBuBOIJ9gTDYgUA9AVAYAXAbIXHgocCAASFHB1Yi0yMzIwODQ4NTA4MDExNjA2GMSaKw&sigh=FS1gjsbKfQc&uach_m=[UACH]&template_id=5000&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 212 B
415 B 44ms
44ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=zvon.octo.net&callback=_gfp_s_&client=ca-pub-2979533909392588&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2979533909392588&plah=zvon.octo.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

9973ceca68c2e2e8c511bc9bea23ad806b7aae31ab00e0680696783f7dfd390e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 94ms
48ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zvon.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 855A 26 KB
12 KB 753ms
705ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0165cd52d19d21e23073fc1259892e8c533dad59d88e7a2ea2667b28d96d77a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
content-length: 12221
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7C8D 26 KB
12 KB 552ms
509ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3b7493b5f86945ad26bc64fe14b0953b16e5306fe7a8ae829bbe104d957a848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
content-length: 12029
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BB30 25 KB
11 KB 1042ms
1004ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1642593067&psa=0&format=300x250&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064577&bpp=1&bdt=259&idt=3395&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=MOej8oGUbs&p=https%3A//zvon.octo.net&dtd=3396

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3206ae96857477671651b86c765704e7b00913e2452a76c6d8b6e0083ba3d435

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
content-length: 11327
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18074128470067017254/ Frame F544 4 KB
5 KB 77ms
40ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18074128470067017254/downsize_200k_v1?w=195&h=102

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f81912514bb0c56b796d72764d5a82a4eeceff331a2e3c4ddbafedbdc09cc30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 21:59:25 GMT
x-content-type-options: nosniff
age: 136303
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4358
x-xss-protection: 0
last-modified: Tue, 13 Oct 2020 12:36:30 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 17 Jan 2023 21:59:25 GMT

GET
DATA 200
OK truncated
/ Frame F544 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame F544 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame F544 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb7acd9beaa6c9eff13f4623152c58b94e444fa630efc88db8168cacdbb4bed3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 97ms
49ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zvon.octo.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4B1A 0
16 B 61ms
48ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&adk=1812271804&adf=3025194257&lmt=1642593067&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fzvon.octo.net%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064585&bpp=1&bdt=266&idt=3390&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90%2C300x250&nras=1&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=3413

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://zvon.octo.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v41/ Frame F544 28 KB
28 KB 121ms
39ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v41/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05e2888e835d97fe6e4cfb256f62f47d5dccf6d9ac202ea9d82a6bc2b1716c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://zvon.octo.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 18:12:51 GMT
x-content-type-options: nosniff
age: 63497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28196
x-xss-protection: 0
last-modified: Tue, 18 Jan 2022 17:53:50 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 18:12:51 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8604 624 B
297 B 52ms
52ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNU0Rv14HrM_CiKRtjzWslkLga3Kdl4mt6E386dRvCqXk2wBf9LFNGlX0CJNiscUy_d5juigr1ZtxN2NjwuSz77z2fvzQ-h9uwPg375lbxeuBeI1sQ-P0fefXhisOddWHBnpdFyiarzarhRFjXnMx9xwe5zG7ywoxhcqYrpmvzhRvnnDX48

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7190 72 KB
30 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS12umtxVImrhOtu7rRxesjfcq0seVKOge8soQ16PTz2ot8bnl99RR1oiY67SZBC9raUjpahQbay0bDzxed51fkL0WvFXvvSiJ9USknQCuQhstTHgWli4ULX-N1ZEOgxiNJhZ5k_I4h9XZBr1HrcEGnmmIYA&dbm_d=AKAmf-DpGApA3L2JXyUr1R27D4-aHZkpDwG60SkM93g3GX-L_kFSCXL3-PSddbpHNJB-IxZxQy95e8xgL5c5YEM1s-9KGZfiLRueMlJcv_f6EwoWDZlxOstVD22XGgAojtB4bCn-6Rt1w_d5ihmmUnPvPFLYbuVXfSWsfe0yaBf4FukbulsaDUkiXBASnhsU54ue8O77d9ADUkWNvQp603vnW5qWTfYLAsRQPF4CAgyMcDZSa2w6j0AEo-X6zJEr0zGrc9z_1hbeYg7RZHl2Gc8tVdBs7rctEspL9g9tP2lOHB-nBVeuogXp7WysB8WWBbW934kul3H9Dyd8LN_0tGmSRhHMCqB5tk8hZfyDuPvHDDAH5zETLUPRGf17aFjaczZICgKMOB1Pbpexf0qBhxoAnnyIpsj_Q-r7F_i9xNRtBUBJtpIBRA3MCxnhmT4kmdIX1MpoC7OWksDaZVp6jfJiHLqN9R0vVQ2-4F08eJ0rQhYbgj1H9Fl9geYdfsiFVbHsVPpMDsv7osMRkMzEFTEAzmAgCta2WSYT8k4iNYwRyDL_Dha2oFepAe0e9itpLTEkyMNrb-bGS8jIBzbrB62mH9xUeHsB70EHK8-8H8jwVj8n60LX0qOAemnV9lLJPjvNTJPj7xpj0QPrwzAqJnY7R0Atfd9TBLgH-vOkJkqi4vm3RKox0ipMggoypvGxohPwYpK7k6vtJEqoSXHQFic0AuQDzq3Mu7E3f2po1yV0yYu9aeOzw58bcbxA2tbeQMAz_nRn4Du8uvi3P_7ohzrRiTAraU6qE-7eNgEK9Wqj6NSgYheehUig-XHL6XtsyZbfMuuQzd2J9mi0IOk0HXOZ2WUw57J915pkMhnUpP6d4jL2wX2Gxn3VNePtVPut46QZWt9fctAcSjXNz8y0o43c9ICGQcwsZf1lHj5Qxw3LwWfuZf2Y_iN9kbAxYatgoTHisJfwyBY90ASVMIx057xDsvsbDvKvXSMBTRFizSB40O89u5wcyMglJhPy7VznZlBUNkm0XThE528LrmYQ3G5ViOocXOJomHHBsw2vL3aA1VnTLRk2906wV4Dz6Cf5u6mT34Exyi1LkPTdnWUbxzX0gcfn02_yucgcVlgCqJveb4OZu1cWiUgvnVFG7jqZ92fYGg_xtH3GR4nTtEzb0oGYIdQ3Euc3Qq4MMnG0LUfljCzFAay1LQxhSXAenT6u2ZdX5EsxFb4RCoCbglntrzLTsEGG9_JuZyZpIB7s2v7ds0j4ww49BTi0UrrmKhaoH4OO7nl29dCncxWVRfRpygscK5A9dNlPr3d9ZYi3-wMwWfKil9RjOwbjxYH2YiJ3gMbpg66kRHWX2plFCKgpGjhC2TKwBVF6XlQT-QLMkBZfty9xkHrRZO5fjrM0TlPtAO82mkkrk8Lg5B0Ft4rCoxxF9zRANyNrtIH3TSjqeaHGTKvliFLDo2wc1eJjpaPXo-Ji4i3nAlGObAMwhMBT6BhWj72epsjQOAkN9bUZ3YHPWukjcyBAiB8mosjqCcMLRVsVgvwSDEqcdiPcU5kK26RxVO6jwgkMIZRG6ykEuCkOmFWV9AhG7gi96o9WcSOqfKoJ8gIDRf0TJNPaqY_cLh3K_SJ0MzXPKKFO9HuS-RLCDkux963EK9m7fx30OADby7hrkhDD1OI3Z4TCchhQKyn1bnd94qvtSXEwI5km6kOX9VQnk74uLmA653frVIXFGLcY1-Odd4mgSSaDMYr72spxLgJTPaK-905aQbBZA-QRsYrO6pf8GxR4-gGz9aWaIGa2GL6TBjMy-VC9vIoCmixnHzQ18Kxz6G56ofShaUMhPAmgY-dis87D4QKgE7sU4tW9Xub1jMj9Rh1PjbHEdVcPPyJHkQKng409KKtmrLRbCYq4SzdihQl4bvLeUGlu2udeqlJI1nG9jhi5cxrL3WFJRntFL_EcFR2RHcHiP6PIt72CiYgzYJPXZ92pSnaH38DbyM4Pr9poihivaRLzCGMiEEXJAtIa1H2OK8w1fVgOD5nLEQWzURFKs8OP38HWhlABIjtiDmKLui9Um_XMRzJj4JQxyWvmEePOIp9H3hL4LigY-nfkQ2bIyx2OtB9go9z8T9TbMFR3rN5E-JGV8WbUm-WN19ABFw3Tr_u-7O-YriSSz8nWta14SgPL35mUAfEIv9QzH4A-IwcVYuHR-gD8pZXqJSr8Qh_qd8wmkGpCsoptBo7u7kpDKFSQjFVz_lV8azCeFUlc6IHr6fmX3v0kVsWCYTIEzKFN3ivgEU4PVzp704ZTQaNtW9OcvUxDgHuagFlqQqWlNNBvzVQKxM9OF7mbnCV669oX--QnSr1g3WmUHmBEIMMSTq0ZT5s7efw0yi3P5tererlKAp1kgAH5EeV1ifajfA4XZ4pHR9Ikmds2PQdM147SfYTtpmDAXbEPlSsufHFkSIKmg1k5BsL6wJ-oD74v-4Bs-fD5Mo7xlaJOHXVyX_o48JbGzqM_zI3HSk3lNlvSGt5Wlm8eUlzKtJ4XHRlFXvwWzMI1bMRFshea6wN853YB9CepoRJQwAA_0163RfUytifVK4sECmzallu8ZlaoTAzjQZZd0L5KTSGcBJFHd6XfNywNeKSi7nSVaKjwC9ixRzNMudEsXxpMMGYwk9N2G0fPILRf4riorjOarllz5cdd6jEyTMN1ryCsvW58MBGIF5mQRTuc7Fbq8fepEdATMa95jEO-j0Glku7Bm4i9sNzYakmj0sOoAVx4aSWcnk-nkse7kRer1JhgFxyMMi5vlmAwKPf7Nmun_M8LGLw89yijxSfaW30rTa-6Iul3_8I-1zYpqfVT-Pf3ml-MwGyyNbWXBJAs0MPECdn_G301DpMny2uHIt5_6-XoAw89DOEguEtcSWGX2WgXNxhT8bBedTwlgO2aLXc1onb7I5nJKSRGIdARBAyC2SRO9hzwn7wYprSW2CBvbnTFLnHwkK44w9O2lZsv0LzuDiikPEaGE75PXfmexukEwZ5opHDvmeYdJDIH8BJ9n7vnMxyo5dUcjhZXxKL8tukf6d1o4bM70Y6meO7DPtCqvkDX6lirDWeHKotrYbgbYAYelnSh56zhXUdD-mFbfFqqL_EIP3XrfG4_TK0KBOpjfP1BRIDUOaxr4EqEbnA_XMnSi7JFB_XbLN_UW7-VEW1glVtpE6Detnk&cid=CAASEuRoTixVLcMZqrSIXknEaL92lA&rfl=1%2Chttps%253A%252F%252Fzvon.octo.net%252F%240

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d13462d5befffec9b20799a734bb35ed57a6ba4553cf58652d04e8083efd5690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7190 42 B
63 B 72ms
71ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A7z3bAXbG7xHZlkRzvtitvSZPEcBb-kFaG0fit1ySKNmw8uWpdiEUJT3Yod0SFGmBszSDThfxHbgKiwmD5lTDgAErra9Sa0IAJc0A-DJ4v6yrg2k8

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 7190 2 KB
1 KB 97ms
48ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/window_focus_fy2019.js

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:50:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:50:02 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7190 121 KB
38 KB 157ms
74ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 7190 15 KB
6 KB 87ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 996
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:34:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7190 0
0 97ms
48ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSEU6GmVCSAfu4r6VTIaLtCsFLqSEPdXMr3JB3sjfDQ4osV4duWNsp3v2WTpsTZ9rRFHwCdyXzMPFTdN6-0R3XohwKnpw
Requested by: Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BD95 640 B
316 B 50ms
49ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARiSpNa9ATAB&v=APEucNXDf0SV8hhm6bYHG5iyfYEgmNbjTFKm9kE0lRuwEtLP37WSxhax9akmmjqYgLsKcZzlmlK0FG_-t-t56T5R1GsLvfPEAspqLZpH9qUBdsmj_dS3MLbs_LpiuSBhEclDND4ijGVt4vQRW7_VYMPu4COEhuiPbRx4EdnuJoynm7wjXyRWtpQ

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 19 Jan 2022 11:51:08 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C7AE 78 KB
31 KB 104ms
104ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DUNK6hPhpmWx4C7o6EdD5Q_Zi6ejyenGz4hjThoeGi-HfwwF0AK768Nj7jI9wGNY7TWmAqYbyZSSHNDFXWyDdwyV_VWJjQY-nbqqbtgXcxLxI8wKZ8UYvYGA2Gut06eqOUqhUN8bRCiQ6OZsEHcVt9LW3cAA&dbm_d=AKAmf-BgvL4zXuJ8IOQ5XILu3LxBGFrP_JSugPH8WS2M1Jnd41iFxy5UbvDSoVQeIR4K0vx2GqyKCS98XZ88YUwMmq7azQpMwGa-cIf2uKbPyuuh-Ygvgj0Z2TyUYIVeiUaR2i8OKPuIXIlInC7Odzq1K6gosVkJHjm-U1s0kU3cj7_TqzgOl4W3paTV1gZ0JCqE58PkfVSqP8WEezuESeD7SRrk3sjT4Rua6ML0fSZ0rkNQEZp8QtZIEcetxPTL3ghQYI5BfYI26sclXltOjmhsFudlfRAhFltCHYtgg3cP-baAluzYmGTi6P9mMAThykOzhbJQp9D-Q5RJM-tjYYyLJ08J5E8HvYe9bhDOOi89Xfo8bqEYkNJGiucRhHva5IDr1i7CArNyLw69DPHRNfjfdQFQGUQHhcoCMQTZ1JUpf-mEN-TfndcoVuBGgYJVjIWjeZIDs-GZkDSivjTMJ0HCGLbwF0Z0xlyB0S94gGX4XEKMJsYeyExiVIF0SgKPwGAuzSUpcSeQfM1Zy283pctP_Sp3F2V07F7iVBnks14ZqpwM_9BPdhGCfz3lfga6lHZHQHmrtj1UgF0pdxi45DnXT7d8bssc2GcSrUrkKgjhJBheA5vkzcIQwWDkjQho2iGRcCJoN0YT0caPZ6QTCxI7jBC24l87LImoyxWJ5JkiKJOwIldt2HMhn79s23tryJcaiKh5WvKbDRi5aA7aJMKFM8ivJH3am5DqVMuL5pixUOa29xyndkMVuFc6mz4FuXsynsK1Pb69MuPPGIovFY0fAdQighBN3UjQ-qLg9UGYxV6XYpHbQZsAW6JV_y3PFzqHnc0eaf_flDNC3TqmWP9BNiSI30MM-YXYrctn094kkK9hfg6oQMLnA9xDsjz6IQp_U8lMSN12KS_98vn0fHh6BYubbVPzXBEWxkk5MRyrynqpNgv1QVCZiTVIBQ4ZlY5D17XaUYWU6EvMhbkvh-dJHPvC3raPEX7Mem5cQDl36DmObgwLDJucInShL0yksU_R-32NDuvJUAA7hn_8cucsU_bfdsNbOU9EwA_f_RiGxYLTEvVLfPRH_6XJeteqHwIH7pdcxWaV9SlLLxHjJ9Yz3MnwMycn65bmuvH_PcWiZ3s0N6pDTbdnhvG5KoevW-QfiaZkSU3nEoqx0zwUcRBKieT3rVtfzvUlIXey_N0hBB2IB-2_RBE5evAkrfTi9jWHNiN6m81OgVqGNnoSy-fbO9704VFOqaiMtRMWjov7Pojvbk2EutnFmdeijRnp4vP_QuKXDlEb6wEW20W4wAbHASeX7IVyv5ZNd7oQT-b1jhQB5agqF3pt3SV7ZDcTZsZHCSeEq-L-DBhLbqF9Uh4pIwaaIYI6eshNKoOJWAuWyfbPAZSWWH4sTm6fweRQiGP9e_rhrx5fY4yU71IQfjr_AGrAKBofp8GXJ-nI9QScDlx0tO7mlrnjnctyAoRM171FIJrmiM71MC4d_wdBVzHpSyCfXlXD1uEDW1K1Y4Dvam-iefXU5m0LUPpm0MqQG2qVV4rTGTU3MCesNLojCH1xe5c98g76VuOPeW8QB1Ey7lh1DAOztIz0iv1tbvihacWBl8uwZ79Y_yKxSQcRgkRPiVDMg9DtqAcl0FN2w5gBs6ai1HSdQcDl0GG7D2IR3IW8DoEv0c8BBrZ7TBjQGLR8P825KbuZlJDnu_TmiTvivKjU1YXS6jJbCTRY5Q05ycYWUIzaSlPGUD5u6BvIQWmu9z4VxW1YJWQpsyhUJjqRH4KVu5ShNlfAsHID0picOFl24ZIpjxcZgHsY9OXai4BU8-ODzO2KGXKAxEzqS2Qu4IDJgyO3WE5z1D3cuUJg6ISRHHdaL2DZ2OUg64epGvSH4MsKoLrGnBupx2NXQVUArtchP2XZOpU8tCdNR8db_2uSBTHNS6SXjM9_uyz5ES_U3Y04XDVwi8TezDKtsAGtuN_Sz7YQ_qFlBMribqF4tuRrXo_X1gRh6ENwKF6CGgBbexL3TU05-UyL5FSXzR4e3T3N0qxr1g8XF021o4D70DSnqDmPOY56pmLQ5DSP09OThxMxTmyyEsBpJgK4CIaKp4jLEegnXFymbzi9AbXNZ-uUjkU3nZ7gI6djK5OcIfQu5ZGpQpM2V3V3TEUqrFr57k8euGe_38RlIQpZhHMGmk21iF3rQeRLmVVaGxReD7_dA0M7PgGS3Da7odu3feh99JMBAGOOvNTQDFuZL39zGkvwPq405xy-ILN8Rzn_KLJO4FNak6i16H2Y9M_6fvRelNFcirMMKguYkqIOgo4By993wOUKNKTpkU2ERbo1UbE2g0Fn-nqO6yuoxQFn2i2zp3g-ZSXVzZL9JRcjQS7k21EKH6F3Itmizf0jTen0gADMB286bfLRrxrGKqtNcrbrAjZyloelgPTlL6sSPPWcYtZbuIefrcPPSFXb5FoCR_1_A90HKJpcn6l6gEM_ck3GlgGBWLltxAH9YUjSBdOHXhSnJRT4I4pT5yvZaXzFMpIUbCQB63cIDx_ZSHsjMhN6elDpfKNZ5n340SccG8BTz4DPQwNIMGmUe_TepDXqvXTy4JgvJQKNOE9AdhUWdbNYbSq_dduzJlmAgP7urR6jNqdN1xrx5SOU72lMseIDSFvrYOl0m5VszP15rcqJhRERHjivQLbcoPd-2AfPIEgn-9nWvUQIAe6wDfyoCLMHEk9XP3lHpGMWk5embyRbuBXJAIcKVcdvgo6wVs7VkcyBUMBUsvqYk3UMCa0FFaa727iMnnKPgH_oukXZ3C_chifAwowTVFuq7gMnPJSAdII8w7HGuRTZNYyOePcRiQnJ4TuwjWL3gHeyVfKjICp5tbc8x5Zke1iY1OMuqtmEMfWRBNrDhw5QkZMOLMOq5ZBcQoJzecfUZLcSBAw_eB3bx6YBkAG1diF6q9dUx9ywfCoUCii7k1NAJxcgbnjiXfKRFu0Wk93gtuNBALXcRFyQ28I5IArdoucssW1_5xSk9JNqi4WaA3KRo6Uf&cid=CAASEuRox0uOerOkdSp3FxvLuhfiKg&rfl=2%2Chttps%253A%252F%252Fzvon.octo.net%252F%240

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62829ff8d42976e73048ce1f0a74cef7fbb6b5df4eef70b6547823d209574873

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31636
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame C7AE 2 KB
1 KB 90ms
50ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/window_focus_fy2019.js

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:50:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:50:02 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C7AE 121 KB
37 KB 195ms
121ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame C7AE 15 KB
6 KB 81ms
41ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 996
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:34:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C7AE 0
0 88ms
47ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRnXUyzd_ykF2HAx52do9D-f4X8JOsNIdQ1Ci5FcO95jrUuyjjvPYYrioQ6x7ncHAhhzEMR7Nq52blxndTz7n7x4-juZg
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C7AE 42 B
63 B 73ms
73ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cl9SHPlbBdSrvDuHF-_5sZQhjdWzo31yCGPYS5ck6uiQ1qF3zAyf6_cUFbnoUpPBoHzFzfVOiW-2wW0A__HLsW1CInGPdaGo9STELLeMqKKxkbEXA

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8604
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1

43 B
894 B

21ms
21ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNU0Rv14HrM_CiKRtjzWslkLga3Kdl4mt6E386dRvCqXk2wBf9LFNGlX0CJNiscUy_d5juigr1ZtxN2NjwuSz77z2fvzQ-h9uwPg375lbxeuBeI1sQ-P0fefXhisOddWHBnpdFyiarzarhRFjXnMx9xwe5zG7ywoxhcqYrpmvzhRvnnDX48
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:08 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8604
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yef7LNQdqJXPSiGAMwFioAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1

43 B
894 B

28ms
16ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNU0Rv14HrM_CiKRtjzWslkLga3Kdl4mt6E386dRvCqXk2wBf9LFNGlX0CJNiscUy_d5juigr1ZtxN2NjwuSz77z2fvzQ-h9uwPg375lbxeuBeI1sQ-P0fefXhisOddWHBnpdFyiarzarhRFjXnMx9xwe5zG7ywoxhcqYrpmvzhRvnnDX48
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:08 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJQ1h-xocuw5t_qPGBtqyNA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8604
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFrH4ev5ESIdKdGCA1hqgWo&google_cver=1

43 B
1008 B

7ms
7ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFrH4ev5ESIdKdGCA1hqgWo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY7uCEGzAB&v=APEucNU0Rv14HrM_CiKRtjzWslkLga3Kdl4mt6E386dRvCqXk2wBf9LFNGlX0CJNiscUy_d5juigr1ZtxN2NjwuSz77z2fvzQ-h9uwPg375lbxeuBeI1sQ-P0fefXhisOddWHBnpdFyiarzarhRFjXnMx9xwe5zG7ywoxhcqYrpmvzhRvnnDX48

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1c1df67d-9d98-41b8-8b13-d1810b20ef93
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFrH4ev5ESIdKdGCA1hqgWo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8604
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4MTg3MDQzNDc3NzQxMDcwMA%3D%3D

170 B
243 B

49ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4MTg3MDQzNDc3NzQxMDcwMA%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 94fbf1f1-effc-48a7-a636-6bad436315dd
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk4MTg3MDQzNDc3NzQxMDcwMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BD95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECFsK1UX4aJ4uQ9rdYkOVHg&google_cver=1

43 B
61 B

38ms
22ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECFsK1UX4aJ4uQ9rdYkOVHg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARiSpNa9ATAB&v=APEucNXDf0SV8hhm6bYHG5iyfYEgmNbjTFKm9kE0lRuwEtLP37WSxhax9akmmjqYgLsKcZzlmlK0FG_-t-t56T5R1GsLvfPEAspqLZpH9qUBdsmj_dS3MLbs_LpiuSBhEclDND4ijGVt4vQRW7_VYMPu4COEhuiPbRx4EdnuJoynm7wjXyRWtpQ
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 google
server: OXGW/17.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECFsK1UX4aJ4uQ9rdYkOVHg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame BD95 43 B
305 B 52ms
21ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARiSpNa9ATAB&v=APEucNXDf0SV8hhm6bYHG5iyfYEgmNbjTFKm9kE0lRuwEtLP37WSxhax9akmmjqYgLsKcZzlmlK0FG_-t-t56T5R1GsLvfPEAspqLZpH9qUBdsmj_dS3MLbs_LpiuSBhEclDND4ijGVt4vQRW7_VYMPu4COEhuiPbRx4EdnuJoynm7wjXyRWtpQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
server: OXGW/17.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame BD95
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESECx8n7DxZNxsDKzhYcNoosU&google_cver=1

23 B
172 B

32ms
32ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECx8n7DxZNxsDKzhYcNoosU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARiSpNa9ATAB&v=APEucNXDf0SV8hhm6bYHG5iyfYEgmNbjTFKm9kE0lRuwEtLP37WSxhax9akmmjqYgLsKcZzlmlK0FG_-t-t56T5R1GsLvfPEAspqLZpH9qUBdsmj_dS3MLbs_LpiuSBhEclDND4ijGVt4vQRW7_VYMPu4COEhuiPbRx4EdnuJoynm7wjXyRWtpQ
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 19 Jan 2022 11:51:08 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESECx8n7DxZNxsDKzhYcNoosU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame BD95 23 B
172 B 80ms
32ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQlL6EARiSpNa9ATAB&v=APEucNXDf0SV8hhm6bYHG5iyfYEgmNbjTFKm9kE0lRuwEtLP37WSxhax9akmmjqYgLsKcZzlmlK0FG_-t-t56T5R1GsLvfPEAspqLZpH9qUBdsmj_dS3MLbs_LpiuSBhEclDND4ijGVt4vQRW7_VYMPu4COEhuiPbRx4EdnuJoynm7wjXyRWtpQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 19 Jan 2022 11:51:08 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 7190 106 KB
38 KB 162ms
39ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Origin: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 13:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82062
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 13:03:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/elements/html/ Frame 7190 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS12umtxVImrhOtu7rRxesjfcq0seVKOge8soQ16PTz2ot8bnl99RR1oiY67SZBC9raUjpahQbay0bDzxed51fkL0WvFXvvSiJ9USknQCuQhstTHgWli4ULX-N1ZEOgxiNJhZ5k_I4h9XZBr1HrcEGnmmIYA&dbm_d=AKAmf-DpGApA3L2JXyUr1R27D4-aHZkpDwG60SkM93g3GX-L_kFSCXL3-PSddbpHNJB-IxZxQy95e8xgL5c5YEM1s-9KGZfiLRueMlJcv_f6EwoWDZlxOstVD22XGgAojtB4bCn-6Rt1w_d5ihmmUnPvPFLYbuVXfSWsfe0yaBf4FukbulsaDUkiXBASnhsU54ue8O77d9ADUkWNvQp603vnW5qWTfYLAsRQPF4CAgyMcDZSa2w6j0AEo-X6zJEr0zGrc9z_1hbeYg7RZHl2Gc8tVdBs7rctEspL9g9tP2lOHB-nBVeuogXp7WysB8WWBbW934kul3H9Dyd8LN_0tGmSRhHMCqB5tk8hZfyDuPvHDDAH5zETLUPRGf17aFjaczZICgKMOB1Pbpexf0qBhxoAnnyIpsj_Q-r7F_i9xNRtBUBJtpIBRA3MCxnhmT4kmdIX1MpoC7OWksDaZVp6jfJiHLqN9R0vVQ2-4F08eJ0rQhYbgj1H9Fl9geYdfsiFVbHsVPpMDsv7osMRkMzEFTEAzmAgCta2WSYT8k4iNYwRyDL_Dha2oFepAe0e9itpLTEkyMNrb-bGS8jIBzbrB62mH9xUeHsB70EHK8-8H8jwVj8n60LX0qOAemnV9lLJPjvNTJPj7xpj0QPrwzAqJnY7R0Atfd9TBLgH-vOkJkqi4vm3RKox0ipMggoypvGxohPwYpK7k6vtJEqoSXHQFic0AuQDzq3Mu7E3f2po1yV0yYu9aeOzw58bcbxA2tbeQMAz_nRn4Du8uvi3P_7ohzrRiTAraU6qE-7eNgEK9Wqj6NSgYheehUig-XHL6XtsyZbfMuuQzd2J9mi0IOk0HXOZ2WUw57J915pkMhnUpP6d4jL2wX2Gxn3VNePtVPut46QZWt9fctAcSjXNz8y0o43c9ICGQcwsZf1lHj5Qxw3LwWfuZf2Y_iN9kbAxYatgoTHisJfwyBY90ASVMIx057xDsvsbDvKvXSMBTRFizSB40O89u5wcyMglJhPy7VznZlBUNkm0XThE528LrmYQ3G5ViOocXOJomHHBsw2vL3aA1VnTLRk2906wV4Dz6Cf5u6mT34Exyi1LkPTdnWUbxzX0gcfn02_yucgcVlgCqJveb4OZu1cWiUgvnVFG7jqZ92fYGg_xtH3GR4nTtEzb0oGYIdQ3Euc3Qq4MMnG0LUfljCzFAay1LQxhSXAenT6u2ZdX5EsxFb4RCoCbglntrzLTsEGG9_JuZyZpIB7s2v7ds0j4ww49BTi0UrrmKhaoH4OO7nl29dCncxWVRfRpygscK5A9dNlPr3d9ZYi3-wMwWfKil9RjOwbjxYH2YiJ3gMbpg66kRHWX2plFCKgpGjhC2TKwBVF6XlQT-QLMkBZfty9xkHrRZO5fjrM0TlPtAO82mkkrk8Lg5B0Ft4rCoxxF9zRANyNrtIH3TSjqeaHGTKvliFLDo2wc1eJjpaPXo-Ji4i3nAlGObAMwhMBT6BhWj72epsjQOAkN9bUZ3YHPWukjcyBAiB8mosjqCcMLRVsVgvwSDEqcdiPcU5kK26RxVO6jwgkMIZRG6ykEuCkOmFWV9AhG7gi96o9WcSOqfKoJ8gIDRf0TJNPaqY_cLh3K_SJ0MzXPKKFO9HuS-RLCDkux963EK9m7fx30OADby7hrkhDD1OI3Z4TCchhQKyn1bnd94qvtSXEwI5km6kOX9VQnk74uLmA653frVIXFGLcY1-Odd4mgSSaDMYr72spxLgJTPaK-905aQbBZA-QRsYrO6pf8GxR4-gGz9aWaIGa2GL6TBjMy-VC9vIoCmixnHzQ18Kxz6G56ofShaUMhPAmgY-dis87D4QKgE7sU4tW9Xub1jMj9Rh1PjbHEdVcPPyJHkQKng409KKtmrLRbCYq4SzdihQl4bvLeUGlu2udeqlJI1nG9jhi5cxrL3WFJRntFL_EcFR2RHcHiP6PIt72CiYgzYJPXZ92pSnaH38DbyM4Pr9poihivaRLzCGMiEEXJAtIa1H2OK8w1fVgOD5nLEQWzURFKs8OP38HWhlABIjtiDmKLui9Um_XMRzJj4JQxyWvmEePOIp9H3hL4LigY-nfkQ2bIyx2OtB9go9z8T9TbMFR3rN5E-JGV8WbUm-WN19ABFw3Tr_u-7O-YriSSz8nWta14SgPL35mUAfEIv9QzH4A-IwcVYuHR-gD8pZXqJSr8Qh_qd8wmkGpCsoptBo7u7kpDKFSQjFVz_lV8azCeFUlc6IHr6fmX3v0kVsWCYTIEzKFN3ivgEU4PVzp704ZTQaNtW9OcvUxDgHuagFlqQqWlNNBvzVQKxM9OF7mbnCV669oX--QnSr1g3WmUHmBEIMMSTq0ZT5s7efw0yi3P5tererlKAp1kgAH5EeV1ifajfA4XZ4pHR9Ikmds2PQdM147SfYTtpmDAXbEPlSsufHFkSIKmg1k5BsL6wJ-oD74v-4Bs-fD5Mo7xlaJOHXVyX_o48JbGzqM_zI3HSk3lNlvSGt5Wlm8eUlzKtJ4XHRlFXvwWzMI1bMRFshea6wN853YB9CepoRJQwAA_0163RfUytifVK4sECmzallu8ZlaoTAzjQZZd0L5KTSGcBJFHd6XfNywNeKSi7nSVaKjwC9ixRzNMudEsXxpMMGYwk9N2G0fPILRf4riorjOarllz5cdd6jEyTMN1ryCsvW58MBGIF5mQRTuc7Fbq8fepEdATMa95jEO-j0Glku7Bm4i9sNzYakmj0sOoAVx4aSWcnk-nkse7kRer1JhgFxyMMi5vlmAwKPf7Nmun_M8LGLw89yijxSfaW30rTa-6Iul3_8I-1zYpqfVT-Pf3ml-MwGyyNbWXBJAs0MPECdn_G301DpMny2uHIt5_6-XoAw89DOEguEtcSWGX2WgXNxhT8bBedTwlgO2aLXc1onb7I5nJKSRGIdARBAyC2SRO9hzwn7wYprSW2CBvbnTFLnHwkK44w9O2lZsv0LzuDiikPEaGE75PXfmexukEwZ5opHDvmeYdJDIH8BJ9n7vnMxyo5dUcjhZXxKL8tukf6d1o4bM70Y6meO7DPtCqvkDX6lirDWeHKotrYbgbYAYelnSh56zhXUdD-mFbfFqqL_EIP3XrfG4_TK0KBOpjfP1BRIDUOaxr4EqEbnA_XMnSi7JFB_XbLN_UW7-VEW1glVtpE6Detnk&cid=CAASEuRoTixVLcMZqrSIXknEaL92lA&rfl=1%2Chttps%253A%252F%252Fzvon.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:45:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/ Frame 7190 24 KB
9 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:33:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1078
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:33:10 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame C7AE 169 KB
59 KB 175ms
83ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Origin: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 18:05:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63927
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 18:05:41 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/elements/html/ Frame C7AE 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DUNK6hPhpmWx4C7o6EdD5Q_Zi6ejyenGz4hjThoeGi-HfwwF0AK768Nj7jI9wGNY7TWmAqYbyZSSHNDFXWyDdwyV_VWJjQY-nbqqbtgXcxLxI8wKZ8UYvYGA2Gut06eqOUqhUN8bRCiQ6OZsEHcVt9LW3cAA&dbm_d=AKAmf-BgvL4zXuJ8IOQ5XILu3LxBGFrP_JSugPH8WS2M1Jnd41iFxy5UbvDSoVQeIR4K0vx2GqyKCS98XZ88YUwMmq7azQpMwGa-cIf2uKbPyuuh-Ygvgj0Z2TyUYIVeiUaR2i8OKPuIXIlInC7Odzq1K6gosVkJHjm-U1s0kU3cj7_TqzgOl4W3paTV1gZ0JCqE58PkfVSqP8WEezuESeD7SRrk3sjT4Rua6ML0fSZ0rkNQEZp8QtZIEcetxPTL3ghQYI5BfYI26sclXltOjmhsFudlfRAhFltCHYtgg3cP-baAluzYmGTi6P9mMAThykOzhbJQp9D-Q5RJM-tjYYyLJ08J5E8HvYe9bhDOOi89Xfo8bqEYkNJGiucRhHva5IDr1i7CArNyLw69DPHRNfjfdQFQGUQHhcoCMQTZ1JUpf-mEN-TfndcoVuBGgYJVjIWjeZIDs-GZkDSivjTMJ0HCGLbwF0Z0xlyB0S94gGX4XEKMJsYeyExiVIF0SgKPwGAuzSUpcSeQfM1Zy283pctP_Sp3F2V07F7iVBnks14ZqpwM_9BPdhGCfz3lfga6lHZHQHmrtj1UgF0pdxi45DnXT7d8bssc2GcSrUrkKgjhJBheA5vkzcIQwWDkjQho2iGRcCJoN0YT0caPZ6QTCxI7jBC24l87LImoyxWJ5JkiKJOwIldt2HMhn79s23tryJcaiKh5WvKbDRi5aA7aJMKFM8ivJH3am5DqVMuL5pixUOa29xyndkMVuFc6mz4FuXsynsK1Pb69MuPPGIovFY0fAdQighBN3UjQ-qLg9UGYxV6XYpHbQZsAW6JV_y3PFzqHnc0eaf_flDNC3TqmWP9BNiSI30MM-YXYrctn094kkK9hfg6oQMLnA9xDsjz6IQp_U8lMSN12KS_98vn0fHh6BYubbVPzXBEWxkk5MRyrynqpNgv1QVCZiTVIBQ4ZlY5D17XaUYWU6EvMhbkvh-dJHPvC3raPEX7Mem5cQDl36DmObgwLDJucInShL0yksU_R-32NDuvJUAA7hn_8cucsU_bfdsNbOU9EwA_f_RiGxYLTEvVLfPRH_6XJeteqHwIH7pdcxWaV9SlLLxHjJ9Yz3MnwMycn65bmuvH_PcWiZ3s0N6pDTbdnhvG5KoevW-QfiaZkSU3nEoqx0zwUcRBKieT3rVtfzvUlIXey_N0hBB2IB-2_RBE5evAkrfTi9jWHNiN6m81OgVqGNnoSy-fbO9704VFOqaiMtRMWjov7Pojvbk2EutnFmdeijRnp4vP_QuKXDlEb6wEW20W4wAbHASeX7IVyv5ZNd7oQT-b1jhQB5agqF3pt3SV7ZDcTZsZHCSeEq-L-DBhLbqF9Uh4pIwaaIYI6eshNKoOJWAuWyfbPAZSWWH4sTm6fweRQiGP9e_rhrx5fY4yU71IQfjr_AGrAKBofp8GXJ-nI9QScDlx0tO7mlrnjnctyAoRM171FIJrmiM71MC4d_wdBVzHpSyCfXlXD1uEDW1K1Y4Dvam-iefXU5m0LUPpm0MqQG2qVV4rTGTU3MCesNLojCH1xe5c98g76VuOPeW8QB1Ey7lh1DAOztIz0iv1tbvihacWBl8uwZ79Y_yKxSQcRgkRPiVDMg9DtqAcl0FN2w5gBs6ai1HSdQcDl0GG7D2IR3IW8DoEv0c8BBrZ7TBjQGLR8P825KbuZlJDnu_TmiTvivKjU1YXS6jJbCTRY5Q05ycYWUIzaSlPGUD5u6BvIQWmu9z4VxW1YJWQpsyhUJjqRH4KVu5ShNlfAsHID0picOFl24ZIpjxcZgHsY9OXai4BU8-ODzO2KGXKAxEzqS2Qu4IDJgyO3WE5z1D3cuUJg6ISRHHdaL2DZ2OUg64epGvSH4MsKoLrGnBupx2NXQVUArtchP2XZOpU8tCdNR8db_2uSBTHNS6SXjM9_uyz5ES_U3Y04XDVwi8TezDKtsAGtuN_Sz7YQ_qFlBMribqF4tuRrXo_X1gRh6ENwKF6CGgBbexL3TU05-UyL5FSXzR4e3T3N0qxr1g8XF021o4D70DSnqDmPOY56pmLQ5DSP09OThxMxTmyyEsBpJgK4CIaKp4jLEegnXFymbzi9AbXNZ-uUjkU3nZ7gI6djK5OcIfQu5ZGpQpM2V3V3TEUqrFr57k8euGe_38RlIQpZhHMGmk21iF3rQeRLmVVaGxReD7_dA0M7PgGS3Da7odu3feh99JMBAGOOvNTQDFuZL39zGkvwPq405xy-ILN8Rzn_KLJO4FNak6i16H2Y9M_6fvRelNFcirMMKguYkqIOgo4By993wOUKNKTpkU2ERbo1UbE2g0Fn-nqO6yuoxQFn2i2zp3g-ZSXVzZL9JRcjQS7k21EKH6F3Itmizf0jTen0gADMB286bfLRrxrGKqtNcrbrAjZyloelgPTlL6sSPPWcYtZbuIefrcPPSFXb5FoCR_1_A90HKJpcn6l6gEM_ck3GlgGBWLltxAH9YUjSBdOHXhSnJRT4I4pT5yvZaXzFMpIUbCQB63cIDx_ZSHsjMhN6elDpfKNZ5n340SccG8BTz4DPQwNIMGmUe_TepDXqvXTy4JgvJQKNOE9AdhUWdbNYbSq_dduzJlmAgP7urR6jNqdN1xrx5SOU72lMseIDSFvrYOl0m5VszP15rcqJhRERHjivQLbcoPd-2AfPIEgn-9nWvUQIAe6wDfyoCLMHEk9XP3lHpGMWk5embyRbuBXJAIcKVcdvgo6wVs7VkcyBUMBUsvqYk3UMCa0FFaa727iMnnKPgH_oukXZ3C_chifAwowTVFuq7gMnPJSAdII8w7HGuRTZNYyOePcRiQnJ4TuwjWL3gHeyVfKjICp5tbc8x5Zke1iY1OMuqtmEMfWRBNrDhw5QkZMOLMOq5ZBcQoJzecfUZLcSBAw_eB3bx6YBkAG1diF6q9dUx9ywfCoUCii7k1NAJxcgbnjiXfKRFu0Wk93gtuNBALXcRFyQ28I5IArdoucssW1_5xSk9JNqi4WaA3KRo6Uf&cid=CAASEuRox0uOerOkdSp3FxvLuhfiKg&rfl=2%2Chttps%253A%252F%252Fzvon.octo.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:45:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:45:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/ Frame C7AE 24 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220113/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:33:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1078
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:33:10 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7190 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10986
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 08:48:02 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A52C 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 19 Jan 2022 05:53:44 GMT
expires: Thu, 20 Jan 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 21444
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C7AE 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10986
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 08:48:02 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 839C 1 KB
749 B 40ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 19 Jan 2022 05:53:44 GMT
expires: Thu, 20 Jan 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 21444
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7190 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5965bce7dda72ee9dedfe15f10b74dfb0f5f92da2a6eb270513beb354d02bb4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C7AE 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf4b7867758f6763136b1bbfb82fa8e3dbdadd7b2d295a6fa6d171ec3f342712

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 162D 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 08:48:03 GMT
expires: Thu, 19 Jan 2023 08:48:03 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 10985
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 174D 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 08:48:03 GMT
expires: Thu, 19 Jan 2023 08:48:03 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 10985
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame A52C 35 B
463 B 41ms
9ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELDL37g-oQhssthHUDOjXhw&google_cver=1&google_push=AYg5qPLLSjMGis8pnK8zBGZKRlx4Yxpl2Us9hMy1VZeNRhTV-FRPewxDUeFloOEBFhcvKKzpDZd84wpuldVAMW2cc3nVwbAfhqE

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A52C
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKUhh3Y...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKUhh3Y...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMzMxOTQwODcxMw%3D%3D&google_push=AYg5qPKUhh3YQYB6HW8KOxdesgOnR4kvleSCRU6J6bJIriyn0XqwI0nGaX4qbWs4PaRk8E...

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMzMxOTQwODcxMw%3D%3D&google_push=AYg5qPKUhh3YQYB6HW8KOxdesgOnR4kvleSCRU6J6bJIriyn0XqwI0nGaX4qbWs4PaRk8EXfmkAXL9y4nWJF_zaAztykoBXPByw

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMzMxOTQwODcxMw%3D%3D&google_push=AYg5qPKUhh3YQYB6HW8KOxdesgOnR4kvleSCRU6J6bJIriyn0XqwI0nGaX4qbWs4PaRk8EXfmkAXL9y4nWJF_zaAztykoBXPByw
pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame A52C 43 B
134 B 59ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEANspoTDxZGYLgrCBWCT0c8&google_cver=1&google_push=AYg5qPKSriflybJ_Yb7y4UvphkRH0n_xl4aSWkVTrU9OEXiH_lDtwSzie76Es2ddpBvZ8SKe_1yene9JciePKYdhsS9HQPKakQ
Requested by: Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:07 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: nrhp8shbqbifjsc69futfnccphct088n

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A52C
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IDy9aajYQrOrPLP6Q6IC_Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IDy9aajYQrOrPLP6Q6IC_Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJsX-uy5zHtjMxivbI9826TyL8Yff6BohzsYELoNZKl4r3UkbPn9REju0arRyNI7FqfBaownNgCzl3OrT5II3Zoq3Ldqw

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IDy9aajYQrOrPLP6Q6IC_Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJsX-uy5zHtjMxivbI9826TyL8Yff6BohzsYELoNZKl4r3UkbPn9REju0arRyNI7FqfBaownNgCzl3OrT5II3Zoq3Ldqw
date: Wed, 19 Jan 2022 11:51:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A52C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEPRmxUqjHKe3yeqQZchjLU&google_cver=1&google_push=AYg5qPKqKoYJSM3BrZRoY4ZUDl6N3G9edYxEO_NiDcw-1BTslIvG7LbcCzneQ3VbrsIrxrx5UmB...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzN0stUC04RElB&google_push=AYg5qPKqKoYJSM3BrZRoY4ZUDl6N3G9edYxEO_NiDcw-1BTslIvG7LbcCzneQ3VbrsIrxrx5UmBkWKKt_VOeA4xUt9kP-v2VfGM

170 B
188 B

52ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzN0stUC04RElB&google_push=AYg5qPKqKoYJSM3BrZRoY4ZUDl6N3G9edYxEO_NiDcw-1BTslIvG7LbcCzneQ3VbrsIrxrx5UmBkWKKt_VOeA4xUt9kP-v2VfGM

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzN0stUC04RElB&google_push=AYg5qPKqKoYJSM3BrZRoY4ZUDl6N3G9edYxEO_NiDcw-1BTslIvG7LbcCzneQ3VbrsIrxrx5UmBkWKKt_VOeA4xUt9kP-v2VfGM
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame A52C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPK4Dw0Hn9OBq1zJ2cJ-H3vpF0CeDoKO8Yf8xTIR5NN-NlS...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame A52C 43 B
296 B 213ms
19ms Image
image/gif 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEOMD4GGj0OAXRxA2vLkb8QA&google_cver=1&google_push=AYg5qPIEsCwD-xoTvgyNBFOeH1LYYDoAaN2om4c58d2399Ji21CaNSQP0RiT_A0jnX8PQyfzD_ciSV_n_L3rRLe_eAmtmhA8QF8
Requested by: Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:5707:3212:b6f4:c6e5 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A52C 0
12 B 95ms
48ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LrBzKj_-NHddT2YvwAFMA3hfGBH4iR4gZoLmpYEa4i7j3kCgCrpKedswZbH1oJr2KPEjAY

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPI8vl1dqgw_tKex7oDLbSN6rtDgNBoPmCrcdqT...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWVmN0xBQUFCYVRxRWt1TQ&google_push=AYg5qPI8vl1dqgw_tKex7oDLbSN6rtDgNBoPmCrcdqTfYvneL0udr2Q1BXXZS62e0P94TrSCAU_521tzekUL0Awl-qKXl-tJ0V...

170 B
188 B

51ms
51ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWVmN0xBQUFCYVRxRWt1TQ&google_push=AYg5qPI8vl1dqgw_tKex7oDLbSN6rtDgNBoPmCrcdqTfYvneL0udr2Q1BXXZS62e0P94TrSCAU_521tzekUL0Awl-qKXl-tJ0Vp8QQ

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWVmN0xBQUFCYVRxRWt1TQ&google_push=AYg5qPI8vl1dqgw_tKex7oDLbSN6rtDgNBoPmCrcdqTfYvneL0udr2Q1BXXZS62e0P94TrSCAU_521tzekUL0Awl-qKXl-tJ0Vp8QQ
Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEFyacKaXG_IIlciWknzm7XE&google_cver=1&google_push=AYg5qPLMAxf8Vu_AwxYl9wnWtM7jWMKDCg6uxcqUWl1O2qj2fKTEX1F5lUsxDdP6xGTy6yrDmPZe6FWM-s2IKSSOdH_sByCB0-v0hw
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLMAxf8Vu_AwxYl9wnWtM7jWMKDCg6uxcqUWl1O2qj2fKTEX1F5lUsxDdP6xGTy6yrDmPZe6FWM-s2IKSSOdH_sByCB0-v0hw&google_hm=Q0FFU0VGeWFjS2FYR19...

170 B
188 B

56ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLMAxf8Vu_AwxYl9wnWtM7jWMKDCg6uxcqUWl1O2qj2fKTEX1F5lUsxDdP6xGTy6yrDmPZe6FWM-s2IKSSOdH_sByCB0-v0hw&google_hm=Q0FFU0VGeWFjS2FYR19JSWxjaVdrbnptN1hF

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:07 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLMAxf8Vu_AwxYl9wnWtM7jWMKDCg6uxcqUWl1O2qj2fKTEX1F5lUsxDdP6xGTy6yrDmPZe6FWM-s2IKSSOdH_sByCB0-v0hw&google_hm=Q0FFU0VGeWFjS2FYR19JSWxjaVdrbnptN1hF
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIGThsOSXGzUMqY4QYS_Q4h98rOsCAFmML_QoXTCUM0IcUyrGfc6o48DZaU7uvwMUU-Ws4Fudxo3U1Kb1toVWSlIsec2SzK&google_gid=CAESEEcKBXkiDkBllUO_UVhHa88&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCKz2n48GEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBJR1Roc09TWEd6VU1xWTRRWVNfUTRoOThyT3NDQUZtTUxfUW9YVENVTTBJY1V5ckdmYzZvNDhEWmFVN3V2d01VVS1XczRGdWR4bzNVMUtiMX...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzlhYldCZTRSMUNkTEV5VjhLdzRmQVBncUhqUlh2S1RmYVh6VmdxcnBXNA==&google_push

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzlhYldCZTRSMUNkTEV5VjhLdzRmQVBncUhqUlh2S1RmYVh6VmdxcnBXNA==&google_push

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTzlhYldCZTRSMUNkTEV5VjhLdzRmQVBncUhqUlh2S1RmYVh6VmdxcnBXNA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJSRuPB...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJSRuPB...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPJSRuPBRkLzgIh0dwR6CmlEwGrADWD5Od9M84FIBFj1X3EOuEG4AeqVqi0iZw3Rpv...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPJSRuPBRkLzgIh0dwR6CmlEwGrADWD5Od9M84FIBFj1X3EOuEG4AeqVqi0iZw3Rpv-Th3uZHdlWuTz0-iVc-eFtCitXj_TYjw

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPJSRuPBRkLzgIh0dwR6CmlEwGrADWD5Od9M84FIBFj1X3EOuEG4AeqVqi0iZw3Rpv-Th3uZHdlWuTz0-iVc-eFtCitXj_TYjw
pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 839C 43 B
350 B 56ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEANspoTDxZGYLgrCBWCT0c8&google_cver=1&google_push=AYg5qPKT3b9Oaa4heHL7Ny5xW5hbNxbEP0MZyPAmpSUkDEV1HDtMfNE8SfUotXMp80FyYO40qMcEf0aCVR22RrNmJSdyz0-SoAdQ1A
Requested by: Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:07 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: afka0mlvc37j4147m90ueo98spssef8m

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ5Lj9e9umG0rpscuqyrlTM0l61KZkvg5EP0OUH2Cwp6rm98PLM-4MaijK5pwRW4RK0xxFyXifAl8iqiosWbcWifE9p7UIHXg

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ5Lj9e9umG0rpscuqyrlTM0l61KZkvg5EP0OUH2Cwp6rm98PLM-4MaijK5pwRW4RK0xxFyXifAl8iqiosWbcWifE9p7UIHXg
date: Wed, 19 Jan 2022 11:51:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame 839C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&google_push=AYg5qPLKsJZCVwSUR6zgtUiTM3Ek5XTZEYzgh...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 839C 0
12 B 92ms
47ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IExQBtTEvNecjULjy_Gd5rPYH5iGJvtO0YfhYpoukD2R2OhclwGO98B7cNXy8v07wCrTtp

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 sfht0if3y.js Show response
cdn.krxd.net/controltag/ Frame 7190 11 KB
4 KB 47ms
10ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/sfht0if3y.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9cf0a7f1ad73851698fe4e7acf61754a0d6cc2dfe12ac15f4c0248feace8cd85

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 varnish, 1.1 varnish
age: 715
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 3743
x-served-by: config-service-a002-ash-prod.krxd.net, cache-iad-kiad7000137-IAD, cache-hhn4027-HHN
x-response-time: 0
x-do-esi: esi
x-timer: S1642593069.541574,VS0,VE0
etag: "b7b9ede32a13955b010743207a7d773d9229f60e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 974

GET
H3 200 index.html Show response
s0.2mdn.net/4528516/38224376047253/ Frame 70C8 7 KB
3 KB 86ms
39ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4528516/38224376047253/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc42dc9f8619314a0c8520b18e341729755c004cf9291312b05cf2fb7908821b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 2653
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 18 Jan 2022 23:00:12 GMT
expires: Wed, 19 Jan 2022 23:00:12 GMT
cache-control: public, max-age=86400
age: 46256
last-modified: Wed, 12 Jan 2022 14:31:59 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7190 0
61 B 198ms
86ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssvHym994AyVsDLi_O35Dl3Z2AX3j1BNtDVmC47PSHwAe4w-JLvNHAeNNlcY-nWpcDVtMY57PpmTv5vW4odaYHX4oBLa3KC_GM6nRqIf_KpfIvQiRaEnXhWE5xAnc0JnWVPV4-tlCNuQ9QX5vWY8d_mFscoHxAVKZVPRVwG0nJSkoILFan1Apl9XzN70dtiOVU0mkhSu1yjGD1IW1xS9y6IiLcNMn7eyDh4Uz1MvpsY2ENzf698xOR-epSYvaB4kNyI4sOvfIOcKeVvYpfMBPTWKmcZO1As39zlcKMvrpY_kPQbHcZTX2WMRbu5scod3jcu5ciy1EGvbp_x10AdJO98fKerwhNz1vlzU0OuSW8IyQ44YX3Mfj6i8gfnOdPCrlL7rSrQVwy7RGvtZYUphp2rzk-_AF2jTeY1bOI4t-SU943a2Kk4mzY4-TWnpGVliisMj4eNt7PRm1VS3X2lBpj6kxUwL_ElwWCdXMzPoVzRkiUS-Svl74zW2sLxziYdaWYWcbUCs3Yc6n897vtksu-2u2OxzPaJ5nhKNb5LLZjOx8bD_9_uzszo0592nBHps7xklhO-5UQ09LvSUiLNEyoL-MMogXCU1dm1V4VHUZh9RDIZUTSpDFvsY4h2hSeA8eHGcspjUODwuo3WiFhCK_fIobkhi795Q5vKfGJsPC2w0LMIQRWID6Jqz9JHKq6TgIPyVKj-MfGmsah-kbr-8y3S6egTeja-pGhYZ7aLJYfLtoEMLdhesgdJzRGUi9QGBK2P4xv1YC4OsRWIoYjhfxDE7d7zNoam2HuIheLmdWPDb7vorODftJNumBsc8Gvl5BoUgJT1QH0OkOu1oXAniZQnd7_-JxxDEYu9xVaPgZEaHq6twh5w-BJ6FWrSc1R9pYE0k-M9neHy1h7-9xCph2fb1E9wN065qZXFofes1st6g4MnLAkcy5dZkQqpyVXU8w82e6jrCmhfG5pOj4-aLdMwFrjQseH3qwmts4sqa8RdSMCbr2S2GUQRm65A17bqB1O52V5zXBZSEMqWlzrQF9uLEziMmrxYyVjjWyIOonqf3mTDt_aw0P8QWplGJ3pmdYHwPNLWGvZDh0q_3ggHJw2JcjNIgYzrnVtyZz0KWauBaXp3gAZ_QeYegF2L23kh6SbPCkY_rXaJ1I_5nqzz6-eUIDe9gRS3AtTdwbMR0P0jZ6XJ&sai=AMfl-YQqfMGdE_Fmfc0rRvAyj5jj-QwFYu-OQUe-n8kW_5QbY0qOSpWOTtaFbBF0miVj79eT3Bo4RABRIoNqHR0pabku97s3zpg_Cu3hX0UCgqeTuCDoqa9xe8XKE725GBdqQ7yBlRMOOT75Rmwtlc7En4xc4VCGRg&sig=Cg0ArKJSzEIPcBT-TIVMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=250&cbvp=1&cstd=248&cisv=r20220113.93191&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 19 Jan 2022 11:51:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 160x600.html Show response
s0.2mdn.net/sadbundle/351369470800822272/ Frame 818F 43 KB
10 KB 77ms
49ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91cb10817eaea10d296e4c3e50982dbf69f460a6a5e0e80b39b83723c34b9d30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
expires: Thu, 19 Jan 2023 11:51:08 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 10 Jan 2022 08:56:37 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C7AE 0
571 B 171ms
80ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvKtyo7xQ9gZ7Y_MpmrD6GUiyj_q5qqZdvQMY0QeW89G9ufTVv5CltrwO5zOVnFImxYTuno4_BN3XavLnZiGIqVfP5Jr68Fzg81lOnw1xzxhTttgIFsPCa6-_pKUi2-OH6c-RdydEkRdijmMAc_3t4FEWFfkpWPa5LbHgX9Nfsu_NiFOR698EkrBCFSO2GpiGGbTRCzbIwd5RmXD2gIDbC8oif1-vOupVzRrbzqomr_P4vu706vPHoP-Gv1NenXzg9HCy5ulEyArooL7JsKTlIjlUzNWM5IuUrKto4chAMyq7ucvIUo9SkH-mlxYm42vhZ6rs5TXx_hnn9vtHaZ0Cbk0ylkAFO8_GcQNhVCx_bfAY3RDVeZs_zmOF41UrA5PwyzKR0MS2PjrEpJJGMw1KXL-bOZw1l4dZE2VJpohmKBX-2AylQNKVRRPhKQd9wohtaAIrpUSP-uze-I3FIFPh2fvu0bSpzHIvhn6qKkHA2vzJ3jJIBXWkf2lx5pxZ6wqsra5DU6dg1WvhzSCsvKN49Ap8juaFnXxGQA9S0AxR05PNEycyl80dy0YpfkMEWMa-m809TtL1BVNrgzBHFVhoCkgQMmzq326juF0Ma5L9WZD-tcZ8sIrg-zjVgbwxDb5t3t2h5U9wAlBUyDvXcfeBLUOIHsI7YuYD9VWe8kdxu0AaXOVgWXOuEbR5ibhMdt-SkkN8glJVlglHRZeSMe_pX-iW29-3s57uYpWSbNb19NacbMHHBHkyap171KSxV_KSDnYZd1Ez5CwWL7T_xJ0ko9lflXNwnbH_8Ctemd6OpN8dTjMHb17puumY-KZ94pCDO0uqSNgA5cjYUuren6-gpZ4C01nlb7fLQtN-SvRR7SsD_y3WaKYXmhwj0rcLXaG2bbhCKaYC1hqchFuK94uXjPeHRMoe663qSRzuzJmpableLjtVFPLsyPQ-vnEBubedC656gMffvwR2WFehdRz-oapVfAB7VrwFbdqnPoPvpj2ZFhGnMEKeeaWf6j65H0hfqO4CwUUt8xV3VBXZxMEi6B--sRMMl4thGXcNcFpQTHyJ2dUDGeoUu_Qq5z4wfFzgWW7Wq618ncgEwJMIeZWIsvN93VVNUVfgiMNBXEwP5To3ddIabVIVnUcOYkjo6sZ8JiH7D6qx3KTDBUCGvRu9dq9w&sai=AMfl-YRJjgNZ2uD69n-z595EFfd4EK0on-OpspuvMK2HSX2iuv3GeaOYqnO4cfSvfpZLWd6aOdMnHmADNAkgoaKKsdv31mgWIfQeYnGq8nrarIiUe4XZbpHKw_EU3FoDFeOR_xAI8p0QEKecYjdCQnn3n4Q9-XRYyw&sig=Cg0ArKJSzNC5gm1oUa6uEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=242&cbvp=1&cstd=237&cisv=r20220113.71666&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 19 Jan 2022 11:51:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js Show response
pagead2.googlesyndication.com/bg/ Frame 162D 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5584809aa902aaa236a75bc6ecdd04661304da64818f8ec3b3c23a9c884398fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 09:57:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6840
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13526
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Jan 2023 09:57:08 GMT

GET
H3 200 VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js Show response
pagead2.googlesyndication.com/bg/ Frame 174D 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5584809aa902aaa236a75bc6ecdd04661304da64818f8ec3b3c23a9c884398fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 09:57:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6840
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13526
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Jan 2023 09:57:08 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 7C8D 2 KB
2 KB 66ms
30ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzYyNDUwMTUxMzIyODczOTk4MTAvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQWJVc2tOMGI2MVlLTVVHRW9NTW1DdkEvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzYyNDUwMTUxMzIyODczOTk4MTAvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/YDB-p5_00cvh5TK_pDFbhpjvNxE&nodeid=1903&group=cdg&auctionid=6245015132287399810&shardkey=6245015132287399810&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.174&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%26client%3Dca-pub-2979533909392588%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.300.0 /
Resource Hash: f2c4378f611ad5c0280125a7f152bf7093d3e8469f79dea8e905a7f902dbfa96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1642593068
Last-Modified: Wed, 19 Jan 2022 11:51:08 GMT
Server: MMBD/3.300.0
x-mm-latency: 16 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x31, cdg-bidder-x142
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 7C8D 2 KB
1 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:50:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:50:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7C8D 121 KB
37 KB 142ms
95ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 7C8D 15 KB
6 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 996
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:34:32 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7C8D 0
0 80ms
79ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cv1JVLPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBL4BT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_PzvyUSPT9OPCjEohl89J6ePMxh89OAHni9MBLMIy-_n4W2MYHEEoAG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMjk3OTUzMzkwOTM5MjU4OBgA&sigh=4phonMAYKGs&uach_m=[UACH]&cid=CAQSPACNIrLMdpxTrZ6HMbTjGCHscH097HMaL1J4X589BeN49Sk1TTzVrzEyDYhSdEoUwERXyXn52lZ7JhpsjhgB&tpd=AGWhJmvX9sWK5DKT2m_k3B-rEIyqAVs98dpp8mKJ29JoYFl5NZKNGGc1fESiRb8R7NPPe3JmvpW0iGkZc52_9OpbewjfvsfeNJNnNs2y_5QqH3wnLRGykwiRx8XryZBPW_SGzMZKnn4CwBKZEFXhzkzIS1HnhE7U0L3mdLqxU-x1F_E0JtvtKtZY8TJe0MJ1CS0AYBO_5TliVWGF5HocKkBeeIXtrPKo93ogH1ikdILzpmx1TgW-3DaNsuYJB-k9rJzQ7g-J0ko5nruJvwOVsUhuxb6qFlCgxsiIu_94xZiuaRsbV9H3w-ngJ8HiMcKJUrMYE5yH89ZhkZG0NAYcfajFInUlx0cW19OoXiRatjBnqfHRLWCjGziNwxx9VuN7NsoRbTlKsYVXgETvGveY9dZhXNu1OwFnTesO0reyyQi-fP__lCs8n5rvNLr3yCZL6R0ierGybYZYQT8o13T0_FR6iTc5w-i7cBnjjRtlvoqXGHXuR2vBWMy4AUsVoLBQvwojDsCTbnbLh0reFprcIrhc0pNDMop3h0P3MmJQMG40f0I2LN925uZjuz0o1amosH5bGd4SuymxuKV_vZvkIklu3-636dYI3eCbq0xr6VIiXKs9nxE_Xnb5mz9425dvwj0EbxwWCc8E7_KhmRSzDkaJd7OaqftZ47KpBcFN3QIEvPm8BaNtt8jLI4LyLZscypo4Gi5_EtaFOjl1Nh3IESfsuuL1a8SPTcBuNHdE3ghitWKqvocfRUCBcOKIzWW1Fao9PsxGAaFrY3A6L2Mleriw8ZPzSz6e1cS48hhecg5pe1iMs7co7fBfgwwgyly1-UWjHFaaPd0g23ivpDrVPBgR-GLEoHZnbkbj08dL1_VLYpCD7nCVkuL2ZiUBKwQWi8YUR95Blxz5nSjgzcUt0dXz9Um7GIyJ7yN1oBOY2IE6RvaxByk3rnfkVnTL9WRQ7N9muI8AIxo_Xq-IllyaYg2nvk3ZX4ZtYV-s_r5Y_p5TdsyRlkhybPXjywbxwPTBfw6ZYk4GOlpGc90pfoHtbTnViLgWO6cf8Q6t1lmjy2JPh9wJ15LRw8IR85HuyTP8L4Iy3VUlatF8Qv4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 19 Jan 2022 11:51:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ Frame 7190 259 KB
83 KB 8ms
7ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/sfht0if3y.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
age: 721176
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 1388825
content-length: 84509
x-served-by: cache-hhn4027-HHN
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1642593069.555749,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H2 204 ad_impression.gif
beacon.krxd.net/ Frame 7190 0
338 B 131ms
28ms Image
text/plain 52.18.40.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/ad_impression.gif?campaignid=11313517&advertiserid=4528516&placementid=150618923&adid=321276323&creativeid=164633713&siteid=1729994&url=https%3A%2F%2Fbeacon.krxd.net%2Fad_impression.gif&_kpid=af5fc09f-edef-481c-bfa7-696005c6deb3&confid=sfht0if3y
Requested by: Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.40.211 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-40-211.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: private, no-cache, no-store
x-request-time: D=62 t=1642593068
x-served-by: beacon-n009-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 70C8 236 KB
63 KB 65ms
19ms Script
text/javascript 2a02:26f0:f7::5c7b:e051
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/4528516/38224376047253/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e051 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Wed, 19 Jan 2022 12:06:08 GMT

GET
H3 200 javascript.js Show response
s0.2mdn.net/4528516/38224376047253/ Frame 70C8 27 KB
7 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/4528516/38224376047253/javascript.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/4528516/38224376047253/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b038572bb1d8062d11e50bc0fd8757cf17d7edca9d7adbed8ca3110a589667d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/4528516/38224376047253/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 23:00:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46256
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7036
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 14:31:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 23:00:12 GMT

GET
H2 200 af5fc09f-edef-481c-bfa7-696005c6deb3 Show response
consumer.krxd.net/consent/get/ Frame 7190 236 B
426 B 106ms
34ms Script
text/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/af5fc09f-edef-481c-bfa7-696005c6deb3?idt=device&dt=kxcookie&callback=Krux.ns.congstar.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1c16d201a9100daacb04cf145129a08cb61e6c06afe4c81f9d63eb7090718c12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a004-dub-prod.krxd.net, cache-hhn4044-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1642593069.730739,VS0,VE28
content-length: 187
x-cache-hits: 0, 0

GET
H/1.1 200
OK kfm7pdl6j5sw Show response
hal9000.redintelligence.net/zone/ Frame 7C8D 10 KB
3 KB 43ms
12ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/kfm7pdl6j5sw?subid=&gdpr=1&gdpr_consent=li&rnd=6245015132287399810&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABd8EKGaAJmAEzrg%26mt_aid%3D6245015132287399810%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 024d502508a798f60c4e4c6f9541cb439746ace4c1038c57449493fd1e5296ed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3282
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 7C8D 49 B
330 B 58ms
36ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=6245015132287399810&node_id=1903&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzYyNDUwMTUxMzIyODczOTk4MTAvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQWJVc2tOMGI2MVlLTVVHRW9NTW1DdkEvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzYyNDUwMTUxMzIyODczOTk4MTAvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/YDB-p5_00cvh5TK_pDFbhpjvNxE&nodeid=1903&group=cdg&auctionid=6245015132287399810&shardkey=6245015132287399810&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.174&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.300.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: MMBD/3.300.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x82, cdg-bidder-x142
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 7C8D 43 B
404 B 48ms
20ms Image
image/gif 104.79.88.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=6245015132287399810&v3=863182&v4=10023288&v5=8675613&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzYyNDUwMTUxMzIyODczOTk4MTAvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQWJVc2tOMGI2MVlLTVVHRW9NTW1DdkEvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzYyNDUwMTUxMzIyODczOTk4MTAvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/YDB-p5_00cvh5TK_pDFbhpjvNxE&nodeid=1903&group=cdg&auctionid=6245015132287399810&shardkey=6245015132287399810&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.174&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-79-88-164.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master cdg-pixel-x4 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: MT3 4133 baa842e master cdg-pixel-x4 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 7C8D 49 B
330 B 51ms
28ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=6245015132287399810&st=10023288&time=1642593068&nodeid=1903
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzYyNDUwMTUxMzIyODczOTk4MTAvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQWJVc2tOMGI2MVlLTVVHRW9NTW1DdkEvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzYyNDUwMTUxMzIyODczOTk4MTAvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/YDB-p5_00cvh5TK_pDFbhpjvNxE&nodeid=1903&group=cdg&auctionid=6245015132287399810&shardkey=6245015132287399810&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.174&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.300.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: MMBD/3.300.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x21, cdg-bidder-x142
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 818F 118 KB
40 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 20:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53868
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 20:53:20 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 818F 60 KB
24 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H/1.1 200
OK request.php Show response
hal900029.redintelligence.net/ Frame 7C8D 2 KB
1 KB 157ms
122ms Script
application/x-javascript 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request.php?zone=kfm7pdl6j5sw&nw=20&renderingType=javascript&namespace=2f0ba0a451&subid=&uid=9f90e30a1b89f86c&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABd8EKGaAJmAEzrg%26mt_aid%3D6245015132287399810%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2979533909392588%26output%3Dhtml%26h%3D90%26slotname%3D7096521402%26adk%3D2342716466%26adf%3D3252783458%26pi%3Dt.ma~as.7096521402%26w%3D728%26lmt%3D1642593067%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fzvon.octo.net%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642593064576%26bpp%3D1%26bdt%3D257%26idt%3D3391%26shv%3Dr20220113%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Df136854c4f74a02a%253AT%253D1642593066%253AS%253DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q%26prev_fmts%3D728x90%26correlator%3D8687887389938%26frm%3D20%26pv%3D1%26ga_vid%3D114075819.1642593065%26ga_sid%3D1642593065%26ga_hid%3D1445575078%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D277%26ady%3D1205%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44753740%252C31063247%26oid%3D2%26pvsid%3D317451230437942%26pem%3D468%26tmod%3D62%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CoepEbr%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DWmuyo6q25y%26p%3Dhttps%253A%2F%2Fzvon.octo.net%26dtd%3D3393&ancestorOrigins=null&random=204306396729&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/kfm7pdl6j5sw?subid=&gdpr=1&gdpr_consent=li&rnd=6245015132287399810&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABd8EKGaAJmAEzrg%26mt_aid%3D6245015132287399810%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 8f6e29d686c9d74c26c34fe310859d2d5cd3e43f71140dd196948cf858bfb353

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 23809100119332502179195011844029
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 724
Expires: Wed, 19 Jan 2022 11:51:08 +0100

GET
H3 200 visual.png
s0.2mdn.net/4528516/38224376047253/ Frame 70C8 39 KB
39 KB 40ms
40ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528516/38224376047253/visual.png

Requested by

Host: 18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com
URL: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d520c8d46b9914fc14e4d825cd7cb191a60d18fe5918c472eb1e1f2cfea060ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/4528516/38224376047253/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 23:00:12 GMT
x-content-type-options: nosniff
age: 46256
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40358
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 14:31:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 23:00:12 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7190 0
23 B 123ms
76ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssvHym994AyVsDLi_O35Dl3Z2AX3j1BNtDVmC47PSHwAe4w-JLvNHAeNNlcY-nWpcDVtMY57PpmTv5vW4odaYHX4oBLa3KC_GM6nRqIf_KpfIvQiRaEnXhWE5xAnc0JnWVPV4-tlCNuQ9QX5vWY8d_mFscoHxAVKZVPRVwG0nJSkoILFan1Apl9XzN70dtiOVU0mkhSu1yjGD1IW1xS9y6IiLcNMn7eyDh4Uz1MvpsY2ENzf698xOR-epSYvaB4kNyI4sOvfIOcKeVvYpfMBPTWKmcZO1As39zlcKMvrpY_kPQbHcZTX2WMRbu5scod3jcu5ciy1EGvbp_x10AdJO98fKerwhNz1vlzU0OuSW8IyQ44YX3Mfj6i8gfnOdPCrlL7rSrQVwy7RGvtZYUphp2rzk-_AF2jTeY1bOI4t-SU943a2Kk4mzY4-TWnpGVliisMj4eNt7PRm1VS3X2lBpj6kxUwL_ElwWCdXMzPoVzRkiUS-Svl74zW2sLxziYdaWYWcbUCs3Yc6n897vtksu-2u2OxzPaJ5nhKNb5LLZjOx8bD_9_uzszo0592nBHps7xklhO-5UQ09LvSUiLNEyoL-MMogXCU1dm1V4VHUZh9RDIZUTSpDFvsY4h2hSeA8eHGcspjUODwuo3WiFhCK_fIobkhi795Q5vKfGJsPC2w0LMIQRWID6Jqz9JHKq6TgIPyVKj-MfGmsah-kbr-8y3S6egTeja-pGhYZ7aLJYfLtoEMLdhesgdJzRGUi9QGBK2P4xv1YC4OsRWIoYjhfxDE7d7zNoam2HuIheLmdWPDb7vorODftJNumBsc8Gvl5BoUgJT1QH0OkOu1oXAniZQnd7_-JxxDEYu9xVaPgZEaHq6twh5w-BJ6FWrSc1R9pYE0k-M9neHy1h7-9xCph2fb1E9wN065qZXFofes1st6g4MnLAkcy5dZkQqpyVXU8w82e6jrCmhfG5pOj4-aLdMwFrjQseH3qwmts4sqa8RdSMCbr2S2GUQRm65A17bqB1O52V5zXBZSEMqWlzrQF9uLEziMmrxYyVjjWyIOonqf3mTDt_aw0P8QWplGJ3pmdYHwPNLWGvZDh0q_3ggHJw2JcjNIgYzrnVtyZz0KWauBaXp3gAZ_QeYegF2L23kh6SbPCkY_rXaJ1I_5nqzz6-eUIDe9gRS3AtTdwbMR0P0jZ6XJ&sai=AMfl-YQqfMGdE_Fmfc0rRvAyj5jj-QwFYu-OQUe-n8kW_5QbY0qOSpWOTtaFbBF0miVj79eT3Bo4RABRIoNqHR0pabku97s3zpg_Cu3hX0UCgqeTuCDoqa9xe8XKE725GBdqQ7yBlRMOOT75Rmwtlc7En4xc4VCGRg&sig=Cg0ArKJSzEIPcBT-TIVMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=503&vt=11&dtpt=253&dett=3&cstd=248&cisv=r20220113.93191&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 855A 2 KB
2 KB 35ms
34ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzI3ODYyNTA2MTg0NjY4NTg1MDEvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVpXbHZha25sN3BtcGg1S2ZBbkNtWDQvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzI3ODYyNTA2MTg0NjY4NTg1MDEvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/FlwjVbr6gCtKEIrT29JR0KC87FQ&nodeid=1903&group=cdg&auctionid=2786250618466858501&shardkey=2786250618466858501&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.95&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%26client%3Dca-pub-2979533909392588%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.300.0 /
Resource Hash: adb15a481b8b4eb4f511e1be4903235fc30f78326df961b6ccb9858327e89888

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1642593068
Last-Modified: Wed, 19 Jan 2022 11:51:08 GMT
Server: MMBD/3.300.0
x-mm-latency: 22 (1)
Content-Type: application/x-javascript; charset=UTF-8
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x71, cdg-bidder-x142
Connection: close
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 855A 2 KB
1 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:50:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:50:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 855A 121 KB
37 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame 855A 15 KB
6 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 996
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:34:32 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 855A 0
0 47ms
47ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS69O2YEEoRd8J4sl99-gbrGQw6kiC2BFMIRSp-z9K4RzFaMm71NsJa66GV2ot--1jCICnfUxiiuc2dDspwkMKX9Kup-A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 855A 0
0 80ms
80ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CpMB6LPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS4AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0umlQa9KCvKq67Wlsc2C45XB15RhMNbqh4rn5m6sjJ7LP2X_y-ieABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI5Nzk1MzM5MDkzOTI1ODgYAA&sigh=aSHyUE7TYeI&uach_m=[UACH]&cid=CAQSPACNIrLMTCEBKMHN9b7gG3Y4dna8Eg0qi5n4ExbKAdrDXGIFUgRgtRg4ZCGC5CBfjHliHrWLkinflylhuBgB&tpd=AGWhJmsCMrNxcqkq_DP_tbv4pXAbQxQCwrMMdZHAzbvj4lZwiWl8PiMrRZnRE04HKof1BuxCqJQOD6o_d_8S7gSchN-OqlGqYxho7PHDGD89vcN99zdugaf6EwI2vcS880antHj-cwo_btJhzJ1rLODT8KZJycpAkzzWO_quSRfTcKvJkiJlt7MMd7G13yymzeTZH67EUXAwVx8-yUnRe_09VMUFXFFJPV7K6NdsdNRHYXphUwOao3Mc9hrnUTspWEHLOAO7fu-8mwvSF68EWcCXo-snMjp0KoOcFl9GmeUbRJdKgoeFu5GcQT59cRf15jSOcx_9q-PLXzySUqyjMBS4AYNPZei7DQ330h4gYyDSoPLwAC4GuxswFaXGa3HZrRkCGA7u8aoN1Q9r1zDqjBoVJQVCSyZrt2XvpeDlQgRZ8dZpLbJYxDEfidhBmG1o3g6fFMQIKzlaq-NH2zsOt7M8btmA1waH3gTv9JwXir26IVh6RXRUPuBnb9d7bkZaqUgYByp7MuRzXKJZJ4W_waGFUQdImT5V9SHaFmq-5qpdkHYMj98zvsd18vx0o81QTow5VDBEjXdt3m0PyvByafSG-bI3nF38g-dmUiB7plB-49XyH_ecyeV_ZsdhUHgpCecmyZzueov6gVyFlEeU1g60VpNv_jDSrXeXYqn-C47eHn2YR-ZXMN_2urX_gt5meICAIF2chO7H7bkLmzq8YfZ-BS5Jj8xIM25YSN49K06LWaJVLinaRHApTp-EebeD8uHF3UXgNIROpLE8XdnqDtlAy24zCSEWLu78xSHDWO82NhlDFuNh_PtODPgwW6WvQ5p5Ik-vR77tf_ZRBVX93kpHyK2JQ_ByZTzm2tGMiBRCosqlU6ECo-1ASe39R1H2aUQ3uVOxIruDDb9TPPLsijWXbeUyi-S1BE-GwEwP9zVP9YEkRSQ9vUjDQpRbYb46SbaL5PhazxeLRTm8jZi04JZ9ka9fwqgmnAZjwX21-opNL1ouI_DP4B8iKdrfA9gIUwK81dKb-jIX-EFUXb02aVJ1f45lNAZKHbq5hv_nvnSSB4NrPxX1Lanx4YSWVR2sH-13miZMLc1xAA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 19 Jan 2022 11:51:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C7AE 0
23 B 86ms
75ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvKtyo7xQ9gZ7Y_MpmrD6GUiyj_q5qqZdvQMY0QeW89G9ufTVv5CltrwO5zOVnFImxYTuno4_BN3XavLnZiGIqVfP5Jr68Fzg81lOnw1xzxhTttgIFsPCa6-_pKUi2-OH6c-RdydEkRdijmMAc_3t4FEWFfkpWPa5LbHgX9Nfsu_NiFOR698EkrBCFSO2GpiGGbTRCzbIwd5RmXD2gIDbC8oif1-vOupVzRrbzqomr_P4vu706vPHoP-Gv1NenXzg9HCy5ulEyArooL7JsKTlIjlUzNWM5IuUrKto4chAMyq7ucvIUo9SkH-mlxYm42vhZ6rs5TXx_hnn9vtHaZ0Cbk0ylkAFO8_GcQNhVCx_bfAY3RDVeZs_zmOF41UrA5PwyzKR0MS2PjrEpJJGMw1KXL-bOZw1l4dZE2VJpohmKBX-2AylQNKVRRPhKQd9wohtaAIrpUSP-uze-I3FIFPh2fvu0bSpzHIvhn6qKkHA2vzJ3jJIBXWkf2lx5pxZ6wqsra5DU6dg1WvhzSCsvKN49Ap8juaFnXxGQA9S0AxR05PNEycyl80dy0YpfkMEWMa-m809TtL1BVNrgzBHFVhoCkgQMmzq326juF0Ma5L9WZD-tcZ8sIrg-zjVgbwxDb5t3t2h5U9wAlBUyDvXcfeBLUOIHsI7YuYD9VWe8kdxu0AaXOVgWXOuEbR5ibhMdt-SkkN8glJVlglHRZeSMe_pX-iW29-3s57uYpWSbNb19NacbMHHBHkyap171KSxV_KSDnYZd1Ez5CwWL7T_xJ0ko9lflXNwnbH_8Ctemd6OpN8dTjMHb17puumY-KZ94pCDO0uqSNgA5cjYUuren6-gpZ4C01nlb7fLQtN-SvRR7SsD_y3WaKYXmhwj0rcLXaG2bbhCKaYC1hqchFuK94uXjPeHRMoe663qSRzuzJmpableLjtVFPLsyPQ-vnEBubedC656gMffvwR2WFehdRz-oapVfAB7VrwFbdqnPoPvpj2ZFhGnMEKeeaWf6j65H0hfqO4CwUUt8xV3VBXZxMEi6B--sRMMl4thGXcNcFpQTHyJ2dUDGeoUu_Qq5z4wfFzgWW7Wq618ncgEwJMIeZWIsvN93VVNUVfgiMNBXEwP5To3ddIabVIVnUcOYkjo6sZ8JiH7D6qx3KTDBUCGvRu9dq9w&sai=AMfl-YRJjgNZ2uD69n-z595EFfd4EK0on-OpspuvMK2HSX2iuv3GeaOYqnO4cfSvfpZLWd6aOdMnHmADNAkgoaKKsdv31mgWIfQeYnGq8nrarIiUe4XZbpHKw_EU3FoDFeOR_xAI8p0QEKecYjdCQnn3n4Q9-XRYyw&sig=Cg0ArKJSzNC5gm1oUa6uEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=510&vt=11&dtpt=268&dett=3&cstd=237&cisv=r20220113.71666&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 174D 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BTTlgLPvnYbq0Cqq5x_APiuyMqA0AAAAAOAHgBAI&bg=!JSalJmLNAAZ_DxPPfw87ACkAdvg8WrpB482cvE7mQ96QJPx0reRkZHfUvzwpNrnijpJBSGjNwh-5SQIAAACNUgAAAAJoAQeZA3IETqezdSgrwNAePOeCozdjyZC9gKJ2UZZJvGGZuP3a69ZWfee6S8I7rvHA2BTAztpLgcAmqu7tT2CXj9gWDynP0D60USuRseh5ut-wYFgeedEPywrMKWBD_orG4UDfVj2Bpfr99nfiJxli4VVdObilJ6zdBANNk7TYm9jiHpq8MsHEHsa09rHXQY_N0nSFt_nIFZXu0Qei_0Kb142hEKFSH43QdXc6XVys-alr1RirjzeXc_e72P-U10tao9sVbYW9OLQi2UWUFox-b-MBgivgT2v7spgWnYxE5ucpVIHvhKLaxAHIlt6JEEl_qUsqF1vhuaXYAmqq8zEK11ftyzYYdNI03pkSz7gGAnMorkhBltRH_zwoY-scrEaJhiERNEFwDcZRUQsGEsO-_FhIHMw9T8Uv3Vj7E1U4PGvOVq3T3VzHqyInYb0w_ZTkh_e8pewPJ7XnI1khkt1SOJrf6IVGKaMby_D5C2dN5nFdQ1nF6iv1_RH108SXlYwL3iOf1TlTfsEHdPlciilhjoVpAoQLUJ9mFw04UoAbp9E8Y6BhnI_TlqAoSpXSg_M3bE5VG6cLBz1xg0AE9ymejUKD86MivlwT5u1lhZrAxK9gPf_WUHsyf5LklWHSfJNnnjYU4oxnZzJci8EBKxbRYlH4b7oX37ks7YqnOycAnO-ltjsAcDRoQOnUGUwcT8pwEgVK72GUQqgdxyi1WnzrQ_wZxykH49Krxockn4U-CnXWoqDC93qqkVTYW_7mfsnUE05hoEFueZO0pPo-tinBc_Ej50QMald6DFEj_qof8D3fUS84Xxx2__prID0_hWn_TGwfgQYIDyjBPJhaGfjIAMO0jGq5SD4ekkxekvi0NYCxLuGisgg9QMH4AnBnivkRaFURIGu3YPBFBvx_XgXH9D6o4KwxXJEmDT07quzSrdeHSTij6YQnxuC_vZqzcioW_bJ8C3PDsVgyhQRLnQfO30K2DHceovkYoGqPgUMHf5afUsxCbmGduoLjEuiD5O5bZeH7x3XkXgOj5OxtEB00UAIgIF9_UQLI3WQS_qP4Bfwxh9nn3MmEz17LW5X5BrL-XRXjdeXS6HzmCed8GcHtXZ_2mH73fFdj1cEK5WPdzHNaaAJTxTZspOmYZ-X41iyLws9EQXa1GTA3CIzDYN5nCVCk7OYZZ8Y

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 optout_check Show response
beacon.krxd.net/ Frame 7190 81 B
240 B 29ms
28ms Script
text/javascript 52.18.40.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.congstar.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.40.211 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-40-211.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f9b5dc0c12b5da893f45efc39069b828cabc0821326b023a86cd49ecfc15d8e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://18ca13d953ef7ab24ef4eb0b5d349848.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=30 t=1642593068
x-served-by: beacon-n017-dub-prod.krxd.net
content-type: text/javascript

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 162D 0
20 B 78ms
77ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BeF0yLPvnYcDUCc7u-gbRhrLoBwAAAAA4AeAEAg&bg=!29il2JzNAAZ_DxPPfw87ACkAdvg8Wids1-t5gli3c8FQ3c_26UqFZyYO4hHC-eieoa3Izjcr_8wtPQIAAACkUgAAAAJoAQeZAwxE8Y2wfvjBNvOakH4epPo6dIuu70HqjqSACRiY__4ijvnQs9jdkkpTvHL5v-UoJKN399sIt7s_yBSD1CYaou10N-Uai3BqSiApHrrkVVQp73ivMKrcfTenYsrHTkZUn_FA_i3nujzf6GwXvR1ViN7XF4aUwLUDzi4b0HhMNgVVEoFCKIokhqiSIFeiQmIuPr5j6psC6PoSWA3iSGgbueIgvxw6LcrHp5EAspw_SzAX2n7Q2YAZVHrRjc5Vq6hywQp7vLKRdUAFVm63zNZhELejXLqA4gzPNjh6UQaJ8scTYceDWXMDBlHA7UPJHDwa57vVR0URJnuW9VwA3DCIFF7_9seUEuyuiemrM5D0Ws_CWaN1hF8jKtsHrlpLHf36IFZuyTpaxGchOVR29Q3x-IlhGTM9dhAy9hApd_gADo2znednYSjyol650hPvtBeKzC97-e7K90I8M1TaQvtReluDmAqk_AvC3vHK7EPGKx3OVh5ntRfK5xbLk32fEb06vV5ivRcR7SYIgfxd8w2o7RmBoVZz77vlvKLa6rZ-Yqb-kLsQCp7yi1qDpPz2fWyIi8qYeMvchUi17Z6_80Uk8KLacF-9Xk_LZp7C7e-JZyndvKieppdx6QphhCPJWCs7tvsm8eITBsA0SZfgHHWYPJopGOJGYPJhvoXRO57gIFb2TZa5l0FKsPKiWn9XDBN070rMn9MiSnHvfjKkdsjAtcVAWPqhzBbUlubsM11vAzpuu0AzZXKhkkC7G6N9KYmIX5bOYLjUvbFlH1LZuFINWbwOy2D1dENGtQP7FIRCZzWp967Zcs0Lg9tXQNLdcUs8VmKFiRKCqVJggtUaqSEaCRCS-SRTx0A28nxKAygGSvha8_6kV_2EvlzPPdslwbddxHYa7yj5m-QMhxV7limBKB9Ppf6liHRJrKe-4uz0llsl_RMotDivHge6zfXoFxJ0AnUm36_VPjgP8Cmvb3XqjS8VWMwe1SZ_B5HrpIC78Wci9aE00r8aPbvqEzHVid9phRNAQ3PUdSCJ5gVjBBI

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK kfm7pdl6j5sw Show response
hal9000.redintelligence.net/zone/ Frame 855A 10 KB
3 KB 35ms
12ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/kfm7pdl6j5sw?subid=&gdpr=1&gdpr_consent=li&rnd=2786250618466858501&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABNoUH_YHkfQJuOg%26mt_aid%3D2786250618466858501%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 6b717fd435d8e45f8aee95e1cb5f58e79e3cf116daba6add531d66be34e69c6c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3285
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 855A 43 B
405 B 21ms
20ms Image
image/gif 104.79.88.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=2786250618466858501&v3=863182&v4=10023288&v5=8675613&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzI3ODYyNTA2MTg0NjY4NTg1MDEvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVpXbHZha25sN3BtcGg1S2ZBbkNtWDQvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzI3ODYyNTA2MTg0NjY4NTg1MDEvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/FlwjVbr6gCtKEIrT29JR0KC87FQ&nodeid=1903&group=cdg&auctionid=2786250618466858501&shardkey=2786250618466858501&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.95&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-79-88-164.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master cdg-pixel-x24 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: MT3 4133 baa842e master cdg-pixel-x24 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 855A 49 B
330 B 33ms
33ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=2786250618466858501&st=10023288&time=1642593068&nodeid=1903
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzI3ODYyNTA2MTg0NjY4NTg1MDEvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVpXbHZha25sN3BtcGg1S2ZBbkNtWDQvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzI3ODYyNTA2MTg0NjY4NTg1MDEvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/FlwjVbr6gCtKEIrT29JR0KC87FQ&nodeid=1903&group=cdg&auctionid=2786250618466858501&shardkey=2786250618466858501&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.95&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.300.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: MMBD/3.300.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x36, cdg-bidder-x142
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H/1.1 200
OK js Show response
sync.mathtag.com/sync/ Frame 855A 1 KB
1 KB 57ms
17ms Script
text/javascript 185.29.134.248
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.mathtag.com/sync/js?sync=auto&source=bidder&mt_lim=1&type=1&synclist=4&gdpr=1&gdpr_consent=li
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWTJZMk1UazFZVGN0TWpVeU9DMWxNVEl3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzI3ODYyNTA2MTg0NjY4NTg1MDEvODY3NTYxMy8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVpXbHZha25sN3BtcGg1S2ZBbkNtWDQvMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzI3ODYyNTA2MTg0NjY4NTg1MDEvYW1zLzAvODU0NC84NS85OTkvMzIyLzJhMDM6MWIyMDo2OjovMC4wMDAvMTY0MjU5MzA2OC8xNjQyNjA1NjY4LzQvcHViLTI5Nzk1MzM5MDkzOTI1ODgv/FlwjVbr6gCtKEIrT29JR0KC87FQ&nodeid=1903&group=cdg&auctionid=2786250618466858501&shardkey=2786250618466858501&sid=10023288&cid=8675613&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.95&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%26client%3Dca-pub-2979533909392588%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.248 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4133 baa842e master cdg-pixel-x12 config:1.0.0 /
Resource Hash: 02324cd53db7e9288ba072f533d8c0f4c7b99b14b8e93d68605b7b0f56f5709a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
Server: MT3 4133 baa842e master cdg-pixel-x12 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: close
Content-Type: text/javascript
Expires: Wed, 19 Jan 2022 11:51:07 GMT

GET
H/1.1 200
OK request.php Show response
hal90009.redintelligence.net/ Frame 855A 2 KB
1 KB 96ms
63ms Script
application/x-javascript 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request.php?zone=kfm7pdl6j5sw&nw=20&renderingType=javascript&namespace=af6b630b63&subid=&uid=2a87bc9d9300a7d9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABNoUH_YHkfQJuOg%26mt_aid%3D2786250618466858501%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2979533909392588%26output%3Dhtml%26h%3D90%26slotname%3D4170394609%26adk%3D2715274491%26adf%3D2671285577%26pi%3Dt.ma~as.4170394609%26w%3D728%26lmt%3D1642593067%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fzvon.octo.net%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642593064573%26bpp%3D3%26bdt%3D254%26idt%3D3379%26shv%3Dr20220113%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Df136854c4f74a02a%253AT%253D1642593066%253AS%253DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q%26correlator%3D8687887389938%26frm%3D20%26pv%3D2%26ga_vid%3D114075819.1642593065%26ga_sid%3D1642593065%26ga_hid%3D1445575078%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D277%26ady%3D477%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44753740%252C31063247%26oid%3D2%26pvsid%3D317451230437942%26pem%3D468%26tmod%3D62%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CoepE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DK0d00K270j%26p%3Dhttps%253A%2F%2Fzvon.octo.net%26dtd%3D3390&ancestorOrigins=null&random=1313735767279&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/kfm7pdl6j5sw?subid=&gdpr=1&gdpr_consent=li&rnd=2786250618466858501&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABNoUH_YHkfQJuOg%26mt_aid%3D2786250618466858501%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Neulussheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 19397bbdbeed0cf1bca0160d2060adb2159f4fb57083abc6851b272f8dc53f96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 45960600124697502179195011844009
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 725
Expires: Wed, 19 Jan 2022 11:51:08 +0100

GET
H3 200 CodeProLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame 818F 52 KB
52 KB 40ms
39ms Font
font/woff 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProLCW05-Regular.woff

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65ec5e0481c4ceacde8c5e8fab9d5305fc68496b8c75d7d58fb0e91feaf7f598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:39:09 GMT
x-content-type-options: nosniff
age: 719
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52901
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:12:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 11:54:09 GMT

GET
H3 200 CodeProBoldLCW05-Regular.woff
s0.2mdn.net/creatives/assets/2560291/ Frame 818F 48 KB
48 KB 47ms
46ms Font
font/woff 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/2560291/CodeProBoldLCW05-Regular.woff

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92426eb5437b357b9046670556ba89baa8384edcc8734f56b813745bdb9e1cc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:39:58 GMT
x-content-type-options: nosniff
age: 670
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49198
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 12:11:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Jan 2022 11:54:58 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 818F 6 KB
5 KB 99ms
50ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7b8eecb67eae0500de44cad74f8054dfe375668e3eda80e2cdbbc7696351646

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4942
x-xss-protection: 0

GET
H3 200 60005582_20211005061312251_ASSET_3GB_Hut.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 818F 8 KB
8 KB 69ms
69ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20211005061312251_ASSET_3GB_Hut.png

Requested by

Host: zvon.octo.net
URL: https://zvon.octo.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2465d58adda3a12113dd1062513e388c06fcc9bd9f74eab1d2d45de250b4994c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/351369470800822272/160x600.html?e=69&leftOffset=0&topOffset=0&c=5N2S6rRkg2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:04:35 GMT
x-content-type-options: nosniff
age: 2793
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8049
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 13:13:12 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Jan 2022 11:04:35 GMT

GET
H/1.1 200
OK postview.gif
portal.blau.de/nws/img/ Frame 818F 43 B
616 B 39ms
13ms Image
image/gif 82.113.101.236
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.blau.de/nws/img/postview.gif?partnerId=BLU_DSP_TRA_HAV_34114_PV&mediacode=26952485_4307561_323345543_154734726_PO1002A&ref=26952485_4307561_323345543_154734726_PO1002A
Requested by: Host: zvon.octo.net
URL: https://zvon.octo.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.236 Hanau, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.blau.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H/1.1 200
OK request_content.php Show response
hal900029.redintelligence.net/ Frame CD9A 7 KB
3 KB 33ms
12ms Document
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request_content.php?s=23809100119332502179195011844029&a=b7b60911
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=kfm7pdl6j5sw&nw=20&renderingType=javascript&namespace=2f0ba0a451&subid=&uid=9f90e30a1b89f86c&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABd8EKGaAJmAEzrg%26mt_aid%3D6245015132287399810%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBAvELPvnYbadA5PjywXL_JrYAc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTI5Nzk1MzM5MDkzOTI1ODjIAQmoAwGqBMEBT9AeymfKhtvF_T50N_FMD1F5vS9eEhpZQkTpCl5WN4ZxkhrE_gsQZl2N-nTOsS1Yq4C8d-xnJx_qfruY5zjmkNs1amiFgpGFyYbIA3DBVPJT4vyXuSKkyaDQciGh9eJ_B4dfANITmZDb5PXVQ8g-a-eziVvwmLD52imX6IiB1sxF8fXeIbnQGVSRtQJiXu6jtUqTrTqo4_OxvQSAkYPqO6Vg6rKktDFuIdhrT9muBpkA8FJj2Y6hs50YqD3Dn38hW4AG-pm04aTW17RHoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_2F3rXOSmN2SJY-T-iomltj3Kdelw%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2979533909392588%26output%3Dhtml%26h%3D90%26slotname%3D7096521402%26adk%3D2342716466%26adf%3D3252783458%26pi%3Dt.ma~as.7096521402%26w%3D728%26lmt%3D1642593067%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fzvon.octo.net%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642593064576%26bpp%3D1%26bdt%3D257%26idt%3D3391%26shv%3Dr20220113%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Df136854c4f74a02a%253AT%253D1642593066%253AS%253DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q%26prev_fmts%3D728x90%26correlator%3D8687887389938%26frm%3D20%26pv%3D1%26ga_vid%3D114075819.1642593065%26ga_sid%3D1642593065%26ga_hid%3D1445575078%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D277%26ady%3D1205%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44753740%252C31063247%26oid%3D2%26pvsid%3D317451230437942%26pem%3D468%26tmod%3D62%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CoepEbr%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DWmuyo6q25y%26p%3Dhttps%253A%2F%2Fzvon.octo.net%26dtd%3D3393&ancestorOrigins=null&random=204306396729&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 73575f5ef67650a14f5ffc8bf024ec2258b2c0f049d1dc8294f0984f00ceb1fc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Wed, 19 Jan 2022 11:51:08 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2307
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 7C8D 43 B
705 B 36ms
12ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2846686&v=14098&q=409715&r=296283&pref1=23809100119332502179195011844029&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 04A2 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 19 Jan 2022 05:53:44 GMT
expires: Thu, 20 Jan 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 21444
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7C8D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 61fe41b9026ffa1074c1fe8f64ef44a4bc9114686368206ecaaaa7ffa9107a35

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK request_content.php Show response
hal90009.redintelligence.net/ Frame 0B9B 7 KB
3 KB 33ms
11ms Document
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request_content.php?s=45960600124697502179195011844009&a=1895ba9b
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=kfm7pdl6j5sw&nw=20&renderingType=javascript&namespace=af6b630b63&subid=&uid=2a87bc9d9300a7d9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYef7LAABNoUH_YHkfQJuOg%26mt_aid%3D2786250618466858501%26mt_id%3D8675613%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_cid%3Dd41261e7-fb2c-4601-8b42-9f50c68f337e%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvMbGLPvnYaekAvai7_UPyvKFyATPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yOTc5NTMzOTA5MzkyNTg4yAEJqAMBqgS7AU_QcyJPFM3ZaEXialIt75FVn5ost-WqVRRVzqE2mQfMq80askR82iOU2Tu9TTt6jxFVI5GHcCm_dQNyU4yGD0CIeJXAC1tRaSMzJPrnLRA6R9MtIQeKUhPH47MCHr9a6gLOMC1t_rTonBkfgHQ6_rxizHkrNPR0hVhzFlQqVZ9DwxVCW4x1eKxyEuJQl8g5Ibw0-Gtx-X4-GK03SSHHqyAXFW1h76RGG6JAX3m5NFGCOZ7Xd-ZO_apL-2OABvqZtOGk1te0R6AGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_10o7RqnDoxt849iQ1jUxr9-GLF_g%2526client%253Dca-pub-2979533909392588%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2979533909392588%26output%3Dhtml%26h%3D90%26slotname%3D4170394609%26adk%3D2715274491%26adf%3D2671285577%26pi%3Dt.ma~as.4170394609%26w%3D728%26lmt%3D1642593067%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fzvon.octo.net%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642593064573%26bpp%3D3%26bdt%3D254%26idt%3D3379%26shv%3Dr20220113%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Df136854c4f74a02a%253AT%253D1642593066%253AS%253DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q%26correlator%3D8687887389938%26frm%3D20%26pv%3D2%26ga_vid%3D114075819.1642593065%26ga_sid%3D1642593065%26ga_hid%3D1445575078%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D277%26ady%3D477%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44753740%252C31063247%26oid%3D2%26pvsid%3D317451230437942%26pem%3D468%26tmod%3D62%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CoepE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DK0d00K270j%26p%3Dhttps%253A%2F%2Fzvon.octo.net%26dtd%3D3390&ancestorOrigins=null&random=1313735767279&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Neulussheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9d7aba20a10e8d0a9271bccf318f6709fa366f7f8d1a2ba8cca9af540d4a05aa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Wed, 19 Jan 2022 11:51:08 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2306
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 855A 43 B
705 B 15ms
15ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2846686&v=14098&q=409715&r=296283&pref1=45960600124697502179195011844009&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 11:51:08 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame CD9A 89 KB
32 KB 123ms
39ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=23809100119332502179195011844029&a=b7b60911

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 22:26:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 134684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Jan 2023 22:26:25 GMT

GET
H2

200

evergreen-kis-728x90.jpg
media.kaspersky.com/de/affiliates/ Frame CD9A
Redirect Chain

https://www.awin1.com/cshow.php?s=2846686&v=14098&q=409715&r=296283&pref1=23809100119332502179195011844029&pv=0
https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

62 KB
62 KB

409ms
159ms

Image
image/jpeg

93.159.228.11
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=23809100119332502179195011844029&a=b7b60911

Protocol

Server

93.159.228.11 , Switzerland, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

1eeaa9afd461c6df55ffad40e5b003b9f2303727cc0276e677cf61bf9023284a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 12:09:22 GMT
server
x-powered-by: Kaspersky Labs, Kaspersky Labs
etag: "8ece3b5a61a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
x-xss-protection: 1; mode=block
x-server: msk2/FRA3
accept-ranges: bytes
content-length: 63391
date: Wed, 19 Jan 2022 11:51:08 GMT

Redirect headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK iframe Show response
sync.mathtag.com/sync/ Frame A970 652 B
764 B 45ms
17ms Document
text/html 185.29.134.248
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.mathtag.com/sync/iframe?mt_uuid=d41261e7-fb2c-4601-8b42-9f50c68f337e&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
Requested by: Host: sync.mathtag.com
URL: https://sync.mathtag.com/sync/js?sync=auto&source=bidder&mt_lim=1&type=1&synclist=4&gdpr=1&gdpr_consent=li
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.248 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4133 baa842e master cdg-pixel-x4 config:1.0.0 /
Resource Hash: 4c5325edabfb7a618fea7fb98d21d0940c941d4533c4e337923515685808a056

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Wed, 19 Jan 2022 11:51:08 GMT
Content-Type: text/html
Connection: close
Access-Control-Allow-Origin: *
Server: MT3 4133 baa842e master cdg-pixel-x4 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Expires: Wed, 19 Jan 2022 11:51:07 GMT
Content-Encoding: gzip

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 352F 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 19 Jan 2022 05:53:44 GMT
expires: Thu, 20 Jan 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 21444
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 855A 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fdd5bbfbd12144ccfb40d36c587a26e0b58834a769854254acec64e487481da8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK img
sync.mathtag.com/misc/ Frame 855A 43 B
550 B 49ms
20ms Image
image/gif 185.29.134.248
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/misc/img?mm_bnc&gdpr=1&gdpr_consent=li&bcdv=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.248 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4133 baa842e master cdg-pixel-x26 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:09 GMT
Server: MT3 4133 baa842e master cdg-pixel-x26 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 04A2
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELDL37g-oQhssthHUDOjXhw&google_cver=1&google_push=AYg5qPIJtDbdUnzYFG_IAXv_qiIZXI3eEUdx0JFN82TiUhGZ1fc8kZjGar...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIJtDbdUnzYFG_IAXv_qiIZXI3eEUdx0JFN82TiUhGZ1fc8kZjGaraLDFFfV4rHx6CVXO7YlPp6GQqUABLQk0BkwWPvJ_FH&google_hm=PTTUKb...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIJtDbdUnzYFG_IAXv_qiIZXI3eEUdx0JFN82TiUhGZ1fc8kZjGaraLDFFfV4rHx6CVXO7YlPp6GQqUABLQk0BkwWPvJ_FH&google_hm=PTTUKbxyhU-yipWHmdxeCg

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPIJtDbdUnzYFG_IAXv_qiIZXI3eEUdx0JFN82TiUhGZ1fc8kZjGaraLDFFfV4rHx6CVXO7YlPp6GQqUABLQk0BkwWPvJ_FH&google_hm=PTTUKbxyhU-yipWHmdxeCg
pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 04A2 42 B
317 B 22ms
20ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPL610SG4MFAo_vssZtyHNvfB66hw7ovul4rww_xgd6YsyuzkNQtUbH_os4soa7jR3huVp9mAFnKVV9UoJU0f3GeafFkiTLw&google_gid=CAESEEcKBXkiDkBllUO_UVhHa88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:09 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3 200 dds
rtb.openx.net/sync/ Frame 04A2 43 B
64 B 39ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEANspoTDxZGYLgrCBWCT0c8&google_cver=1&google_push=AYg5qPJx4lNOQlERA3tP89H1ZAIBc1C8EREpgnJG6_bFBu3hQDMbPsMCxojqemFlaqxW1SIaK6qZNFn-jlJI68fQ0FMaYMtwBxc
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=7096521402&adk=2342716466&adf=3252783458&pi=t.ma~as.7096521402&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064576&bpp=1&bdt=257&idt=3391&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=1205&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=Wmuyo6q25y&p=https%3A//zvon.octo.net&dtd=3393
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 12h741e5lccs028jmnfn3pflqrooavd3

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 04A2
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKEUcK0Pi3m5kpdTQVCLxwfFlywaqAzQzkm6IMTOgDtlioBVuwRNkoSTF5VTMkboNBgGHi45-sdPjU5yC7lQNRAnl0r-zHt

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKEUcK0Pi3m5kpdTQVCLxwfFlywaqAzQzkm6IMTOgDtlioBVuwRNkoSTF5VTMkboNBgGHi45-sdPjU5yC7lQNRAnl0r-zHt
date: Wed, 19 Jan 2022 11:51:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 04A2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEPRmxUqjHKe3yeqQZchjLU&google_cver=1&google_push=AYg5qPLx4noRMxc2KMD8tRD4v3d9oOx0ZwYgRqcpKus6MhdKQlYkYKR1iQz7P060rVeXdyFyIRs...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzTFctMUYtNTk4UQ==&google_push=AYg5qPLx4noRMxc2KMD8tRD4v3d9oOx0ZwYgRqcpKus6MhdKQlYkYKR1iQz7P060rVeXdyFyIRs262Az7XDvLfJb-6Jqod8sF75x

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzTFctMUYtNTk4UQ==&google_push=AYg5qPLx4noRMxc2KMD8tRD4v3d9oOx0ZwYgRqcpKus6MhdKQlYkYKR1iQz7P060rVeXdyFyIRs262Az7XDvLfJb-6Jqod8sF75x

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzTFctMUYtNTk4UQ==&google_push=AYg5qPLx4noRMxc2KMD8tRD4v3d9oOx0ZwYgRqcpKus6MhdKQlYkYKR1iQz7P060rVeXdyFyIRs262Az7XDvLfJb-6Jqod8sF75x
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 04A2
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_cver=1&google_push=AYg5qPJL38QrxtKDIMe1ReZtnyT2QpW4cGRMAjGiEslAsm8ZENAin3lLAMu2Q-GOUQEXczkGuDOC...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 04A2
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECJJoj6OdHp-9sp0_mn9ebQ&google_cver=1&google_push=AYg5qPLAay26iIdX59sspVzO...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLAay26iIdX59sspVzObSLwsD6rKRMEqtOxre5urUcRwvf0SmxvJDuDYyPtSw6kXmsO0l8oP8P-7eKqKbroE4K6wCXZGUPp&google_hm=

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLAay26iIdX59sspVzObSLwsD6rKRMEqtOxre5urUcRwvf0SmxvJDuDYyPtSw6kXmsO0l8oP8P-7eKqKbroE4K6wCXZGUPp&google_hm=

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLAay26iIdX59sspVzObSLwsD6rKRMEqtOxre5urUcRwvf0SmxvJDuDYyPtSw6kXmsO0l8oP8P-7eKqKbroE4K6wCXZGUPp&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 18 Jan 2022 11:51:09 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 04A2 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LHR7XCDuuVE8MIAobLJjpJMjzatm15y16-vPIwUJYfo1AIsxX8O4u5NJcLzgrfHnJyFzxh5w

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 818F 17 KB
6 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:09 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame 0B9B 89 KB
32 KB 109ms
80ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=45960600124697502179195011844009&a=1895ba9b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 22:26:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 134684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Jan 2023 22:26:25 GMT

GET
H2

200

evergreen-kis-728x90.jpg
media.kaspersky.com/de/affiliates/ Frame 0B9B
Redirect Chain

https://www.awin1.com/cshow.php?s=2846686&v=14098&q=409715&r=296283&pref1=45960600124697502179195011844009&pv=0
https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

62 KB
62 KB

306ms
80ms

Image
image/jpeg

93.159.228.11
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=45960600124697502179195011844009&a=1895ba9b

Protocol

Server

93.159.228.11 , Switzerland, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

1eeaa9afd461c6df55ffad40e5b003b9f2303727cc0276e677cf61bf9023284a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 12:09:22 GMT
server
x-powered-by: Kaspersky Labs, Kaspersky Labs
etag: "8ece3b5a61a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
x-xss-protection: 1; mode=block
x-server: msk2/FRA4
accept-ranges: bytes
content-length: 63391
date: Wed, 19 Jan 2022 11:51:08 GMT

Redirect headers

Date: Wed, 19 Jan 2022 11:51:09 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 352F 42 B
306 B 21ms
20ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKe9tELOiUUoASieagOY45JtOqJGF-L6nxaDQB3e0wxLp_o-6fo5DW2Oo6r9iz9d6RmupnMuiNjIBMR85q5WCfbVkrsMvd6&google_gid=CAESEEcKBXkiDkBllUO_UVhHa88&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 19 Jan 2022 11:51:09 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 352F
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIWy05v...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPIWy05vhGEy6mjjUjT9irCbqpb7ML5QKF9dqH3BJeK9cTAaBRNQ1aYrbXK9DFUNi6...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPIWy05vhGEy6mjjUjT9irCbqpb7ML5QKF9dqH3BJeK9cTAaBRNQ1aYrbXK9DFUNi63shDVelGxDx88Lhoi41FAz2HVpfMrw

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMTkxMTUxMDgwMDAxMTEyNzg0MDY0NA%3D%3D&google_push=AYg5qPIWy05vhGEy6mjjUjT9irCbqpb7ML5QKF9dqH3BJeK9cTAaBRNQ1aYrbXK9DFUNi63shDVelGxDx88Lhoi41FAz2HVpfMrw
pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 19 Jan 2022 11:51:09 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 352F 43 B
324 B 72ms
20ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEEE9gTIBPsByQMqqmnKcl70&google_push=AYg5qPLoCNYjPksoCo6Y4bVgLNAW10MEdISZ5S-lFx3dpXu0MHUVDgEQ9V9d3saoJGRrAtknVBWHFKiPnjy_7r2Ty_8Xwib-F6k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 352F 43 B
64 B 24ms
22ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEANspoTDxZGYLgrCBWCT0c8&google_cver=1&google_push=AYg5qPKUQJRxtMrkU5SxjAdDNDNmY0IA4kAZzVKIgOuXU_zDaDqo5Gj9rmfmi5I8Om9u4_cP9t_bCZfJKnAvId0qKaFhE9zKnfw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=90&slotname=4170394609&adk=2715274491&adf=2671285577&pi=t.ma~as.4170394609&w=728&lmt=1642593067&psa=0&format=728x90&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064573&bpp=3&bdt=254&idt=3379&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&correlator=8687887389938&frm=20&pv=2&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=277&ady=477&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoepE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=K0d00K270j&p=https%3A//zvon.octo.net&dtd=3390
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 25unumn9r7slajf8jmu7p0bb33bpgpds

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 352F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLRKxR4QTab64E4U9mRy-wbikkEGW_FBA8Ltfl_pLQ2Zu1dp179P5HLeOx4DEF-JGyNJff9FO6ZapJbuc7smnNEFAMobK-x

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLRKxR4QTab64E4U9mRy-wbikkEGW_FBA8Ltfl_pLQ2Zu1dp179P5HLeOx4DEF-JGyNJff9FO6ZapJbuc7smnNEFAMobK-x
date: Wed, 19 Jan 2022 11:51:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 352F
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEOMD4GGj0OAXRxA2vLkb8QA&google_cver=1&google_push=AYg5qPLHrTpHHGs_9NLZLsR34GlJdZi36cO6rbdMA4YdENPJ2_7p9toGSWxn3dbJmM-sSgPeQGA4k5Dad6cm9ID0KUYtHB5...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLHrTpHHGs_9NLZLsR34GlJdZi36cO6rbdMA4YdENPJ2_7p9toGSWxn3dbJmM-sSgPeQGA4k5Dad6cm9ID0KUYtHB5QcUYD&google_hm=gB6JdhQ4RTaQpbrH...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLHrTpHHGs_9NLZLsR34GlJdZi36cO6rbdMA4YdENPJ2_7p9toGSWxn3dbJmM-sSgPeQGA4k5Dad6cm9ID0KUYtHB5QcUYD&google_hm=gB6JdhQ4RTaQpbrHG7Kqgw

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLHrTpHHGs_9NLZLsR34GlJdZi36cO6rbdMA4YdENPJ2_7p9toGSWxn3dbJmM-sSgPeQGA4k5Dad6cm9ID0KUYtHB5QcUYD&google_hm=gB6JdhQ4RTaQpbrHG7Kqgw
pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 352F
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECJJoj6OdHp-9sp0_mn9ebQ&google_cver=1&google_push=AYg5qPLRbyRHaLgDOJAmZVYF...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLRbyRHaLgDOJAmZVYFjyQIrpsHWZNOb20Iyb-azR0rvKy2paI1okYZJpN26c0LmOEBxQrpT4UeJjJvjBE28I6Ehu-WWegO3g&google_hm=

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLRbyRHaLgDOJAmZVYFjyQIrpsHWZNOb20Iyb-azR0rvKy2paI1okYZJpN26c0LmOEBxQrpT4UeJjJvjBE28I6Ehu-WWegO3g&google_hm=

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLRbyRHaLgDOJAmZVYFjyQIrpsHWZNOb20Iyb-azR0rvKy2paI1okYZJpN26c0LmOEBxQrpT4UeJjJvjBE28I6Ehu-WWegO3g&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 18 Jan 2022 11:51:09 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 352F 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LIotwcu4trXds33f6SWtmCBdkUEVHkCVJCcG_SBRmyqRVacrLG1gFwGcGigB3lvh8fe3yfzw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK img
sync.mathtag.com/misc/ Frame A970 43 B
549 B 33ms
20ms Image
image/gif 185.29.134.248
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/misc/img?mm_bnc&gdpr=1&gdpr_consent=li&bcdv=0
Requested by: Host: sync.mathtag.com
URL: https://sync.mathtag.com/sync/iframe?mt_uuid=d41261e7-fb2c-4601-8b42-9f50c68f337e&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.248 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4133 baa842e master cdg-pixel-x9 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.mathtag.com/sync/iframe?mt_uuid=d41261e7-fb2c-4601-8b42-9f50c68f337e&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 11:51:09 GMT
Server: MT3 4133 baa842e master cdg-pixel-x9 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 43
Expires: Wed, 19 Jan 2022 11:51:08 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame BB30 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1642593067&psa=0&format=300x250&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064577&bpp=1&bdt=259&idt=3395&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=MOej8oGUbs&p=https%3A//zvon.octo.net&dtd=3396

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:50:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:50:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BB30 121 KB
37 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 19 Jan 2022 11:51:09 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/ Frame BB30 15 KB
6 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220113/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:34:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 997
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 11:34:32 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame BB30 0
0 81ms
80ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C21IRLPvnYcOSBILXygXl2rq4Csme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpApvooNm_BLM-qAMBqgS-AU_QQgd0LG9amYFqHw02d6YuP44Pc1HcHvMqia7x8aP-nFQpEpwrc-beaUCZ0vhbzViasbKQsAVPEYz45-q_TrqQHOp_P7qAzLOYdopHuQ169eiLTFJGltCKGWaLOBvuSmo5j_CkpQc3_F0DMkyaFVb9cpTA0MPlS_yDN0B9S-O4ptgzCu8wgOF3s2Nr-2A5LOdopbD-7ZZJFIFrYR1k6iXXyaT6crKmkLo4sgbSa8YFnT3G_dA-72BP9tgPSdSABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTI5Nzk1MzM5MDkzOTI1ODgYAA&sigh=_duySWQO8M0&uach_m=[UACH]&cid=CAQSPACNIrLMlzhNab2Qpd7aImzTo5KUwCvglpu2-1ES07UDagIdurHBqGPdqTK3E1DlzPDHCApb1NApMN620BgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1642593067&psa=0&format=300x250&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064577&bpp=1&bdt=259&idt=3395&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=MOej8oGUbs&p=https%3A//zvon.octo.net&dtd=3396
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 19 Jan 2022 11:51:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame BB30 0
0 260ms
15ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EN2BMKwC-gGdg2ICAgAAAHFaH-VbgSqAECz752GneoFZHaNAwdIzdAAS&wp=Yef7LAABCUMKsquCAA6tZVLkPc-2Vh3xaBG4Lw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 11:51:08 GMT
server: Kestrel
server-processing-duration-in-ticks: 229647
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 2B90 168 KB
54 KB 173ms
136ms Document
text/html 2a02:2638:1::11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yef7LAABCUMKsquCAA6tZVLkPc-2Vh3xaBG4Lw&u=%7CNy%2BPA1S73gFtewPhvuesM6MbEpwfsBSVfIqduq2Qpxg%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy_rqmQpy5dPsQBkbTap8cLnZe7BPRnP6cRxqWmTN9fAdN1GJy5QyLnrg0ncFq-G7kI38naEjVkPmpB6bSMCCV_JNrFhUFHh2eV6vtP1oz59o59tsh71JVp_SM7sk2BNuisGOhFOaBJ0I1HSy0CuTbg8_VonOK8Yqhmw776sdG0AUoNRBvNf4OQmJxy5MZqYsCmi6PwhziwYIAyO-z_zXvIEAxP7MB2j9pE8589SIkVD75taCkyzk6X_6bSqX931s2YlPgBxj91R-s0bNEcvkIbIptm8DLZKNSrdNwsYdip9SV6aoVJPDwKVc6j9Dl6f1CW9zrYsGK6tpB-Csmze1vKAy2BXd6LZBebeeVWRp4-eZlOGfOgFC7TawjV7MAFQwTY-wS1Pkl-e2&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXx-TLPvnYcOSBILXygXl2rq4Csme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItMjk3OTUzMzkwOTM5MjU4OKAB1bbS6gPIAQmpApvooNm_BLM-qAMBqgTBAU_QQgd0LG9amYFqHw02d6YuP44Pc1HcHvMqia7x8aP-nFQpEpwrc-beaUCZ0vhbzViasbKQsAVPEYz45-q_TrqQHOp_P7qAzLOYdopHuQ169eiLTFJGltCKGWaLOBvuSmo5j_CkpQc3_F0DMkyaFVb9cpTA0MPlS_yDN0B9S-O4ptgzCu8wgOF3s2Nr-2A5LOdopbD-7ZZJVoNK85rrdjZoVbBZoo8AaLMsuLDYRd6HKfX7WyKB8UxXc3KLWmtQbCiABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3L2k96yPYy14BaSwRh-Vi6WIxVgw%26client%3Dca-pub-2979533909392588%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

647e64de5945a62f54782070bfa892ae69b771a87a35937cb39c9064493bce0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Wed, 19 Jan 2022 11:51:09 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=kpGlLef8ouQl9y2zhWWhLhHd-1HxR4lPZbc8x6hgDiuNW81M9W7KKZPZmRxQ2C43VzlGgKOFwVv7jTIPI9FPLVXnVqMneGKIBcUjozJEaWDLeB0seDBxFjXmi8W2UVmCZQBoxcQl9QkNnQ6nn14dYDHhVTKOs-o9leq39GqBvxHR-yiY-tTvH8pVh5Gnk2axVGusABTmFuOiw5hpQZ1CUTr_ZtukVLrv78J0kaB_g9tCerDk8TArexroC-XknWDp2nQhWA"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 115614686
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4D2D 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 19 Jan 2022 05:53:44 GMT
expires: Thu, 20 Jan 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 21445
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js Show response
pagead2.googlesyndication.com/bg/ Frame D389 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VYSAmqkCqqI2p1vG7N0EZhME2mSBj47Ds8I6nIhDmP4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5584809aa902aaa236a75bc6ecdd04661304da64818f8ec3b3c23a9c884398fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 09:57:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13526
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Jan 2023 09:57:08 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4D2D 35 B
210 B 10ms
8ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELDL37g-oQhssthHUDOjXhw&google_cver=1&google_push=AYg5qPKPsh1e573ViNpCc4hXrWl7y-KadIgA6v9HLws0FgNhvGTcRfManBBz0Pq3QG6K-w1WdaTE28-65RaYa6Du4L4BylszVHs

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 4D2D 43 B
106 B 21ms
19ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEEE9gTIBPsByQMqqmnKcl70&google_push=AYg5qPIyZSUzTQxyBtAC_5U_Cu_fzUlcehAr5S_HG0o51EXbfqJbLxUvee9kBVvylSt-2UeltBVE4zVkU6ZTOkxdX47Vg17cCgI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1642593067&psa=0&format=300x250&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064577&bpp=1&bdt=259&idt=3395&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=MOej8oGUbs&p=https%3A//zvon.octo.net&dtd=3396
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 4D2D 43 B
64 B 41ms
39ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEANspoTDxZGYLgrCBWCT0c8&google_cver=1&google_push=AYg5qPKuIFGApVnKgLRLrdlK7SLLgI-dbFN-cjv3W_Cd9rXhk3N6cxSjevayzp-NZ6zkMvvh_36MeU2UpxlT5233uN-H7Z3FOw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2979533909392588&output=html&h=250&slotname=0787847652&adk=665242438&adf=3866777003&pi=t.ma~as.0787847652&w=300&lmt=1642593067&psa=0&format=300x250&url=https%3A%2F%2Fzvon.octo.net%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642593064577&bpp=1&bdt=259&idt=3395&shv=r20220113&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df136854c4f74a02a%3AT%3D1642593066%3AS%3DALNI_ManokQDRRYQzbH8hMOElk3igiUO3Q&prev_fmts=728x90%2C728x90&correlator=8687887389938&frm=20&pv=1&ga_vid=114075819.1642593065&ga_sid=1642593065&ga_hid=1445575078&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1039&ady=1319&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740%2C31063247&oid=2&pvsid=317451230437942&pem=468&tmod=62&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeopEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=MOej8oGUbs&p=https%3A//zvon.octo.net&dtd=3396
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:08 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 5jtq7dqlbemjtcsirk0utgi3e5imqdil

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D2D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI2RqVMtMBpsCVznt7RFu4v7lFOf-94X4OhX5fA2BJHFQT1iyx0P68ACZKiFoWKDxq_ZIail04tlH3ia0Cy12CREw33UfY

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=r-ij8u49R9OAbgQvk2Vl2Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI2RqVMtMBpsCVznt7RFu4v7lFOf-94X4OhX5fA2BJHFQT1iyx0P68ACZKiFoWKDxq_ZIail04tlH3ia0Cy12CREw33UfY
date: Wed, 19 Jan 2022 11:51:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D2D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEPRmxUqjHKe3yeqQZchjLU&google_cver=1&google_push=AYg5qPJiyrR-f-BSDqKtdnA10HP4-pyCRTLpef_5b21MF3rRPwfMEJnlNVtrRy9t1RhnF_MUL-w...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzT0gtMjgtQ1U0OQ==&google_push=AYg5qPJiyrR-f-BSDqKtdnA10HP4-pyCRTLpef_5b21MF3rRPwfMEJnlNVtrRy9t1RhnF_MUL-w10ElOqRIRcw51nPutwP-R02w

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzT0gtMjgtQ1U0OQ==&google_push=AYg5qPJiyrR-f-BSDqKtdnA10HP4-pyCRTLpef_5b21MF3rRPwfMEJnlNVtrRy9t1RhnF_MUL-w10ElOqRIRcw51nPutwP-R02w

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lMSEkzT0gtMjgtQ1U0OQ==&google_push=AYg5qPJiyrR-f-BSDqKtdnA10HP4-pyCRTLpef_5b21MF3rRPwfMEJnlNVtrRy9t1RhnF_MUL-w10ElOqRIRcw51nPutwP-R02w
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 4D2D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yef7LNQdqJXPSiGAMwFioAAABKIAAAIB&google_gid=CAESEN-9QPgpnJQdxgeMT2WfFdo&google_push=AYg5qPKFZ5On7vwEU48I7105wwb-gygkHhfwncivTf0jtF3YMVO...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D2D
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECJJoj6OdHp-9sp0_mn9ebQ&google_cver=1&google_push=AYg5qPKrA0IiA7g0VaUB55vZ...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKrA0IiA7g0VaUB55vZ8RAxWUlO0FX5z59KGQMhF9R_vIyOpVSRVBVa_ANr06UT-eMf4I6XJshEoKiGjHM1p2T_VFYsA3U&google_hm=

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKrA0IiA7g0VaUB55vZ8RAxWUlO0FX5z59KGQMhF9R_vIyOpVSRVBVa_ANr06UT-eMf4I6XJshEoKiGjHM1p2T_VFYsA3U&google_hm=

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 11:51:09 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKrA0IiA7g0VaUB55vZ8RAxWUlO0FX5z59KGQMhF9R_vIyOpVSRVBVa_ANr06UT-eMf4I6XJshEoKiGjHM1p2T_VFYsA3U&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 18 Jan 2022 11:51:09 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4D2D 0
12 B 47ms
46ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13INjnmTMWv4dEiiMRenkT8mT7TlksaU4EFS6o5Mrutfm6jU_32g4Kqev0o62BCMDV7_zXiauw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS